CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary

1

arXiv:2608.17068v1 [cs.CR] 17 Aug 2026

CUSTOS: Toward Forensic-Ready Zero Trust at the Capture–Containment Boundary Avinash Srinivasan

John Paramadilok

Department of Cyber Science United States Naval Academy Annapolis, MD, USA srinivas@usna.edu

Joint Cyber Center U.S. Space Command Peterson SFB, CO, USA john.paramadilok@usspacecom.mil

Disclaimer: The views expressed in this article are those of the author(s) and do not reflect the official policy or position of the U.S. Naval Academy, Department of the Navy, the Department of War, or the U.S. Government.

(PEP), and SP 800-207A extends the model to cloud-native applications [5], [6]. Together they replace implicit location-based trust with continuous, identity- and policy-driven verification. This shift changes what investigators can observe and preserve. Conventional workflows often assume that compromised systems persist, network payloads remain inspectable, and hostnames or IP addresses remain stable enough for attribution. ZT weakens these assumptions: automated remediation may terminate ephemeral workloads before acquisition, mutual TLS (mTLS) obscures payloads from passive collectors, and identitycentric authorization distributes attribution across subjects, devices, claims, policy decisions, and short-lived sessions. These effects compound during valid-identity abuse. A detector may flag a request and terminate the workload before acquisition, reclaiming memory and ephemeral state containing injected code, staged data, or live connections; session revocation may instead remove session and flow context. Such abuse is recognized late because it looks authorized: SolarWinds actors forged valid SAML tokens that produced apparently legitimate access [7], [8], while in the CircleCI breach malware stole a single sign-on (SSO) cookie already cleared by multifactor authentication (MFA), and the investigation rested on authentication, network, monitoring, and system-log records [9]. Rapid containment can therefore succeed while leaving too little evidence to reconstruct the intrusion. ZT therefore creates a direct conflict between containment and preservation. We call containment-induced loss of volatile Index Terms—Zero Trust Architecture, zero trust reference architecture, reference architecture, zero trust forensics, digital state the forensic shredder effect; it creates a forensic gap forensics, forensic readiness, incident response, chain of custody, between the system’s ability to stop an incident and the inidentity-centric security, provenance, capture–containment race. vestigator’s ability to reconstruct it. Few prior systems make forensic readiness a ZT control-plane function [10], [11], [12]. Our central claim is that forensic-ready ZT requires an I. I NTRODUCTION always-on decision-provenance floor plus richer capture conZero Trust (ZT) has progressed from an emerging phistrained by a measurable time window and budget. CUSTOS1 losophy [1], [2] to an established enterprise security model. operationalizes that requirement through the proposed Forensic Executive Order 14028 and OMB M-22-09 set federal ZT Management Point (FMP). implementation requirements across identity, devices, networks, Contributions. Table I distinguishes architectural, impleapplications, and data [3], [4]; NIST SP 800-207 defines the mented, measured, modeled, and out-of-scope claims. The Policy Decision Point (PDP) and Policy Enforcement Point paper contributes:

Abstract—Zero Trust (ZT) replaces implicit trust with continuous verification, but mutual TLS, ephemeral workloads, identitycentric control, and automated remediation reduce payload visibility, weaken IP-based attribution, and shrink the window for acquiring volatile evidence. We propose CUSTOS, a forensic-ready ZT reference architecture centered on a Forensic Management Point (FMP) that coordinates tiered capture, identity- and policylinked reconstruction, telemetry orchestration, and ZT-controlled investigative access. We evaluate a composed, component-level prototype using a live enforcement gateway plus separate runtime and orchestrator experiments. An always-on decision record is captured and hash-chained on the gateway at a 1.9–3.0% throughput cost on in-process policy engines, preserving decision provenance outside the monitored workload under the stated trust assumptions. Reactive checkpointing (≈65 ms) precedes seconds-scale defender-routed eviction but loses to unsequenced direct SIGKILL (≈9 ms), in-kernel enforcement, and adversarial self-destruction, producing the forensic shredder effect. On a real container, concurrent capture and SIGKILL recovered the planted secret in 0/1000 trials; sequencing SIGKILL behind the FMP barrier recovered it in 1000/1000. The primary integrated single-node Kubernetes race checkpoints an FMP-controlled process; container-memory capture is evaluated separately and was unavailable in the evaluated managed-Kubernetes configuration. Across five public benchmark datasets and a synthetic schema reference, identity-oriented telemetry populates 64–75% of the decision-record schema against 18–30% for network-oriented, while rate limiting bounds the full-memory admission ceiling. These results show that forensic-ready ZT requires both an always-on evidentiary floor and bounded reactive capture, while identifying where volatile evidence remains unrecoverable.

This manuscript is being submitted to the IEEE Transactions on Information Forensics and Security for possible publication.

1 CUSTOS: Latin for guardian, keeper.

2

TABLE I: Scope of the CUSTOS architecture and evaluation. Measured values are reported in Section VI. Evidence level Proposed architecture Implemented components Measured Replay and modeling Not evaluated

What it covers Forensic Management Point (FMP) reference architecture: policy-triggered tiered capture, identity- and policy-linked reconstruction, telemetry orchestration, and ZT-controlled investigative access. FMP capture hook on a live FastAPI PEP (OPA, Cedar, Casbin), plus the hash-chained decision-record pipeline, capture and sequencing harness, Checkpoint/Restore in Userspace (CRIU) capture path, detector adapters, evidence-ledger tooling, and an integrated k3s ordering demonstration; exercised as components, not as one integrated deployment. Live-gateway overhead across three policy engines; CRIU full-memory process checkpoint; the real-container sequencing-barrier experiment; containment from direct SIGKILL to forced and grace-period Kubernetes eviction; adversarial self-destruction; first-attempt C2-socket recovery under two detectors; and post-anchor tamper detection. Storage and full-memory rate-cap models, telemetry-schema coverage and full-memory admission ceilings across five empirical sources and one non-empirical schema reference, detector-recall sensitivity, and a decision-record-only baseline. Production identity provider (IdP)/multi-cloud deployment, production-load integrated container/session/microsegment capture, live microsegment packet capture, successful cross-source incident reconstruction, coordinator and evidence-path failure, and joint detector precision–recall.

A forensic-ready ZT reference architecture. CUSTOS centers on an FMP that coordinates policy-triggered tiered capture, identity- and policy-linked reconstruction, telemetry orchestration, and ZT-controlled investigative access (Sections IV–V). • An anti-forensic threat model. An FMP-aware adversary can induce rapid containment or destroy local state, making the relation between capture time tC and evidencedestruction time tR adversary-influenced rather than a property of the defender alone and motivating an alwayson gateway-side record (Section II-B). • A measured capture–containment race. We measure full-memory capture of an FMP-controlled process on bare metal and integrated single-node k3s; container-memory capture is evaluated separately. Containment and detection are additionally measured on managed Kubernetes. Loss L = Pr[tC ≥ tR ] follows the locus and speed of memory destruction rather than nominal grace periods, and a controlled real-container barrier experiment isolates sequencing as the cause (Section VI). • Telemetry-schema coverage and capture bounds. Replaying five public benchmark datasets against a synthetic schema reference, identity-oriented telemetry populates 64–75% of the decision-record schema versus 18–30% for network-oriented, and a rate cap bounds the fullmemory admission ceiling; these bound field availability, not demonstrated reconstruction (Section VI). •

II. BACKGROUND AND M OTIVATION A. Research Questions (RQ) and Evaluation Framework This paper addresses three research questions: RQ 1: How much of the FMP decision-record schema can identity- and network-oriented telemetry populate, bounding forensic fidelity and correlation? RQ 2: Under what timing conditions can automated containment or adversarial self-destruction destroy volatile evidence before capture, and what sequencing requirement follows? RQ 3: At the evaluated operating points, what request-path overhead, storage footprint, and full-memory admission ceiling result from tiered capture and the full-memory rate cap? RQ 1 evaluates fidelity (whether a record preserves sufficient state and metadata) and correlation (whether records retain the temporal and shared identity, device, session, trace,

and decision identifiers needed for joins). Telemetry-schema coverage is a limited proxy for the reconstruction context available: it measures source-field presence across identity, identity attributes, action, resource, risk context, verdict, and temporal-order resolution. Of the correlation identifiers above, the seven-element score covers only identity and timestamp resolution; device, session, trace, and decision identifiers remain outside it. It therefore neither tests joins nor demonstrates incident reconstruction. Availability (capture, retention, and accessibility) is not a schema property and is evaluated separately. RQ 2 uses capture time tC , evidence-destruction time tR , and loss rate L = Pr[tC ≥ tR ]. Both share one origin, the instant the response is triggered: tC runs to capture completion, a closed local acquisition artifact on the evaluated CRIU path excluding durable evidence-store commit; tR until that artifact becomes unavailable. RQ 3 evaluates request-path overhead, retained storage, and the full-memory admission ceiling. Scope and assumptions. We assume a hybrid enterprise in which perimeter evidence is supplemented by host and endpoint artifacts. We focus on ZT’s direct effects on chokepoint visibility, stable identifiers, persistent workload state, and centralized packet capture. The vendor-neutral model follows NIST SP 800-207 and SP 800-207A [5], [6], with an identity provider (IdP), PDP, PEPs, and telemetry pipeline. The component-scale evaluation combines microbenchmarks, a live FastAPI enforcement gateway, analytical models, and schema projections over replayed telemetry datasets; it excludes production IdPs and end-to-end multi-cloud telemetry (Section VI-G). Appendix A maps the technical properties that may support admissibility, authenticated provenance, detectable alteration, documented custody, reproducible processing, and preservation of relevant evidence, to the applicable evidentiary rules and ISO/IEC standards; admissibility remains case-specific, and the prototype establishes neither admissibility nor production cryptographic validation.

B. Threat Model and Security Goals System, assets, and trust. Protected requests traverse a PEP and are adjudicated by a PDP using identity, device, resource, and risk context. High-risk signals may trigger session termination, credential revocation, quarantine, or isolation. The FMP adds a routine decision record, targeted session/flow artifacts, and rate-limited full-state capture. Protected properties are

3

volatile incident state, decision provenance, and evidence in- a token alone does not establish attribution. A ZT forensic tegrity. The trusted computing base comprises the FMP capture workflow follows NIST SP 800-86’s collection, examination, path and evidence-store root, including its signing service, key, analysis, and reporting lifecycle [13], supplementing disk and and periodic anchor; workloads, requesters, the network, and packet evidence with workload snapshots, IdP records, policy privileged insiders, including operational administrators and decisions, enforcement events, and session or flow metadata. investigators, are untrusted. This boundary is custodial rather Forensic readiness. Forensic readiness requires preserving than organizational: privilege over the monitored environment volatile evidence and correlation identifiers before defenderdoes not imply control of the evidence root. The prototype routed destructive response. Reconstruction under continuous co-locates the capture hook with the PEP (Section VI-G). A verification needs persistent, correlatable identifiers; identitycompromised PEP, PDP, or source may suppress or forge its centric policy requires each decision’s attributes; microsegmensignals but is not assumed to control the evidence root or tation requires records aggregated across enforcement points; alter anchored records undetected; the tail since the latest and least privilege requires just-in-time investigative access. anchor remains externally unanchored. Anchoring detects post- A PDP risk or forensic-interest signal may therefore trigger anchor alteration under an uncompromised signing service preservation before confirmation on posture, behavior, privilege, and evidence root, not semantic falsity; policy and detector or sensitive-export indicators, consistent with ISO/IEC 27043’s anticipatory-collection objective [14]. The gap spans RQ 1 and correctness remain out of scope. Adversaries and timing threat. We consider three adversary RQ 2: encryption or incomplete telemetry reduces fidelity, fragcases. A1 is a foothold attacker with a stolen credential or mented identifiers reduce correlation, and termination reduces compromised host; A2 is a malicious insider; and A3 denotes availability through the capture race. Section V presents the anti-forensic capability rather than a mutually exclusive actor FMP as the architectural response to this gap. class. An A1 or A2 adversary that learns FMP behavior may III. R ELATED W ORK exercise A3 by inducing rapid containment or destroying local state, hence its objective set subsumes theirs. Objectives are A. ZT Guidance and Security Telemetry response-induced evidence destruction (TO1), evasion of richer ZT research and federal guidance emphasize architecture, capture (TO2), record forgery/tampering (TO3), capture-budget access control, deployment, visibility, and coordinated redenial of service (DoS) (TO4), and repudiation (TO5). Evisponse [15], [16], [17], [18], but rarely treat preservation of dence is lost when tC ≥ tR ; A3 can reduce tR , and integrity volatile evidence, identity-linked provenance, or custody as a protects only artifacts captured in time. The gateway creates control-plane objective. Security information and event manthe routine record inline outside the monitored workload, so agement (SIEM) and security orchestration, automation, and reit survives workload self-destruction, but queued persistence sponse (SOAR) systems coordinate detection and response [19]; leaves gateway-crash durability unresolved. Targeted capture is causal identifiers and provenance logs improve correlation and asynchronous, and full-state capture is most exposed. Table XII auditability [20], [21]. Commercial and cloud playbooks can maps adversary cases to objectives (TO#) and security goals automate acquisition before isolation, including memory and (G#). Section VI measures CRIU memory/task checkpoints, disk, but do not provide a capture-before-destruction sequencing writable-area exports, response profiles, and self-destruction; requirement, identity/policy-linked capture admission, and an live microsegment capture remains future integration. explicit capture budget as one ZT control-plane function. Goals and exclusions. The security goals follow directly from Host-provenance systems reconstruct attacks from prothe threat model and define what the FMP is intended to cess/file audit graphs and recover attack stories [22], [23]; preserve and bound. The FMP targets capture before defendertamper-evident trees protect history [24]. CUSTOS instead routed destructive containment (G1), preservation of availoperates at the ZT decision plane, complementing host lineage able decision provenance (G2), integrity and authenticated with subject, device, policy, and enforcement context. provenance (G3), binding of evidence to available identity context (G4), and bounded operational cost (G5). The prototype demonstrates G1 ordering for an FMP-controlled process on B. Forensic Readiness and Cloud Acquisition Zero Trust Digital Forensics treats tools, sources, and ink3s; it does not provide integrated container-memory capture or a production guarantee. Table I summarizes the implementation termediate conclusions as untrusted [10]. This perspective and evaluation support for G2–G5. Policy and detector correct- motivates externalized records, provenance, and separation ness, collusion among authorization roles, compromise of the of duties but not ZT-native collection. Among forensic-ready evidence root, and side-channel, physical, and supply-chain ZT proposals, Alnajjar et al. provide a two-tier industrial IoT attacks are out of scope. Table XV maps the threat objectives model [30]; ZETA is network-centric and readiness-assessment oriented [11]; and ZTForensics demonstrates a functional prototo FMP mechanisms and supporting evidence. type coupling centralized ZT enforcement with tamper-evident decision logging [12]. CUSTOS extends beyond decision logC. Forensic Evidence and Readiness in ZT ging to tiered volatile-state preservation and experimentally Identity and lifecycle. A ZT decision draws on principals, characterizes the capture–containment boundary. Container authentication assertions, device posture, claims, workload checkpoint forensics is the closest acquisition work: ConPoint identity, and delegation, but reconstruction also needs the policy collects CRIU container checkpoints for memory forensics and version, request trace, enforcement point, and data classification: evaluates their acquisition latency [25], and Forensic Snapshot

4

TABLE II: Representative capabilities (✓ implemented/evaluated; ∼ architected/partial; — not reported). Measured overhead is request-path cost, not acquisition latency or storage. Approach Neale et al. [10] ZETA [11] ZTForensics [12] ConPoint [25] FSC [26] SecLaaS [27] Cloud/forensics as a service [28], [29] CUSTOS (ours)

Control-plane integration — ∼ ∼ — — — —

Volatile-state capture — — — ✓ ✓ — —

∼

✓

ID/policy-linked reconstruction — — — — — — — ∼

Chains (FSC) captures alert-triggered high-frequency container snapshots and reconstructs incident timelines from the resulting chain, with measured performance and storage overhead [26]. To our knowledge, none measures volatile-state capture directly against destructive containment; ConPoint and FSC evaluate checkpoint-based acquisition without modeling that race. Cloud systems address complementary pieces. NIST’s cloud forensic reference architecture defines forensic readiness for cloud deployments [31]; CUSTOS couples preservation to ZT decisions and measures capture against containment. Adaptive collection is the lineage of our tiering and budget: selective rather than exhaustive gathering [32], formally derived preservation requirements that retain the minimum relevant to a future investigation [33], and adaptive observability for evidence destroyed when containers terminate [34]. These address what evidence to collect, not whether volatile acquisition completes before a destructive deadline. SecLaaS protects durable logs [27]; cloud-acquisition studies expose trust across provider layers [35]; and cloud- and forensics-as-aservice proposals service-enable acquisition and analysis [28], [29]. Their emphasis is logging or acquisition rather than orchestration across IdP, PDP, PEP, and workload layers.

Tamper-evident integrity ∼ — ✓ — — ✓ ∼

Measured overhead — — ∼ — — ✓ —

Capture–containment race

✓

✓

✓

— — — — — — —

workload, stopping the threat while destroying unexternalized memory, command history, caches, active connections, and inmemory keys. The outcome depends on how quickly response reaches the workload: evaluated orchestrator eviction was slow enough for capture, whereas direct/in-kernel termination and self-destruction were not (Section VI). Compressed volatility and fragmentation. In serverless runtimes, memory may hold decrypted payloads, credentials, or session keys for only a single invocation, and unexternalized container memory vanishes with the instance [25], [26], [34]. Interfaces, flow state, and tokens separately disappear or expire as workloads scale and sessions are re-authorized. A single user action also spans IdP, PDP, PEP, and application components. Unlike a monolithic disk image, the resulting evidence is distributed across identity records, policy decisions, enforcement logs, and workloads that may vanish, forcing correlation despite missing context and clock uncertainty.

B. The Encryption Blind Spot: mTLS and Application-Layer Encryption ZT service-to-service deployments commonly use mTLS, and applications may add application-layer encryption (ALE). These controls strengthen confidentiality but make applicaC. Synthesis and Research Gap tion headers and bodies opaque to passive collectors; timing, Prior work provides the constituent mechanisms, but not their endpoints, and volume remain visible, but not commands or joint use as a bounded ZT control-plane function. CUSTOS uses exfiltrated content. An endpoint authorized to decrypt may hold policy or forensic-interest signals to select capture tiers before plaintext in memory unless ALE keeps it encrypted beyond defender-routed destructive response, links artifacts to available transport termination. identity and policy context, and rate-caps expensive full-state Forward secrecy and key location. TLS 1.3 (EC)DHE and acquisition. Its evaluation measures the capture–containment PSK+(EC)DHE handshakes provide forward secrecy [36], so boundary rather than assuming reactive acquisition succeeds. later seizure of a long-term server key cannot decrypt those sessions; PSK-only mode is the exception. Retrospective deTable II summarizes the distinction. cryption therefore requires both the recorded ciphertext and traffic secrets exported during the connection or recovered from IV. T HE C HALLENGES : F ORENSIC H URDLES IN ZT volatile endpoint state; memory acquisition may instead yield Section I outlined how cloud-native ZT deployments weaken plaintext directly. Either path recovers transport plaintext only: three legacy forensic assumptions. This section develops each payloads separately protected by ALE remain opaque. ALE in turn: ephemerality, encryption, and attribution. further shifts the acquisition point. Holding the key in a keymanagement service or hardware security module (HSM) does A. The Ephemerality Crisis not mean plaintext never exists; it means the transport endpoint Cloud-native applications combine microservices with con- may never contain it, so capture must occur at whichever tainerized and serverless runtimes whose instances may be component decrypts and holds the decrypted state. short-lived. The runtime itself is disposable, which changes Inspection trade-offs. TLS-inspection middleboxes can restore transport-layer visibility for traffic they terminate, but not what can be acquired. Auto-remediation. A response workflow driven by a PDP de- for payloads under independent end-to-end ALE, and they cision or detector alert may isolate and replace a suspicious concentrate key material in a privileged failure point that

5

adds decrypt/re-encrypt overhead. Zero Trust Network Access gateways may retain session metadata without payloads, and short retention can remove even that source. Encryption is consequently both a defensive shield and a forensic blindfold. C. The Attribution Paradox: Identity vs. IP Transient addressing makes IP addresses weak attribution anchors on their own, shifting reconstruction toward identity, device posture, certificates, tokens, and policy context. This improves policy precision but creates four challenges: 1) Identity translation fragments attribution. OAuth token exchange supports impersonation and delegation [37], and SAML mapping, service-mesh identities, cloud roles, and successive service accounts may replace the initiating identity; reconstruction must preserve the subject and actor chain across boundaries. 2) Identity detaches from location. Activity may span IPs, services, regions, and policy boundaries. Binding 10.1.5.20 to User A at a precise instant requires time-resolved identity, session, gateway, and address-allocation records, synchronized clocks, and sufficiently precise logs. 3) Continuous authorization fragments the record. Reauthentication and policy re-evaluation need not open new sessions, producing successive decisions that investigators must correlate using token, trace, and decision records. 4) Service identities obscure actors. An attacker can live off the identity, issuing well-formed API calls under a stolen service credential that leave limited host artifacts and little network evidence visible to signature-based detection, though application and cloud audit records may retain them. Investigators must separate malicious calls from legitimate automation using the same principal, which analytics tuned to human behavior are not designed to do. These hurdles shift investigations from stable artifacts toward timely, correlated, identity-aware telemetry, motivating the architecture that follows. V. T HE CUSTOS R EFERENCE A RCHITECTURE Figure 1 summarizes the proposed reference architecture, which integrates forensic-ready capture and evidence handling with the ZT control plane. Perimeter-less environments limit reliable host access and passive collection. Section VI evaluates a component-level proof-of-concept subset. Although ZT disrupts traditional forensic practice, its identity-rich, policydriven telemetry creates four opportunities: policy-triggered state capture, preserving volatile evidence before containment destroys it; identity- and policy-linked reconstruction, tying events to available authenticated identity, device, and policy context rather than transient IPs; telemetry orchestration, an integrity-protected pipeline of identity, workload, and enforcement records; and ZT-controlled investigative access, applying the same policy discipline to the investigation itself. A. FMP Input/Output Contract The FMP operates downstream of the identity, policy, enforcement, and detection stack through a control-plane interface.

It does not hold or alter the PDP decision for capture; routine record generation remains inline and adds the measured request-path latency (Section VI). Sequencing applies only to subsequent defender-routed destructive remediation. Inputs include PDP decisions (verdict, policy version, risk or forensicinterest signal), PEP enforcement events, IdP claims, detector alerts, and workload/session metadata. Outputs include tiered PEP/runtime capture commands, integrity-protected evidence bundles, per-decision provenance records, and just-in-time investigator-access decisions. The FMP sequences capture and coordinates cross-source case assembly. It is trigger-decoupled: it consumes upstream signals but generates no risk score. Under the threat model of Section II-B, cross-source correlation may reveal forgery or omission by a compromised PEP, PDP, or source but cannot guarantee detection, and upstream-detector recall remains an external dependency analyzed only through sensitivity. B. Policy-Triggered State Capture A risk or forensic-interest signal can trigger preservation before volatile evidence disappears. The FMP selects a tier and invokes PEP, runtime, or SOAR actions to preserve workload memory, authorized session or microsegment traffic, and ephemeral logs before termination. 1) Tiered Capture at Scale: Because PDPs may issue thousands of decisions per second, capturing each in full is infeasible. The FMP therefore applies three tiers: 1) Routine decision record (always-on): records action, resource, verdict, policy version, request trace ID, and any available authenticated identity and device context for every decision. 2) Targeted preservation (event-triggered): asynchronously preserves validated claim metadata, a token hash rather than the bearer secret, request metadata, and session or microsegment flow records for constrained, challenged, or anomalous decisions. 3) Workload-scoped full-state capture (rare and rate-limited): where operator-controlled runtime access permits, preserves process memory and execution state, the writable container filesystem, and authorized packet captures for events classified as high risk. It is scoped to the workload at that runtime boundary, not to global infrastructure or remote service state, and its components are captured sequentially rather than as one mutually atomic snapshot. Throughout, fullstate names this tier and full-memory its measured memory component, the CRIU checkpoint the cap is sized against. Every event receives routine capture; an escalated event additionally receives either targeted or full-state capture. Live microsegment flow/packet capture remains a production integration task (Section VI). Events exceeding the full-state budget receive targeted preservation. Admission policies may partition the full-state budget by identity or source to limit capture-budget DoS. Section VI-F evaluates per-identity budgeting, although the prototype does not deploy it. 2) Detection Inputs and Limits: The FMP consumes rather than replaces upstream signatures, behavioral or anomaly analytics, and threat intelligence. A single anomaly may trigger

6

CUSTOS Forensic-Ready Zero Trust Reference Architecture

PDP — Policy Decision Point

token

2

Policy Engine + Administrator · allow / deny

correlates identity · session and workload telemetry

enforce

execution & resources

DATA PLANE

DFIR & Response Orchestration

Workload / Resource Fabric — provisioned execution environment Execution Runtime

Workload (container / VM / serverless)

Delegated principal

image digest / workload ID

subject → delegate (e.g., agent)

Process

Storage

Network

memory / state

FS / volumes

flows / pcap

API / Service Sessions service identity · delegation

full-state capture depends on runtime access 3

PEPs govern ingress and service-to-service access.

Token-hash / Auth logging 1

API / Workload Audit

actor · action · result · time / trace

origination · replay investigation

requests capture consumes evidence coordinates containment

control / evidence telemetry / trigger containment / evidence risk

Auto-response (containment) session kill · quarantine can destroy evidence before capture

#

logging point

release after capture completion or window expiry

capture command / telemetry

FORENSIC

Detection & Hunting

PEP(s) — Policy Enforcement · Gateway / Sidecar / Agent

Privileged (isolated)

durable commit continues asynchronously

INFRASTRUCTURE FORENSIC MANAGEMENT POINT (FMP)

tamper-evident custody records

device · asset · threat posture informs policy and collection

policy context

Service account

Evidence Store + Provenance Ledger

Threat Intelligence & Risk Context

decision · policy version · context

decision Person / Persona

SECURITY OPERATIONS (SOC)

Authorization logging

risk / detector trigger

Authenticates · issues tokens logs events

authorization decisions

CONTROL PLANE

IDENTITY PROVIDER

IdP / IdM · federated SSO

CONTEXT / ASSURANCE Tiered Collection + Integrity routine record · targeted session/flow full memory/FS

Preserved evidence supports DFIR & evidentiary review.

Capture & Sequencing Coordinator trigger · tier · release

SIEM / Case Management investigation record · search · evidence access

External Context IP · domain · cert · reputation

Evidentiary Objectives Integrity · Availability Correlation · Fidelity

Fig. 1: CUSTOS forensic-ready ZT reference architecture across identity, control, enforcement, and data planes. The FMP gates defender-routed destructive containment until capture completion or capture-window expiry; durable evidence-store commit normally continues asynchronously.

targeted preservation, while high-confidence or correlated signals may trigger rate-limited full-state capture. We prescribe no scoring algorithm, requiring only an upstream risk score or categorical signal; deployments set thresholds and budgets, and Section VI evaluates one reference operating point. 3) Capture–Containment Sequencing: The threat in Section II-B (tC ≥ tR ) requires explicit sequencing. Delaying destructive containment increases dwell time, while containing first may destroy volatile evidence. A workload-specific capture window bounds this trade-off. The window opens when the destructive-containment hold becomes active, not when a signal is generated or received, so its bound is on held dwell time rather than on detection latency. A production realization needs the expiry enforced locally at the PEP, runtime, or orchestrator, so that release does not depend on a healthy FMP; the failure and release semantics this implies are not evaluated here; specifically, we do not test FMP crash, queue saturation, or evidence-store partition (Section VI-G). The sequencing is then: 1) The FMP normally releases destructive containment when capture completes, while durable evidence-store commit continues asynchronously. This assumes the closed artifact survives the containment action: it did for the evaluated

workload-scoped paths, but would not for node loss before export. If the capture window expires first, containment is released even if capture is incomplete. 2) A deployment requiring durable commit before release must keep the target frozen or state-preservingly isolated through the flush; otherwise post-checkpoint execution adds attacker dwell. Non-destructive controls, such as traffic mirroring or access restriction, may run throughout capture and commit. 3) High-impact resources may use a zero-length window to prioritize containment. Other workloads may accept delay to preserve more evidence.

This sequencing governs defender-routed orchestrator containment; it cannot prevent an adversary already inside the workload from executing a local self_exit or memset memory scrub before capture, which is why the always-on routine record, not the reactive volatile capture, is the evidentiary floor (Section VI). Observable capture operations, including memory acquisition, mirroring, or token introspection, may prompt A3 to destroy state or retreat; PEP-, runtime-, or host-local agents mitigate but cannot eliminate this side channel. Section VI measures the residual race.

7

privileged administration use the same just-in-time, two-party Because IP addresses are weak anchors (Section IV), the grants. Recursive oversight logs FMP administrative actions architecture assembles a forensic identity record providing in the evidence ledger. Enclave microsegmentation and out-oflinkage inputs across IdP, PDP, PEP, workload runtime, and band reachability restrict administrative paths. These controls related logs. Records retain source timestamps, request traces, do not establish semantic truth or protect the evidence-store root and available clock-offset context so that uncertain ordering of trust. Colluding authorization roles can still alter FMP policy. remains explicit. The record and its cross-source assembly are Isolating the FMP also adds maintenance cost. The design architected; Section VI measures field availability rather than seeks to preserve this boundary through two-party, just-in-time maintenance under a distinct FMP operator role; signaturesuccessful joins. This record supports three functions: verified, ledger-logged patch ingress; and configuration-as-code, 1) Session stitching: Request-trace and session identifiers link with manual enclave changes treated as anomalies. same-session records to user and device identifiers, validated 3) Regulated-Data Controls: Evidence carrying protected claim metadata, and a token or assertion hash rather than health information or PCI DSS cardholder data inherits the the bearer secret. applicable encryption, retention, masking, and segmentation 2) Cross-session tracking: Repeated authentication and authoduties, which the FMP applies per artifact from the datarization can split an intrusion path across short-lived sessions. classification context of Section II-C. These are design requireReauthentication, delegation, and policy-decision records ments, not properties of the evaluated prototype; Appendix D supply the identifiers that support reconstruction of the details them. sequence where those identifiers are available. 3) Attribution context: The record reframes ‘‘Machine A accessed File B’’ as a request authenticated as Identity X, associated with Device Y and Certificate Z, accessing E. Telemetry Orchestration and Deployment Model File B. This improves contextual precision without proving NIST SP 800-207 defines the PDP and PEP [5]; the FMP the human actor. The legal mapping appears in Appendix A, is our proposed extension to that model rather than a NISTTable VI. defined component. It is a control-plane service in a hardened forensic enclave, an administrative and network isolation D. ZT for Forensics: Recursive Security boundary rather than necessarily a hardware trusted execution A forensic-ready model must protect the investigation itself environment, acting as forensic coordinator and evidence-policy by applying ZT to evidence handling. enforcement point. The model extends the PEP with a mir1) Evidence Handling and Investigator Access: The pipeline ror/capture function alongside allow/deny enforcement: on a retains a logically sealed, append-only master of each artifact forensic-interest signal from the FMP, it can fork relevant and re-derivable working copies. Forensic accounts hold no traffic or metadata to the enclave. For transport-encrypted standing privilege and receive expiring just-in-time access only sessions, authorized endpoint instrumentation may export perfor authorized investigations; destructive or policy-changing session traffic secrets, enabling authorized decryption of the actions require two approvers; every evidence action is logged corresponding captures under hardware-backed key control. write-once, so alteration after anchoring is exposed, including Exporting those secrets creates a retained decryption capability by an administrator, provided the signing service and evidence for those sessions, so their scope, retention, and access must be root are uncompromised; the unanchored tail is not yet covered. constrained accordingly. If ALE keys are externally escrowed Artifacts are hashed at capture, their records chained, and an- and unavailable to the enclave, the capture path preserves chors signed periodically, which at scale may fold into a signed ciphertext plus metadata; plaintext may still exist at the comglobal Merkle root (Section VI-F). These are architectural ponent performing decryption, which remains the alternative controls, not legal conclusions. acquisition point (Section IV). In either case, the design exter2) Securing the FMP: The FMP adds a policy- nalizes evidence to the isolated enclave after temporary local administration surface and a high-value target. Capture staging, rather than retaining it there long-term. policies, escalation thresholds, retention rules, and access grants are policy-as-code artifacts governed by the same review, version-control, and signing pipeline as access policies. VI. F EASIBILITY AND E VALUATION The FMP also holds sensitive privileges (evidence-store writes, We evaluate CUSTOS through three bounded experiments: capture control at PEPs and runtimes, IdP session reads, SOAR invocation) whose compromise could blind collection (E1) schema projection and storage modeling, (E2) captureprimitive and capture–containment measurements, and (E3) or fabricate evidence. The architecture bounds this surface through two design request-path overhead from an FMP hook on a live FastAPI requirements; the hardening mechanisms described here are enforcement gateway. The characterization is composed rather architectural rather than implemented. Scope minimization than fully integrated under load: expensive tiers are timed grants the FMP’s standing identity only append-only evidence- separately and composed into the model, and a 30-run k3s exstore access. IdP reads are read-only, while invocation at PEPs, periment validates capture-before-containment ordering but not runtimes, and SOAR systems uses narrowly scoped, short-lived production-load performance. Appendix F reports the testbed service credentials. Policy modification, evidence release, and and sample counts, while Section VI-G bounds the claims. C. Identity- and Policy-Linked Reconstruction

8

100

admission ceiling

footprint floor 60896 GB (a) cap 0.050/s

105

10−1 10−2

10−2

10−1

100

0.0

t∈tiers

Every event receives routine capture; an escalated event additionally receives either targeted or full-state capture, never both, as the spill term in Eq. 3 makes explicit. Let R be the decision rate, h the labeled high-risk fraction, ft the base targeted fraction excluding that high-risk stream, and c the full-memory rate cap (events/s). High-risk arrivals above c spill down to targeted preservation: rroutine = R; rfull = min(hR, c); rtargeted = ft R + (hR − c)+ (3)

0.2

LANL CERT UNSW

NSL

(b)

0.4

0.6

0.8

1.0

detector recall r

rate cap (/s, log)

Fig. 2: Feasibility bounds. (a) Steady-state storage vs fullmemory rate cap (dashed 0.05/s); (b) admission ceiling vs detector recall r (= min(r, C); dashed recall bound y=r). 100 80

1 s grace SIGTERM SIGKILL cap 65 ms

103

(a)

60 40 20

single-shot pre-dump floor SIGKILL 9 ms

(b)

102

101

0 101

102

103

containment latency (ms)

The tier structure governs logical retained storage. Let rt be the artifact rate of tier t (events/s), st its average bytes per artifact, and ρt its retention window (days). Under stationary rates and expiry, the steady-state footprint before replication, compression, and backend overhead is: X Footprint ss = 86 400 · rt · st · ρt . (2)

CIC

10−4 10−3

100

B. Cost and Storage Model

recall bound

10−3

capture tC (ms, log)

Ttrigger is the tier-selection latency for an upstream risk or forensic-interest signal. Tcapture (t) varies most: negligible for routine records, sub-millisecond for the evaluated targetedrecord serialization path, and tens of milliseconds to seconds for evaluated full-memory acquisition, depending on boundary and size. Tserialize canonicalizes the record. Thash computes and links its SHA-256 digest, and Ttransport exports it to the evidence pipeline. Equation (1) describes artifact-completion latency, not necessarily request-path delay. In the prototype, the measured inline increment includes only routine-record serialization and hash linking. Targeted and full-state work executes asynchronously, and export is queued off path. Periodic anchor signing is excluded. Equation (1) is a per-event accounting decomposition; separately reported medians do not sum to it. Expensive work is thus event-gated: cost scales with the escalation fraction, not full-memory capture per decision.

footprint (GB, log)

Tartifact (d, t) = Ttrigger + Tcapture (t) + Tserialize + Thash + Ttransport . (1)

106

CDF (%)

A. Tiered Overhead Decomposition For decision d at tier t ∈ {routine, targeted , full }, FMP artifact-completion latency comprises five components:

256M

1G

workload RSS

4G

8G

Fig. 3: Capture–containment race. (a) Containment-latency CDF vs the capture cap; (b) capture time tC vs workload resident set size (RSS; single-shot, pre-dump) against the ≈9 ms kill. memory and task state, but the same race applies to session, filesystem, and flow artifacts. Capture succeeds when tC < tR .

(4)

Conditioned on tier, workload, and destruction profile, the evidence-loss rate L = Pr[tC ≥ tR ] is the fraction of triggered events that lose the artifact and the complement of the capturesuccess probability in Eq. (4). Both clocks start at the shared origin of Section II-B, so detector latency upstream and durable commit downstream lie outside L. It is the primary preservation metric evaluated below. The bounded capture window of Section V limits defender-imposed delay but cannot guarantee capture against adversarial self-destruction.

At the reference point (R=500/s, h=0.02, c=0.05/s, ft =0.124), rfull =0.05/s and rtargeted =71.95/s: a 62.0/s base stream plus ≈9.95/s spilled from the capped high-risk stream. D. Measured Results Equation (2) thus uses post-cap artifact rates, not raw high-risk CUSTOS’s harness directly times canonical serialization, arrivals. Table VIII gives the reference per-tier rates and SHA-256 hash linking, RSA-2048 anchor operations, flowconservative sizes. Routine and targeted storage still scale record serialization, and memory-image hash/write throughput, with R, whereas the cap bounds the full-memory contribution alongside the live gateway (E3), runtime and orchestrator to 86 400 · c · sfull · ρfull : rate limiting prevents full-memory measurements, and an integrated k3s ordering demonstration. storage from growing without bound with throughput, unlike Table VIII combines the measured operation latencies with uniform per-decision memory capture. reference rates, sizes, and retentions at 500 decisions/s, a 2% high-risk arrival fraction capped per (3), and a 256 MiB memory artifact. Absolute latencies remain host-dependent. C. The Capture–Containment Race 1) Request-Path Overhead: Microbenchmarks place canoniSection II-B defines evidence loss when tC ≥ tR . Here, tC cal serialization at ≈6.8 µs and a hash-chain link at ≈0.4 µs; is the elapsed capture time (the Tcapture of Eq 1) and tR the RSA-2048 signing costs ≈0.16 ms but occurs only at 1000time until containment or adversarial action makes the artifact entry anchors, off the request path. Because only the routine unavailable. The prototype measures a CRIU checkpoint of record is inline, its measured cost is ≈7.1 µs at p50 and

9

TABLE III: Live-PEP overhead (Zen 5, 30 paired repeats; on-minus-off latency deltas in ms). Displayed off/on rates are marginal medians; throughput cost is the median paired relative change, so the two need not agree. Engine Deploy off/on (rps) Tput cost ∆p50 ∆p95 ∆p99 OPA sidecar 839/839 1.0% +0.08 +0.39 +1.93 Cedar in-process 3197/3093 3.0% +0.62 +0.75 +0.76 Casbin in-process 2599/2543 1.9% +0.55 +0.61 +0.30

≈7.4 µs at p95; targeted-record serialization (≈0.07 ms) and full-memory checkpointing (≈65 ms) run asynchronously. On the live FastAPI PEP, routine recording costs 3.0% (Cedar) and 1.9% (Casbin) throughput for the in-process engines, with ∆p99 ≤ 0.76 ms; the OPA sidecar costs 1.0% at the median but is unresolved relative to run-to-run noise and reaches +1.93 ms at p99 because of the network hop (Table III). The in-process 1.9–3.0% range is therefore the cleaner marginal-cost estimate. 2) Storage Footprint: Table VIII gives the reference rates and conservative sizes. Measured sizes and latencies come from experiments; the conservative sizes support the ≈96 TB scenario; the full-memory cap and retentions are operator-selected; and R, h, and ft are illustrative. At this operating point, conservative routine and targeted artifacts ingest ≈474 GB/day. The cap bounds the full-memory contribution, so the footprint approaches the non-full-state contribution below ≈ 10−2 /s and becomes cap-driven above it (Fig. 2(a)). At 365/90/30-day routine/targeted/full-memory retention, measured sizes give ≈46 TB and conservative sizes ≈96 TB; an 8 GiB workload at the same cap and retention implies ≈1.1 PB for full memory alone. At measured sizes, uncapped memory capture for every high-risk event or every decision would require ≈7.1 PB or ≈352 PB, respectively (152× and 7,594× the tiered footprint). 3) Direct Capture–Containment Race: A force-kill terminated the 256 MiB workload in ≈9 ms and a cooperating SIGTERM in ≈10 ms, both inside the ≈65 ms capture window (L=100%), whereas a 1 s configured SIGTERM grace (≈1.13 s measured) lay outside it (L=0%; Fig. 3; n=1000 each). A controlled experiment on a real Docker container (n=1000/arm; protocol in Table XIII) isolates the barrier from any slow-path advantage: fired together, capture and the kill lose the planted secret in every trial (0/1000 recovered, L=100%); behind the barrier of Section V-B3 the same kill preserves it in all of them (1000/1000, L=0%). The same experiment on a bare process corroborates (0/1000 vs. 1000/1000): FMP sequencing, not a slow eviction path, preserves the artifact. One campaign (n=1000 per arm) resolves the release policy into three points, all preserving the checkpoint (L=0%): releasing at checkpoint completion holds containment for ≈175 ms and removes 93.0% of a local-write activity proxy, a 64 KiB pwrite() loop, relative to an equal ungated delay, since CRIU seizes the task for the duration of the dump; releasing only after synchronous durable commit, with the workload resumed during it, extends the hold to ≈1314 ms and leaves the activity reduction at 12.2%; and holding the container cgroup frozen through durable commit costs ≈1344 ms while still removing 98.1%. Capture completion is therefore the lowest-delay evaluated release point that preserved the checkpoint, and a durability-

gated policy must keep the target frozen or state-preservingly isolated through commit to avoid ceding dwell. The verdict is size-robust from 256 MiB to 8 GiB (L=0% vs. 100% un-held; Table XIII) and reproduces on a second host (EPYC 7702) at 256 MiB and 1 GiB (Table XIV), where the release ordering is invariant and only the absolute holds scale. 4) CRIU Capture Validation: We use a non-destructive CRIU checkpoint (criu dump --leave-running) of a 256 MiB workload, capturing memory pages, registers, open descriptors, and task state. On the Zen 5 host, capture took ≈65 ms median and ≈75 ms at p95 (n=1000, range 55– 114 ms); an older EPYC 7702 host gave ≈126 ms. Under matched timing boundaries over 128/256/512/1024 MiB (Fig. 4; n=200/method/size/host), acquisition is method- and hostdependent: CRIU is acquisition-competitive with the smallest fitted size coefficient on both hosts, while gcore is slowest in every cell. Descriptive intercept-plus-size fits have R2 ≥ 0.997; coefficients, fitted crossovers, and the independent near-crossover validation are in Appendix C. Durablecommit method spreads are smaller (5–29%), consistent with the common persistence path dominating total latency. The fair harness equalizes timing boundaries, not invocation mechanics: CRIU and gcore run as subprocesses, whereas process_vm_readv executes in the harness, so the fair harness’s 83 ms CRIU value should not decompose the 65 ms standalone headline. We select CRIU for restorable memory and task-state fidelity; gcore yields a non-restorable core and process_vm_readv a non-atomic, memory-only acquisition without restorable task state. Race verdicts are sizeconditional: single-shot tC grows to ≈1.2 s at 8 GiB RSS, still below the ≈2.1 s eviction median, while pre-dump holds the final freeze at ≈98 ms even at 8 GiB (Fig. 3(b)), at zero dirty rate: a floor, not a general bound, since at 256 MiB the final freeze grows ≈27→46 ms as dirtying reaches 100 MB/s. We use an FMP-controlled process because this k3s setup does not expose the container address space through crictl checkpoint [38]. To test whether the race is an artifact of that subject, we also checkpointed a 260 MiB Docker container (full address space, --tcp-established) with runc/CRIU. Its ≈175 ms median (n=1000) was ≈ 2.7× the Zen 5 process median but remained far above a direct container kill (≈8 ms, n=200), so L=100% also holds for the container. The ≈65 ms CRIU time excludes durability. A writable-area export of the container’s /root adds ≈13–45 ms, yielding an ≈80–110 ms sequential, non-atomic composition; a full root-filesystem export costs ≈330 ms. A local checkpointto-fsync pipeline (n=1000, 256 MiB) measures ≈1232 ms median (p95 ≈ 1.66 s). Median checkpoint/hash/transport/storeverification/flush stages are 175/138/42/139/703 ms; stage medians are non-additive, and the per-trial unattributed residual has a 33 ms median. Falco and Suricata alert-to-harness latencies are ≈0.69/0.80 s, whereas Table IV’s ≈0.15/0.23 s values are successful-checkpoint durations. Because these legs were measured separately, we draw no detector-to-durable race conclusion. 5) Remediation and Orchestrated Eviction: At tC ≈75 ms, direct force-kill (≈9 ms) and a cooperating SIGTERM (≈10 ms) terminate inside the capture window (L=100%), whereas

10

7K

3475

3649

data source

3K 2K 1K

0

0 256 MiB

Ref

3565

4K

974

72

100

132

200

5K

1077

208

233

300

Telemetry-schema projection (%), native plus derived

(b)

6K

1041

304

CRIU gcore process_vm_readv

durable-commit latency (ms)

(a)

83

acquisition latency (ms)

400

256 MiB

1 GiB

100 100 100 100 100 100 100

CERT

100

0

100 100 100

70

0

LANL

100

0

100 100 100

50

100

60

NSL-KDD

100

0

0

0

100

50

0

40

UNSW

46

0

0

0

100

50

0

20

0

0

0

0

100

40

0

action

temp-order

id

id-attr

resource

risk-ctx

verdict

schema element

evict

1s grace capture 65-75ms

term

(a)

kill

L = 100% L = 0%

101

102

103

termination/reap (ms)

delayed: tR > 0.5 ms (%)

Fig. 4: Matched-boundary capture methods (Zen 5, n=200/method/size; medians and p95): (a) closed local artifact; (b) verified durable commit. userspace, per campaign userspace mean (b) in-kernel, 0/50,000

n/a

80

CIC-DDoS

1 GiB

overall 100

0

schema

0

admission ceiling

50

100

percentage (%)

Fig. 6: Native-plus-derived coverage across five measured sources plus one non-empirical synthetic schema reference: per-element schema projection (left) and overall schema versus the rate-cap admission ceiling (right).

100 75 50 25 0 0.5 1 1.5 2

3

4

5

6

CPU load (×cores)

8 10

Fig. 5: (a) Per-mechanism termination/reap tR vs. full-memory capture tC ; the grace bar is a 1 s configured grace measured at ≈1.13 s. (b) Share of enforcement observations slower than 0.5 ms, a threshold fixed before the data was inspected, for five independent campaigns per load (n=1000/arm/campaign). Dashes are campaign means; in-kernel recorded 0/50,000 delayed observations.

container stop, control-plane revocation, and Kubernetes eviction leave margin (L=0%, memory-scoped; Table XVIII). On single-node k3s, forced eviction took 2060 ms median (p95 ≈ 2585 ms) and grace expiry ≈ 30 s (n=100 each): force removes the API object before runtime memory is reclaimed. The same regime held on a three-node DigitalOcean Kubernetes Service (DOKS) cluster, where forced deletion, rolling replacement, preemption, and node drain fell within ≈ 2.1–2.2 s and grace expiry took ≈ 30.09 s. We do not rank mechanisms within the first band. Rolling replacement rejected 731/3731 unusable attempts, principally stale-subject cases in which the locked pod died before the trigger; the appendices report attempted/valid counts and source-hash-stratified checks. These margins apply to the evaluated clusters, not every endpoint agent or runtime API. 6) In-Kernel Enforcement Locus: eBPF enables in-kernel containment (bpf_send_signal): the hook issues SIGKILL inline on the adversary’s own syscall, so evidence dies via the same ≈9 ms termination but triggered from within the kernel, well below the ≈65 ms capture and orders of magnitude below the ≈2.1 s eviction (Fig. 5(a)). The distinct threat is locus, not raw speed: the kill fires outside the control-plane path, so the FMP hold hook cannot sequence capture ahead of it. Isolating signal issuance rather than completed termination, userspace enforcement exhibited distinct fast and millisecond-scale modes

whose mixture varied with load and campaign: delayed observations (tR >0.5 ms) were rare through 2× (≤ 6.2% in every campaign), frequent and variable at 3×–5× (0.8–85.6%), and rare again at 6×–10× (≤ 0.4%). In-kernel enforcement held a 0.5–0.8 µs median with 0/50,000 observations over 0.5 ms (Fig. 5(b)); no userspace scheduling precedes it. The median alone misleads here: at 4× every campaign median sits near the fast mode while 7.5–46.4% of observations are already delayed. The robust boundary is locus: in-kernel issuance avoids the scheduling path the control-plane hold depends on. 7) Integrated k3s Ordering Demonstration: We deployed CUSTOS as three k3s services: a FastAPI PEP with an inprocess Cedar PDP and FMP hook, a volume-backed hashchained evidence store, and a target workload. A policy violation emits routine and targeted records, activates the containment hold, checkpoints ≈259 MiB with CRIU, records the image digest, and then contains the workload. Across 30 integrated runs on the Zen 5 node, the five-link chain (routine, targeted, hold, capture, containment) completed capture in ≈67 ms while pod memory remained available for ≈2049 ms during eviction: capture preceded memory loss in 30/30 runs. This establishes deployed ordering and timing margin for an FMP-controlled workload process; container-memory capture is demonstrated separately (the Docker/runc result above), not integrated into this k3s pipeline, and unavailable in the evaluated DOKS configuration. It is not a guarantee for containment paths that bypass the control plane. E. Telemetry-Schema Coverage Capture feasibility does not establish how much reconstruction context the resulting records contain. Appendix C states the replay protocol: per-source ordering, how timestamps are consumed, and why λm derives from measured labels and a stipulated decision rate rather than from replay time. We replayed five labeled datasets spanning the identity–network spectrum: CERT [39], [40], LANL [41], NSL-KDD [42], UNSW-NB15 [43], and CIC-DDoS2019 [44], and score them against a synthetic schema reference. That reference row (Ref in Fig. 6) is 100% on every element by construction: the ceiling a source would reach by populating every decision-

11

100

legit id. cov. (%)

record field. It is excluded from origin-basis scoring and carries no measured event count. We measure (i) telemetryschema coverage, the weighted fraction of FMP decision-record elements a source can populate (identity, identity attributes, action, resource, risk context, verdict, and temporal-order resolution), crediting native and deterministic-derived fields but not imputed ones; and (ii) the full-memory admission ceiling, the fraction of malicious events a rate-capped budget can admit. Timestamp-derived resolution is tie-aware and does not imply causal recovery (Table XI): rtemp =(U −1)/(n−1) for n events and U distinct timestamps. At native event density, without replay subsampling, it is 0.581 for CERT and 0.00477 for LANL. All three network-source projections receive zero temporal-order credit: the evaluated NSL-KDD and UNSWNB15 feeds expose no wall-clock field, while CIC-DDoS2019 records carry timestamps that the adapter does not consume. Timestamp-derived ordering still receives no credit, so coverage is unchanged. Appendix C gives the derivation, full-stream counts, and crediting rules. Identity credit requires an IdPbound principal, not a bare IP or per-flow pseudonym. These are schema-projection and budget bounds, not detection results or demonstrated incident reconstruction; Table IX and Table XI give the mappings, weights, formula, and detailed results. 1) Context Bound: The FMP records action and resource for nearly every decision but obtains authenticated identities, identity attributes, and native verdict labels only when upstream telemetry supplies them. Identity-centric CERT and LANL reach 64–75% schema coverage. Network sources using flow endpoints rather than authenticated identities reach 18–30%. Re-scoring under four alternative weight vectors (equal, identity-heavy, risk-heavy, and one dropping temporalorder; Appendix E) leaves identity-rich sources at 63–88% and network sources at 12–36% with the ranking unchanged, so the separation persists. The missing identity and identity_attributes fields in Fig. 6 reflect the source feed, not the FMP schema. This is the reconstruction counterpart of the identity-fragmentation hurdle in Section IV. 2) Feasibility Bound: The admission ceiling falls as eligible volume rises. The full-memory budget admits only 0.01–0.02% of malicious events in the UNSW, NSL-KDD, and CIC-DDoS streams, which carry the highest labeled malicious fractions h (all sources share the stipulated R), compared with 1.24% for CERT and 2.85% for LANL. This is a deliberate cost ceiling, not a detection result. It assumes a stationary offered load and perfect admission among eligible events, with no false escalations consuming budget. The cap bounds storage, while the admission policy triages eligible malicious events for full-memory capture. Section VI-F discusses severity-weighted admission.

global only per-id bucket (a)

100

81

80

67

80

60

60

40

40

20 0

10

2 CERT

CERT LANL (b)

20 0

dataset

LANL

1

2

4

8

16

32

64 128

source buckets N (log2)

Fig. 7: Capture-budget resilience to an A3 flood. (a) Global vs per-identity budgeting; (b) legitimate-identity coverage as the flood spreads across N source buckets. TABLE IV: Trigger-decoupled recovery (n=1000/detector). Mem. art.: four planted memory-resident markers. C2 sock. (1st): first-attempt ESTABLISHED-socket recovery. Capture: successful checkpoints only, not attack-to-alert latency. Detector Modality Capture Mem. art. C2 sock. (1st) Falco (Zen 5) eBPF/syscall ≈0.15 s 1000/1000 1000/1000 Suricata (Zen 5) network IDS ≈0.23 s 1000/1000 883/1000

memory in ≈3 ms (mem_scrub), versus ≈65 ms reactive CRIU capture (p95 ≈ 75 ms). Both destruction distributions lay entirely below capture. A naive Python overwrite measured ≈67 ms but overlapped the 55–114 ms capture distribution, so it is only a weak-adversary upper bound. Self-destruction bypasses the orchestrator, making the ≈2.1 s eviction margin irrelevant and reactive full-memory capture unreliable. The always-on routine tier remains: its record is serialized and hash-chained inline (≈7 µs) and, after successful externalization, covered by a periodic anchor. Once durably externalized and covered by a signed anchor, the monitored workload cannot retroactively destroy it. 2) Detector-Quality Sensitivity: Routine decision provenance is detector-independent. For full-memory malicious-event admission, let r be detector recall and C the source-specific admission ceiling. We model the admitted malicious-event fraction as min(r, C). Across the evaluated sources, the largest ceiling is 2.85%, so admission becomes budget-limited once recall exceeds the corresponding C (Fig. 2(b)). Let fFP be the false-escalation fraction. False escalations consume the same budget and alone would saturate the cap when fFP ≥ c/R (10−4 at the reference point). The appendices specify the schema-weight sensitivity check. Joint precision–recall evaluation against a live detector remains future work. 3) Decision-Record-Only Baseline: Relative to a decisionrecord-only baseline, the FMP preserves identical decision provenance while adding session artifacts and rate-capped host/memory state. These additions raise steady-state storage F. Robustness and Scalability from ≈7.0 TB to ≈46 TB, a ≈ 6.6× premium (Table XIX). We test six pressure points, one per subsection below. 4) Capture-Budget Denial of Service: An A3 adversary 1) Adaptive Self-Destruction: The race in Section VI-C ini- pursuing TO4 can flood high-risk events to exhaust the fulltially assumes defender-driven containment, but a compromised memory budget. In a deterministic replay of the admission logic workload may destroy its own memory after detecting scrutiny. driven by a CIC-DDoS2019 flood interleaved with legitimate On the Zen 5 node (Table XX; n=1000 per strategy), a 256 MiB CERT and LANL incidents at the 0.05/s cap, a global-only budworkload exited in ≈7 ms median (self_exit) or scrubbed get achieved legitimate-identity coverage of just 1.5% (CERT)

12

and 10.2% (LANL), while the flood consumed 94–99% of granted captures. A per-identity token bucket raised legitimateidentity coverage to 66.7% and 80.6% (fractions of labeled incidents admitted in that replay, a different denominator from the all-malicious-event ceilings of Section VI-E) and cut the adversary’s share to ≈3% (Fig. 7(a)). Per-identity budgeting is strongest against concentrated floods. As the flood spreads across N synthetic source buckets, legitimate-identity coverage approaches the global-budget floor once N nears the legitimate population (Fig. 7(b)). This sweep models source dispersion, not botnet size. The per-identity refill rate is the global budget divided by an assumed active-identity count, so fair-share allocation presumes an estimate of that population, although buckets themselves are created on first appearance rather than enumerated in advance. Per-identity budgeting is evaluated but not deployed; severity-weighted admission remains an extension against false-positive floods. 5) Evidence-Ledger Scalability: A globally-locked hash chain serializes appends (≈1.0 M records/s peak, 0.6 M contended); per-shard chains scale near-linearly to ≈28 M records/s at a flat ≈0.6 µs p99 in an in-memory single-host benchmark that excludes networking and durable writes. In the architecture, shard state may subsequently fold into a periodically signed global Merkle root [45], whose folding cost the benchmark excludes; each signed root makes anchored state tamper-evident (100% over 1000 trials), addressing post-capture record alteration (TO3) and repudiation (TO5). Detection holds only after anchoring and under an uncompromised signing key, and does not cover records forged by a compromised source before chaining; Fig. 9 gives the scaling curves. 6) Real-Detector Closed Loop and Forensic Utility: To exercise the loop with real detectors, we drove the same runc/CRIU checkpoint from Falco (eBPF/syscall) and Suricata (network IDS) reacting to a fileless attack (an in-workload reverse shell to a live C2 socket plus a sensitive-file read). Across 1000 trials per detector, every successful checkpoint recovered all four planted memory-resident markers, and the ESTABLISHED C2 socket in 1000/1000 (Falco) and 883/1000 (Suricata) on the first attempt (the operational same-incident metric); both detectors fired on 1000/1000, so detection is not the limiting factor. The remaining Suricata sockets recovered only by redeploying the container and re-detonating the attack (998/1000 across repeated independent incidents, not sameincident retries), a transient capture-stage shortfall whose mechanism the retained records do not identify. Driving one capture path from both modalities demonstrates trigger decoupling (Table IV). Falco detection reproduced 1000/1000 on managed DOKS, but node-level checkpointing was unavailable [38], leaving full-memory capture bound to operator-controlled infrastructure and managed or serverless environments the hard case.

For RQ 2, reactive checkpointing precedes slow defenderrouted eviction but loses to direct or in-kernel termination and self-destruction. For RQ 3, request-path measurements, storage modeling, and the rate cap quantify cost and turn heavy-artifact availability into an explicit admission budget. Four limitations bound these findings: 1) Measurement scope. Gateway overhead and the primary CRIU race use synthetic workloads on individual hosts; orchestrator tests additionally span k3s and a managed cluster. CRIU captures memory and task state, but live microsegment-flow capture remains a production integration task. The primary race times a 256 MiB workload and is corroborated on a real Docker container (Section VI-C). Repeated-trial figures are empirical rates on a single host, not independent real-world incident samples. 2) Storage abstraction. Equation (2) estimates logical retained bytes, excluding replication, metadata, write amplification, compression, and object-store costs. 3) Detector dependence. Overall recall remains bounded by upstream detection. The recall and false-escalation sensitivity analyses (Section VI-F) are analytical projections rather than a joint precision–recall study. 4) Trust and failure semantics. The FMP capture path is trusted, and the prototype co-locates the hook with the PEP, so gateway or node compromise defeats the floor; the separation mechanisms of Section V are unimplemented. The alwayson record is canonically serialized and hash-chained on the gateway before capture is attempted, and outside the monitored workload, so workload self-destruction cannot remove it and a checkpoint crashing mid-dump, a store rejecting the write, or a queue shed under load do not retroactively alter the gateway-side record, though they can prevent its durable externalization. Export to the evidence store is queued off the request path, however, so the prototype does not establish durability against gateway failure: a crash before export can lose the unexported tail. Synchronous inline commit would close that gap at a cost the measured ≈7 µs inline increment does not include. Four dependability classes remain unevaluated: coordinator failure, evidence-path failure, release semantics, and recovery idempotence (Appendix E). The capture window bounds the safety consequence of the third but measures none of them.

VII. C ONCLUSION ZT changes not only what evidence exists but whether volatile evidence survives long enough to be captured. CUSTOS proposes tiered, identity- and policy-linked preservation in the ZT control plane through the FMP. The capture–containment race defines the feasibility boundary: the always-on decision record is the evidentiary floor, whereas reactive volatile-state capture succeeds only before defender or adversary action destroys the target state. The prototype realizes the capture hook, hash-chained record pipeline, CRIU checkpointing, seG. Synthesis and Threats to Validity quencing barrier, detector-triggered capture, ledger mechanisms, For RQ 1, schema population bounds reconstruction context and an integrated k3s ordering demonstration; production IdP relevant to fidelity and subsequent correlation but does not integration, live microsegment capture, just-in-time investigator demonstrate cross-source reconstruction; capture timing and access, hardened FMP isolation, and failure and recovery budget, not schema retention, bound volatile-state availability. semantics remain reference-design requirements.

13

Within the evaluated scope, the results address all three ephemerality is evaluated directly in Section VI. These are RQs (synthesis, Section VI-G). For RQ 1, identity-oriented public post-incident reports, each naming a specific evidentiary telemetry populates substantially more of the decision-record shortfall rather than only an intrusion path; they motivate the schema than network-oriented telemetry, bounding the recon- design rather than validate it. In every case the recurring failure struction context available for subsequent correlation. For RQ 2, is absence rather than tampering, and records never written sequencing determined the outcome for the evaluated defender- cannot be recovered afterward, which is why CUSTOS captures routed paths: the same direct SIGKILL lost the planted artifact at the decision rather than the investigation. when fired concurrently with capture (0/1000 recovered) but preserved it when gated behind capture completion (1000/1000). A PPENDIX C In-kernel enforcement that bypasses the control-plane hold and adversarial self-destruction remain outside that guarantee. On D ETAILED C OST, S TORAGE , AND R ACE PARAMETRIZATION the evaluated CRIU path, capture completion is the lowestThis section provides the rates, sizes, retentions, and timings delay release point that preserved the checkpoint; durable behind the Section VI feasibility results. commit normally proceeds asynchronously, while a policy a) Tier parameters: Table VIII uses conservative sizes requiring it before release must keep the target frozen or and measured latencies. Full-memory denotes the CRIU memstate-preservingly isolated through commit. The gateway-side ory/task checkpoint; architectural full-state also includes filesysroutine record survives destruction of the monitored workload, tem and flow artifacts. The 71.95/s targeted rate follows main though not gateway failure before its queued export. For RQ 3, Eq. 3. At the stated rates and 365/90/30-day retentions, Eq. 2 routine recording cost a measured 1.9–3.0% of throughput on yields 95.7 TB. Measured sizes are ≈445 B routine, ≈7.2 KiB in-process policy engines, modeled footprints were ≈46 TB targeted, and ≈259 MiB full-memory, yielding ≈46.3 TB at using measured artifact sizes and ≈96 TB using conservative the same rates and retentions. Sizes use binary units; aggregate reference sizes at the stated operating point, and the modeled footprints use decimal TB. eligible malicious-event admission ceiling ranged 0.01–2.85%. b) Storage and admission sensitivity: We sweep each Schema population bounds available reconstruction context; governing parameter of Eq. 2 to show the headline numbers capture timing and budget bound volatile-state availability. Future Work. Section VI-G states the limitations that bound are one point on a curve, not an artifact of the reference these claims. Next steps are live flow/packet-capture integration, point. Footprint is linear in full-memory artifact size at fixed production-load and integrated multi-node capture characteri- cap and retention (the full-memory tier alone is 34.8 TB at zation, joint precision–recall evaluation, and assessment under the 256 MiB reference), and linear in the cap and retention, control-plane compromise and disconnected operation. The while decision rate R scales only the routine and targeted tiers; the 0.05/s cap is the knee below which the tiered footprint appendices provide the evidentiary and legal mapping. These appendices contain additional methodological detail, approaches its non-full-state floor. With burst multiplier β and false-escalation fraction fFP , the ceiling min(1, c/(βhR + tables, and figures referenced by the main text. fFP R)) falls inversely with β; false escalations alone saturate the cap when fFP ≥ c/R=10−4 . Every swept curve preserves A PPENDIX A the qualitative conclusions. E VIDENTIARY AND L EGAL M APPING c) Per-source provenance: Table IX gives the per-source The FMP is designed to support authentication, preservation, values summarized in Section VI-E. The admission ceiling and integrity requirements under the Federal Rules of Evidence is min(1, c/λ ) for full-capture budget c=0.05/s and perm (FRE) and the Federal Rules of Civil Procedure (FRCP) [46], source malicious-event rate λ , which spans ≈1.8/s (LANL) m [47] (with the analogous Military Rules of Evidence [48]), to ≈340/s (UNSW) across the replays: the two-order spread alongside technical guidance from ISO/IEC 27037 and 27041– in λ , not any property of detection, is what separates these m 27043 [49], [50], [51], [14]. Table V summarizes the provisions, source-specific admission ceilings. and Table VI maps them to FMP capabilities. Production d) Live-gateway records: The coverage values above are cryptography assumes FIPS 140-validated modules [52] and projections of archival datasets onto the decision record, and key management consistent with NIST SP 800-57 [53]. a low value reflects what the dataset retained, not a limit FMP records and controls may support authentication, preserof the architecture. A record produced on the live path is vation, and process showings; courts determine admissibility. not so limited: the gateway adapter (gateway_source.py) FRE 902(13)/(14) also requires qualified-person certification marks identity, identity attributes, action, resource, risk context, and pretrial notice under Rule 902(11); hashes and signatures and verdict as natively populated, since each is taken from alone do not suffice. the request and from the policy engine’s own response rather than reconstructed by an adapter. Those six carry 0.85 of A PPENDIX B the reference weight; the seventh, temporal-order resolution, D OCUMENTED I DENTITY AND G ATEWAY E VIDENCE G APS is set by the recorder’s timestamp granularity rather than by Figure 8 maps representative ZT controls to the evidence the source. This is the gateway path specifically. The failurethey erode and the FMP’s response, and Table VII grounds the semantics harness records only what its own analysis needs identity-misuse and gateway-visibility hurdles in documented (case identifier, decision, request identifier, and a recording incidents; the encryption hurdle is analyzed in Section IV and timestamp) and is not a decision-record producer.

14

Forensic gap

ZT control

FMP response

Continuous verification Short-lived tokens and changing attributes

Identity/policy context fragments; unexternalized context may disappear.

Persist identity, action, resource, policy, trace, and verdict.

Microsegmentation and mTLS Distributed PEPs; no stable choke point

Payload visibility falls; flow evidence fragments across ephemeral PEPs.

Correlate identity and flow context; trigger targeted capture.

Ephemeral workloads Automated restart, eviction, or termination

Memory, writable layers, and flows can vanish before capture.

Gate destructive containment on bounded, ratelimited capture.

Least privilege and JIT Temporary access; restricted evidence stores

Access expires; master analysis risks alteration.

Broker JIT access to verified copies; retain a sealed, append-only master.

Fig. 8: ZT controls, associated forensic gaps, and corresponding FMP responses. TABLE V: Selected federal evidentiary and civil-procedure provisions the architecture is designed to support. Table VI additionally invokes FRCP 26 and 34 (discovery scope and production of electronically stored information (ESI)). Provision FRE 901(a) FRE 901(b)(9) FRE 902(13) FRE 902(14) FRE 803(6) FRE 1001(d) FRE 1003 FRE 702 & Daubert FRCP 37(e)

Substance General authentication: the proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be. Authentication by “evidence describing a process or system and showing that it produces an accurate result.” Self-authentication of records generated by an electronic process or system, with a qualified certification (added 2017). Self-authentication of data copied from an electronic device, supported by digital identification and a qualified certification (added 2017). Business-records hearsay exception: records kept and made as a regular practice of a regularly conducted activity. Defines the “original” of ESI to include any output that accurately reflects the data. Admits duplicates to the same extent as originals unless authenticity is genuinely disputed. Expert-testimony reliability factors: tested methodology, known error rate, peer review, and general acceptance [54]. On loss of ESI that should have been preserved and cannot be restored: curative measures on a finding of prejudice (37(e)(1)); severe measures such as adverse-inference instructions or dismissal only on a finding of intent to deprive (37(e)(2)).

TABLE VI: Mapping FMP capabilities to evidentiary provisions and supporting evidence. FMP capability Policy-triggered state capture Identity- and policy-linked reconstruction Automated telemetry orchestration JIT access to working copies Cryptographic custody and ledger anchoring FMP administration and maintenance

Applicable provisions FRE 803(6), 902(13); FRCP 37(e); ISO/IEC 27037, 27043 FRE 901(a), 902(13); ISO/IEC 27042 FRE 803(6), 901(b)(9); FRCP 26, 34; ISO/IEC 27041, 27043 FRE 1001(d), 1003; ISO/IEC 27037 FRE 901(a), 902(13), 902(14); ISO/IEC 27037, 27042 FRE 901(b)(9), 803(6); FRCP 26, 34; ISO/IEC 27037, 27041

e) Barrier and release-policy protocol: All barrier runs are same-host Docker/runc/CRIU, not Kubernetes and not a remote production evidence store. Synchronization point. At t=0, each arm generates capture and containment requests. The no-barrier arm delivers direct-PID SIGKILL immediately; barrier arms delay delivery to the specified release boundary. Adversary operation. The in-container workload runs a bounded local-write loop; one operation is a single 64 KiB pwrite() recorded in a shared counter read immediately before and after the hold. It is deliberately a local write, not network exfiltration, and bounds attacker throughput during the hold rather than any specific exfiltration semantics. Equal-delay control. A freerun arm runs the workload ungated for 300 ms to measure its uncontained operation rate. Expected operations for any other arm are that rate multiplied by the arm’s median hold, and activity reduction is 100(1 − measured/expected), so the comparison is against an equal delay rather than against no delay. Release boundaries. barrier releases at checkpoint completion; barrier_durable releases after durable-store

Evidence provided Automated, regular-practice capture supporting business-record treatment, self-authentication, and timely preservation. Identity, action, and policy-decision records supporting attribution and reconstruction. A documented, reproducible collection process that assembles consistent and producible records. A sealed master and verified duplicates that protect the original evidence from modification. Hashes, signatures, and handling records supporting authentication of system-generated records and copied artifacts. Policy-as-code, brokered administration, and data-class tags supporting process reliability, retention, and redaction.

acknowledgment with the workload resumed during the flush; barrier_frozen_durable releases after the same acknowledgment while the container cgroup stays paused. Success criterion. The evidence token is injected through a FIFO after startup, never via argv or environment, and recovery scans only CRIU pages-*.img files. A repetition counts as success only if the checkpoint succeeded and the token is found; for the durable arms it must be present in both the source and the committed copies. The token search runs after release and never delays it. Sample size. n=1000 per arm; every attempted repetition, including failures and timeouts, is retained. f) Storage sensitivity sweep: Table X sweeps each governing parameter of Eq. 2 around the reference point, holding the others fixed. The full-memory tier is linear in artifact size, cap, and retention, so the total is dominated by whichever of those is relaxed; decision rate R moves only the routine and targeted tiers. The reference curve sets fFP =0; under burstiness the admission ceiling falls from 0.5% at β=1 to 0.1% at β=5 and 0.025% at β=20.

15

TABLE VII: Documented incidents illustrating identity-misuse and gateway-visibility forensic gaps. MFA is multi-factor authentication; SSO is single sign-on. Incident Year Mechanism abused Forensic evidence gap Source Identity misuse: valid tokens or credentials make malicious activity appear legitimate SolarWinds / Golden 2020 Forged SAML assertions from a stolen Logins appeared routine, leaving limited failed-login, MFA-challenge, [7], [8] SAML token-signing key or ADFS authentication evidence in the relevant paths Okta support HAR 2023 Post-MFA session cookies replayed from Sessions were fully authenticated, leaving limited brute-force or [55] hijack stolen HAR files MFA-challenge evidence Midnight Blizzard 2024 Malicious OAuth applications granted Collection used legitimate Graph and EWS calls, without malware or [56] full_access_as_app exploit signatures Snowflake / UNC5537 2024 Stolen credentials used against tenants Malicious SQL resembled routine queries; primarily [57] without MFA successful-authentication and query logs remained CircleCI SSO-cookie 2023 Malware exfiltrated a valid, Impersonation via a valid session; the investigation correlated [9] theft MFA-authenticated SSO session cookie authentication, network, monitoring, and system-log records Gateway blind spot: session logging lacks payload detail or appliance telemetry Citrix Bleed 2023 NetScaler session tokens stolen from Token theft was unlogged; replayed sessions appeared legitimately [58] memory and replayed to bypass MFA authenticated Ivanti Connect Secure 2024 Gateway authentication bypass and Logs were wiped and integrity hashes forged, degrading reliable [59], [60] command injection access records

TABLE VIII: Conservative reference rates, sizes, and retentions with evaluated operation latency (p50) at 500 decisions/s. Tier Rate (/s) Bytes/ev. Latency Retention Footprint Routine (inline) 500 1.5 KiB 7.0 µs 365 d 24 TB Targeted (async) 71.95 64 KiB 0.07 ms 90 d 37 TB Full-memory (async) 0.05 256 MiB 65 ms 30 d 35 TB Total steady-state footprint 95.7 TB

TABLE IX: Per-source native-plus-derived schema projection and the rate-caplimited admission ceiling. The synthetic row defines schema completeness and is not an empirical incident stream, so its admission ceiling is n/a. Source Type Schema cov. (%) Adm. ceil. (%) Synthetic ref. 100.0 n/a LANL identity 75.0 2.85 CERT identity 64.0 1.24 NSL-KDD network 30.0 0.02 UNSW-NB15 network 24.6 0.01 CIC-DDoS network 18.0 0.02

g) Reference-parameter provenance: The reference point mixes measured and stipulated values. Measured: 445 B routine, 7.2 KiB targeted, 259 MiB full-memory, and all reported latencies. Conservative sizes: 1.5 KiB, 64 KiB, and 256 MiB yield 95.7 TB; measured sizes yield 46.3 TB. Operator-selected: c=0.05/s and 365/90/30-day retentions. Illustrative: R=500/s, h=0.02, and ft =0.124. The sensitivity sweep varies these stipulated inputs. h) Capture-method scaling coefficients: Acquisition medians are well described over 128/256/512/1024 MiB (n=200/method/size) by T =a + bS, where a is a fitted intercept and b a size coefficient; these are descriptive coefficients, not isolated setup or hardware-bandwidth measurements because method invocation differs. Zen 5: CRIU a=35.9 ms, b=0.1692 ms/MiB (implied 5909 MiB/s); process_vm_readv 14.4, 0.2143 (4666 MiB/s); gcore 68.7, 0.2302 (4345 MiB/s). EPYC 7702/A100: CRIU 45.4, 0.2907 (3440 MiB/s); process_vm_readv 25.6, 0.4404 (2271 MiB/s); gcore 116.5, 0.4991 (2004 MiB/s), with R2 ≥ 0.997. The fitted CRIU/process_vm_readv crossover is ≈477 MiB on Zen 5 and ≈132 MiB on the older host; the independent 512 MiB Zen 5 schedules give near-zero gaps (+1.7 and −0.3 ms), consistent with the first prediction. i) Unevaluated dependability classes: The four classes named in Section VI-G are coordinator failure (an FMP crash while containment is held), evidence-path failure (unavailable

TABLE X: Storage and admission sensitivity around the reference point (R=500/s, h=0.02, ft =0.124, c=0.05/s, 256 MiB, 365/90/30 d), which yields 95.7 TB. One parameter varies per row. Parameter full-memory artifact (MiB) full-memory rate cap (/s) full-memory retention (d) decision rate R (/s) high-risk fraction h targeted fraction ft

low 128 / 78.3 TB 0.005 / 64.4 TB 7 / 69.0 TB 100 / 46.9 TB 0.005 / 91.9 TB 0.05 / 76.8 TB

reference 256 / 95.7 TB 0.05 / 95.7 TB 30 / 95.7 TB 500 / 95.7 TB 0.02 / 95.7 TB 0.124 / 95.7 TB

high 8192 / 1174 TB 1.0 / 756 TB 365 / 484 TB 5000 / 644 TB 0.1 / 116 TB 0.5 / 191 TB

TABLE XI: Per-element completeness ce (%) and weights w under P the native-plus-derived basis; the bottom row is cov= e we ce . Element identity identity attr. action resource risk context verdict temporal order cov (%)

w 0.15 0.15 0.10 0.10 0.20 0.15 0.15 1.00

Syn 100 100 100 100 100 100 100 100.0

CERT 100 100 100 100 70 0 0 64.0

LANL 100 100 100 100 50 100 0 75.0

NSL 0 0 100 100 50 0 0 30.0

UNSW 0 0 46 100 50 0 0 24.6

CIC 0 0 0 100 40 0 0 18.0

TABLE XII: Adversary–objective–goal mapping. A# A1 A2 A3

Access and behavior Stolen credential or compromised host Legitimate or privileged insider Anti-forensic capability exercised by A1/A2

TO# 1–3, 5 2, 3, 5 1–5

G# 1–4 2–4 1–5

store, saturated queue, or FMP–store partition), release semantics (fail-open versus fail-closed when capture cannot complete), and recovery idempotence (stale or replayed operations after restart). The capture window bounds the safety consequence of the third but measures none of them. j) Temporal-order scoring: The temporal-order element of Section VI-E measures timestamp resolution, not causal recovery. For event timestamp si let csi be its tie-bucket size, n the event count, and U the number P of distinct timestamps. Local per-event resolution is n−1 i c−1 si =U/n; we report the endpoint-normalized rtemp =(U −1)/(n−1) for n > 1 and 0 otherwise, so a source with all-unique timestamps scores 1 and one fully tied bucket scores 0. Because fixed-size replay subsampling thins timestamp collisions, the temporal metric is com-

16

no-barrier L 100% 100% 100% 100% 100% 100%

barrier L 0% 0% 0% 0% 0% 0%

Release point checkpoint durable-resume frozen-durable checkpoint durable-resume frozen-durable

Hold 203 ms 756 ms 786 ms 437 ms 2372 ms 2408 ms

Act. red. 94.7% 25.9% 96.5% 96.6% 18.6% 98.5%

10

20 15 10 5

2

101

100

0 0

TABLE XIV: Cross-host container barrier experiment on the EPYC 7702/A100 host (n=100/arm). Holds are medians; activity reduction is versus an equal ungated delay; L is plantedsecret loss. Footprint 256 MiB 256 MiB 256 MiB 1 GiB 1 GiB 1 GiB

sharded (b) naive

append p99 (μs)

RSS 256 MiB 512 MiB 1 GiB 2 GiB 4 GiB 8 GiB

sharded (a) naive

25

M records/s

TABLE XIII: Barrier vs. no barrier across workload size (n=100/arm per size; runc/CRIU checkpoint, direct-PID SIGKILL, secret injected after startup and recovered from pages-*.img only). L is planted-secret loss.

L 0% 0% 0% 0% 0% 0%

2

4

6

8

PEP gateways

10

12

0

2

4

6

8

PEP gateways

10

12

Fig. 9: Evidence-chain append microbenchmark with N writer processes: globally locked versus per-shard chains; (a) append throughput, (b) p99 tail. Merkle folding is architectural and excluded from the timed path.

section then expands robustness analyses summarized in Section VI-F. a) Weight sensitivity: The alternatives to the reference weight vector cited in Section VI-E are, in the element order (identity, identity-attributes, action, resource, risk context, verdict, temporal-order resolution): equal (1/7 each), puted separately at native event density over the full identity- identity-heavy (0.25, 0.25, 0.075, 0.075, 0.10, 0.10, 0.15), and source streams: CERT has n=1,260,239, U =732,011, and risk-heavy (0.10, 0.10, 0.075, 0.075, 0.40, 0.10, 0.15). All five rtemp =0.580851; LANL has n=1,051,430,459, U =5,011,198, measured sources and the synthetic reference were re-scored and rtemp =0.004766. All three network sources receive zero under each vector; the source ranking is identical throughout temporal-order credit: CIC-DDoS2019 carries a timestamp field (LANL, CERT, then NSL-KDD, UNSW, CIC-DDoS). Those the evaluated adapter does not consume, and the NSL-KDD three vectors all retain a 0.15 temporal-order weight, which and UNSW-NB15 feeds expose no wall-clock field. Timestamp- no measured source earns, so they cannot test whether includderived ordering is nevertheless granted no credit under every ing that element depresses every empirical value. A fourth basis, so these corrected full-stream values do not change vector therefore removes temporal-order and renormalizes the any coverage score. The remaining elements are credited as remaining six weights. Because the element scores zero for follows: identity requires an IdP-bound principal, not a bare IP all five sources, every coverage value rises by the same factor or per-flow pseudonym; risk context is the per-event fraction 1/0.85=1.176: CERT 64.0 → 75.3, LANL 75.0 → 88.2, NSLof available risk signals; and action, resource, and verdict each KDD 30.0 → 35.3, UNSW 24.6 → 29.0, and CIC-DDoS 18.0 → 21.2. The ranking and the identity-versus-network require a non-empty projected field. k) Barrier vs. no barrier across size and host: The barrier separation are unchanged (identity 75–88% vs network 21– result of Section VI-C is reported here across workload size 35%), so the reported absolutes are conservative by exactly and on a second host. The release ordering is invariant in every the weight assigned to an element none of these sources can populate, while the comparative conclusion does not depend cell; only the absolute holds scale. on it. b) Adaptive self-destruction: Per-strategy destruction A PPENDIX D times behind Section VI-F. R EGULATED -DATA H ANDLING These are unimplemented architectural requirements. For reA PPENDIX F tained electronic protected health information (ePHI), CUSTOS E XPERIMENTAL T ESTBED requires encryption, minimum-necessary access, and logged Table XVI lists the evaluation hosts and Table XVII the decryption; HIPAA’s six-year period applies to governing documentation, while artifact retention follows applicable pol- per-experiment tooling and sample counts. Both bare-metal icy [61]. PCI evidence must minimize retention, render stored hosts ran OpenSSL 3.0.13 (FIPS off), with SHA-256 using primary account numbers (PANs) unreadable and displayed the CPU’s sha_ni extensions and RSA-2048 in software (no PAN masked, and inherit cardholder-environment segmenta- TPM/HSM); microbench iterations (canonicalize / hash-link tion and attestation requirements [62]. Data-class labels drive / RSA / flow) were 2×104 /5×104 /300/5×103 . Each ledgerscalability point is the median of 30 two-second runs, and its retention, redaction, and access policy. append-latency percentiles are computed over ∼104 –106 timed A PPENDIX E appends per run (1/64 sampling). Managed DOKS contributes ROBUSTNESS A NALYSES orchestrator-eviction and detector-leg measurements only; nodeTable XV maps the main-paper threat objectives to the level checkpointing was unavailable. Pooled attempted/valid corresponding FMP mechanisms and supporting analyses. This counts are 1000/1000 forced, 3731/3000 rolling replacement,

17

TABLE XV: Threats, FMP mechanisms, and supporting evidence (main-paper threat model, §2). Threat / goal FMP mechanism Evidence / analysis TO1 evidence destruction (race) Capture barrier gating containment on capture completion Main §6 race TO2 capture evasion below triggers Always-on decision records plus signal-triggered targeted preservation Main §6 cost, prov. TO3 post-capture record alteration Hash-chain linkage plus periodic anchor and signature Main §6 tamper-detect (post-anchor) TO4 capture DoS Rate-limited full-state tier and asynchronous workers Main §6 rate cap TO5 repudiation Identity-bound records with anchored signatures Main §6 tamper-detect Residual: incomplete capture Full-memory rate cap bounds the admission ceiling Main §6

TABLE XVI: Evaluation hosts. DOKS is DigitalOcean Kubernetes Service. Node Zen 5

Hardware AMD Ryzen Threadripper 9960X (24C/48T), 125 GB

GPU server

AMD EPYC 7702 (16 vCPU) + NVIDIA A100 80 GB (drv 595.71.05), 125 GB 3× s-2vcpu-4gb (2 vCPU / 4 GB / 80 GB SSD), NYC1

DOKS

Kernel / runtime Ubuntu 24.04.4, 7.0.0-28 (microbench/gateway runs under 6.17.0-40); runc 1.3.4, CRIU 4.2 Ubuntu 24.04.4, 6.17.0-35; runc 1.3.4, CRIU 4.2, Docker 29.1.3 Debian 13, 6.12.96; K8s 1.36.3-do.0, containerd 2.2.3

Used for Capture, containment, eBPF, adversary, ledger, overhead, e2e/k3s Dataset replay (coverage), behavioral e2e, capture cross-check Managed eviction, detector leg

TABLE XVII: Per-experiment tooling and sample counts. Experiment Capture-primitive microbench + cost composition Live-gateway overhead Concurrency sweep (32–256) Containment race (SIGKILL vs graceful) Full-memory CRIU checkpoint Matched-boundary capture methods Adaptive-adversary self-destruction Kubernetes eviction Capture-vs-containment race sampler Remediation profiles (container stop; revocation) eBPF containment vs. SIGKILL / userspace Managed-cloud eviction Capture-budget DoS (per-identity bucket) Evidence-ledger scalability Ledger tamper-detection Real-container capture race Sequencing barrier (container; process) Release-policy hold cost (adversary ops during hold) Storage/coverage sensitivity sweep Real-detector closed loop Memory + writable-area composition Integrated k3s ordering demonstration

Measured tooling OpenSSL 3 PDP engines Cedar, EPYC host POSIX signals CRIU 4.2, runc 1.3.4 CRIU / gcore / process_vm_readv process exit / memset k3s v1.36.2+k3s1 CRIU 4.2 + SIGKILL/evict Docker; control-plane bcc 0.29.1, bpftrace 0.20.2 DOKS 3-node, k8s API CIC-DDoS + CERT/LANL replay multiprocessing, 1–12 writers SHA-256 chain + RSA-2048 anchor Docker + runc/CRIU 4.2 runc/CRIU + direct SIGKILL CRIU + 64 KiB local-write loop Eq. 2 model Falco 0.44.1, Suricata 7.0.3 CRIU anchor + filesystem snapshots FastAPI + Cedar + FMP

n 3×102 –5×104 30/arm 20/cell 1000/mode 1000 200/method × 4 sizes × 2 hosts 1000/strategy 100 forced, 100 graceful 1000/regime 30; non-destr. control 30; 1000/arm/campaign, 5 campaigns × 10 loads (0.5–10×) valid: 1000 F; 3000 R; 1150 P/D; 552 G deterministic 30 runs/config (2 s ea.) 1000 trials 1000 cap; 200 kill 1000/arm 1000/arm analytic grid 1000/detector FS 1000/delta; CRIU anchor 1000 30 race; 1 chain

TABLE XVIII: Measured remediation time and memory-artifact loss L at a 75 ms capture bound.

TABLE XX: Adaptive self-destruction time and loss at a 65 ms reactive capture (n=1000/strategy).

Remediation mechanism Time to death L direct SIGKILL (force-kill) ≈9 ms 100% cooperating SIGTERM (process exits) ≈10 ms 100% container stop (SIGTERM, 10 s, SIGKILL) ≈10 s 0% k8s forced eviction (delete --force) ≈2.1 s 0% k8s graceful eviction (30 s grace) ≈30 s 0% session revocation (control-plane only) non-destructive 0%

Self-destruction median p95 L self-exit ≈7 ms ≈15 ms 100% memset scrub ≈3 ms ≈4 ms 100% Python overwrite ≈67 ms ≈69 ms overlap

L scopes memory-resident state; session- or flow-scoped evidence may be lost by revocation while memory persists. Per-mechanism sample counts in Table XVII.

TABLE XIX: Decision-record-only baseline versus FMP-tiered capture using measured-artifact sizing. Forensic capability record-only FMP-tiered decision provenance yes (18–75%) yes (18–75%) incident provenance none targeted volatile host/memory state none capped memory volatile-state recovery 0% budget-bounded steady-state storage ≈7.0 TB ≈46 TB

1154/1150 preemption, 1152/1150 node drain, and 554/552 grace expiry. Mechanism-consistency QC excluded 42 of those 3000 rolling-replacement records below the 1 s grace floor (3.1–176.1 ms), so that mode is analyzed at n=2958; raw and filtered medians are 2097.2 and 2097.5 ms, and raw ledgers are retained. DOKS sessions record the harness source hash in config.source_sha256_16; four hashes occur in the supplied ledgers. Where revisions overlap, valid medians are

stable (rollout 2096–2099 ms across three revisions, drain 2194–2196 ms, preemption 2194–2199 ms), supporting pooled mechanism-level summaries while not resolving fine ordering within the ≈2.1–2.2 s regime. Rolling-replacement invalids are principally stale-subject cases in which the locked pod died before the trigger; other modes have only 0–4 invalid attempts. These are rejections of unusable observations, not removal of unfavorable ones. CRIU checkpoints used criu dump --shell-job --leave-running; anticipatory pre-dump added --track-mem with --prev-images-dir. a) Replay protocol: CERT, UNSW-NB15 and CICDDoS2019 are seed-shuffled (seed=7); NSL-KDD is replayed in native file order; and LANL reservoir-samples benign events to the uniform 125,000-event target while retaining every redteam event. Timestamps are consumed where the adapter reads them: LANL uses the native one-second epoch field, CERT parses the record date to an epoch value, and NSL-KDD, UNSW-NB15 and CIC-DDoS2019 receive a row-index sequence instead. For NSL-KDD and UNSW-NB15 the evaluated feeds expose no wall-clock field; for CIC-DDoS2019 the flow records do carry a timestamp that this adapter does not consume,

18

which is an adapter limitation rather than a dataset property. The row-index value is a deterministic ordering surrogate only: it is not seconds, and no rate, interval, or burst statistic is derived from it. Replay order and this surrogate therefore do not enter the capture-budget calculation. The malicious-event rate is λm =hR, where h is the post-sampling labeled fraction, not an estimate of native prevalence; R=500/s is the stipulated operating point of Section VI-B, not a rate recovered from the data. The quantity min(1, c/λm ) is thus an admission ceiling under a stationary offered load at that operating point: it bounds the fraction of eligible malicious events a c=0.05/s budget can admit, and assumes perfect admission among them with no false positives. Burstiness is not modeled here; Table X sweeps it separately. Schema coverage is a field-presence projection computed per event, so neither replay order nor the timestamp surrogate affects it, which is why the CIC-DDoS adapter limitation leaves the headline coverage values unchanged. b) Capture-budget DoS protocol: The admission replay merges a CIC-DDoS2019 flood (63,708 high-risk events across 2 addresses mapped to one adversarial identity in the concentrated condition) with the labeled CERT or LANL incident stream over a 3600 s window: 1199 legitimate incidents across K=66 identities for CERT, 702 across K=98 for LANL. Admission is two-level. A global token bucket refills at the full-memory cap C=0.05/s, and each identity holds its own bucket refilling at the fair share C/(K+1), which is 0.000746/s for CERT and 0.000505/s for LANL; the extra identity in the denominator is the adversary. Both buckets have capacity (burst) 4 and start full, so an identity’s first request is always admissible; per-identity buckets are created on first appearance of that identity rather than at t=0. A capture is granted only when both levels hold a token, and a token is charged at neither level on a denial. The baseline condition runs the same code path with the per-identity level disabled, so baseline and treatment differ only in that one flag. c) Evidence-ledger benchmark scope: The ledger throughput figures measure a single-host, in-memory hash-chain hot path with N PEP writers as N operating system processes. They exclude network transport, durable-store writes, and the cost of Merkle folding: the periodic anchor of each shard head into the global root happens out of band on a coordinator, not on the append path. The numbers are therefore an upper bound on append rate for the chaining primitive, not a throughput figure for a deployed evidence store. Tamper detection is a separate experiment: 1000 trials against a 10,000-entry ledger anchored every 1000 records, each trial mutating a field, deleting an entry, or forging a principal, and testing whether the next anchor exposes it. Detection is claimed only for alteration after anchoring and only while the signing key and evidence root are uncompromised. d) Measurement protocol: Primary bare-metal timing experiments use the Zen 5 host (ext4/NVMe, performance governor, no core isolation); the EPYC/A100 host provides dataset replay, behavioral end-to-end measurements, and the capture cross-checks listed in Table XVI. Latencies use perf_counter, timed trigger-to-completion; the enforcement sweep is pinned to four cores. Live-gateway overhead:

one uvicorn worker, concurrency 64, 3000 warm-up then 3×104 timed req/arm, 30 repeats (matching Table III). The evidence ledger chains hi =SHA-256(rec i ∥ hi−1 ) with an RSA-2048 anchor signed every 1000 entries (n=104 , 1000 trials); append percentiles use 1/64 sampling over each two-second run (median of 30 runs). Dataset replays are deterministic under fixed seeds. The real-detector loop watches Falco’s alert stream (with a custom Suricata rule for the off-host C2), firing a runc CRIU checkpoint (--tcp-established --leave-running); success = recovering the four planted memory-resident markers plus the ESTABLISHED C2 socket (Table IV); failed-attempt latency is excluded from the wall-time summary.

R EFERENCES [1] J. Kindervag, “No more chewy centers: Introducing the zero trust model of information security,” Forrester Research, 2010. [2] R. Ward and B. Beyer, “Beyondcorp: A new approach to enterprise security,” login, vol. 39, no. 6, pp. 6–11, 2014. [3] The White House, “Executive order on improving the nation’s cybersecurity,” Executive Order 14028, May 2021. [4] Office of Management and Budget, “Moving the u.s. government toward zero trust cybersecurity principles,” M-22-09, Jan. 2022. [5] S. W. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-207, 2020. [6] R. Chandramouli and Z. Butcher, “A zero trust architecture model for access control in cloud-native applications in multi-location environments,” National Institute of Standards and Technology, Gaithersburg, MD, NIST SP 800-207A, 2023. [7] CISA, “Detecting post-compromise threat activity in Microsoft cloud environments,” CISA, Tech. Rep. Alert AA21-008A, 2021. [8] Mandiant, “Remediation and hardening strategies for Microsoft 365 to defend against UNC2452,” Mandiant, Tech. Rep., 2021. [9] CircleCI, “CircleCI incident report for the january 4, 2023 security incident,” https://circleci.com/blog/jan-4-2023-incident-report/, 2023, official post-incident report. [10] C. Neale, I. Kennedy, B. Price, Y. Yu, and B. Nuseibeh, “The case for zero trust digital forensics,” Forensic Science International: Digital Investigation, vol. 40, p. 301352, 2022. [11] M. S. Inukonda, J. Tarachandani, I. Ahmed, B. R. Tamma, and S. Mittal, “ZETA: A zero-trust security-based forensic-ready solution for perimeterless enterprise networks,” in 2023 IEEE ANTS, 2023, pp. 189–194. [12] A. Shan, M. Ahmad, H. Iqbal, and A. Sufyan, “ZTFORENSICS: Zero trust policy enforcement with tamper-evident forensic evidence packaging for hybrid cloud environments,” Spectrum of Engineering Sciences, vol. 4, no. 5, pp. 795–810, 2026. [13] K. Kent, S. Chevalier, T. Grance, and H. Dang, “Guide to integrating forensic techniques into incident response,” National Institute of Standards and Technology, Gaithersburg, MD, NIST Special Publication 800-86, 2006. [14] ISO, “Information technology – Security techniques – Incident investigation principles and processes,” ISO/IEC, Standard 27043:2015, 2015. [15] C. Buck, C. Olenberger, A. Schweizer, F. Völter, and T. Eymann, “Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero-trust,” Computers & Security, vol. 110, p. 102436, 2021. [16] Z. Ma, C. Li, Y. Zhang, R. You, and B. Tu, “IMS: Towards computability and dynamicity for intent-driven micro-segmentation,” IEEE TDSC, vol. 22, no. 1, pp. 677–694, 2025. [17] S. Hong, L. Xu, J. Huang, H. Li, H. Hu, and G. Gu, “SysFlow: Toward a programmable zero trust framework for system security,” IEEE TIFS, vol. 18, pp. 2794–2809, 2023. [18] National Security Agency, “Advancing zero trust maturity throughout the automation and orchestration pillar,” National Security Agency, Cybersecurity Information Sheet U/OO/182301-24; PP-24-2698, Jul. 2024. [19] A. Hassan, A. Rauf, N. Shafqat, R. Latif, and H. Khan, “ZenGuard a machine learning based zero trust framework for context aware threat mitigation using SIEM SOAR and UEBA,” Scientific Reports, vol. 15, no. 1, p. 35871, 2025.

19

[20] J. Olegård, S. Axelsson, and Y. Li, “When is logging sufficient? tracking event causality for improved forensic analysis and correlation,” Forensic Science International: Digital Investigation, vol. 52, p. 301877, 2025. [21] P. R. Oza, V. S. Gulhane, P. Sharma, M. Lamba, M. K. Mokashi, and D. Patil, “Zero trust security architecture in cyber forensics: An analysis through log management,” in Intelligent Computing and Automation, ser. Smart Innovation, Systems and Technologies. Springer Nature Singapore, 2025, vol. 421, pp. 573–582. [22] M. N. Hossain, S. M. Milajerdi, J. Wang, B. Eshete, R. Gjomemo, R. Sekar, S. D. Stoller, and V. N. Venkatakrishnan, “SLEUTH: Realtime attack scenario reconstruction from COTS audit data,” in USENIX Security Symposium, 2017. [23] A. Alsaheel, Y. Nan, S. Ma, L. Yu, G. Walkup, Z. B. Celik, X. Zhang, and D. Xu, “ATLAS: A sequence-based learning approach for attack investigation,” in USENIX Security Symposium, 2021. [24] S. A. Crosby and D. S. Wallach, “Efficient data structures for tamperevident logging,” in USENIX Security Symposium, 2009. [25] T. Gharaibeh, S. Seiden, M. Abouelsaoud, E. Bou-Harb, and I. Baggili, “Don’t, Stop, Drop, Pause: Forensics of CONtainer CheckPOINTs (ConPoint),” in Proc. 19th Int. Conf. on Availability, Reliability and Security (ARES), 2024. [26] R. Stoyanov, L. Goldoni, A. Reber, C. Hargreaves, and R. Bruno, “Forensic Analysis of Container Snapshot Chains for Post-Event Reconstruction,” Forensic Science International: Digital Investigation, vol. 57, p. 302114, 2026. [27] S. Zawoad, A. K. Dutta, and R. Hasan, “Towards building forensics enabled cloud through secure logging-as-a-service,” IEEE TDSC, vol. 13, no. 2, pp. 148–162, 2016. [28] A. N. Moussa, N. Ithnin, and A. Zainal, “CFaaS: bilaterally agreed evidence collection,” Journal of Cloud Computing, vol. 7, no. 1, 2018. [29] A. Srinivasan and F. Ferrese, Forensics-as-a-Service (FaaS) in the Stateof-the-Art Cloud. Wiley & Sons, Ltd, 2019, ch. 16, pp. 321–337. [30] I. A. Alnajjar, A. A. Salameh, L. Almazaydeh, and A. Al Tawil, “Twotier forensic readiness architecture for zero trust-enabled industry 4.0 applications,” Information Security Journal: A Global Perspective, vol. 35, no. 3, pp. 363–380, 2026. [31] M. Herman, M. Iorga, A. M. Salim, R. Jackson, M. Hurst, R. Leo, A. K. Mishra, N. Landreville, and Y. Wang, “NIST Cloud Computing Forensic Reference Architecture,” National Institute of Standards and Technology, Tech. Rep. NIST Special Publication 800-201, July 2024. [32] L. Pasquale, S. Hanvey, M. Mcgloin, and B. Nuseibeh, “Adaptive evidence collection in the cloud using attack scenarios,” Computers & Security, vol. 59, pp. 236–254, 2016. [33] D. Alrajeh, L. Pasquale, and B. Nuseibeh, “On Evidence Preservation Requirements for Forensic-Ready Systems,” in Proc. 11th Joint Meeting Found. Softw. Eng. (ESEC/FSE), 2017, pp. 559–569. [34] D. Monteiro Barbosa, Y. Yu, A. Zisman, and B. Nuseibeh, “Adaptive Observability for Forensic-Ready Microservice Systems,” IEEE Transactions on Services Computing, vol. 16, no. 5, pp. 3196–3209, 2023. [35] J. Dykstra and A. T. Sherman, “Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques,” Digital Investigation, vol. 9, pp. S90–S98, 2012. [36] E. Rescorla, “The transport layer security (TLS) protocol version 1.3,” Internet Engineering Task Force (IETF), RFC 9846, Jul. 2026. [37] M. Jones, A. Nadalin, B. Campbell, J. Bradley, and C. Mortimore, “OAuth 2.0 Token Exchange,” RFC 8693, IETF, 2020. [38] Kubernetes SIG-Node, “Forensic container checkpointing (KEP-2008),” Kubernetes Enhancement Proposal, 2022. [39] J. Glasser and B. Lindauer, “Bridging the gap: A pragmatic approach to generating insider threat data,” in Proc. IEEE Security and Privacy Workshops, 2013, pp. 98–104.

[40] B. Lindauer, “Insider threat test dataset,” Dataset, 2020. [41] Alexander D. Kent, “Comprehensive, Multi-Source Cyber-Security Events,” Los Alamos National Laboratory, 2015. [42] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of KDD CUP ’99 data set,” in IEEE CISDA, 2009, pp. 1–6. [43] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in IEEE MilCIS, 2015, pp. 1–6. [44] I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, “Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy,” in Proc. IEEE 53rd Int. Carnahan Conf. Security Technology (ICCST), Chennai, India, 2019, pp. 1–8. [45] B. Laurie, E. Messeri, and R. Stradling, “Certificate Transparency Version 2.0,” Internet Engineering Task Force (IETF), RFC 9162, Dec. 2021. [46] Cornell Law School Legal Information Institute, “Federal Rules of Evidence,” https://www.law.cornell.edu/rules/fre, 2025, as amended through December 1, 2025. [47] Cornell Law School Legal Information Institute, “Federal Rules of Civil Procedure,” https://www.law.cornell.edu/rules/frcp, 2025, as amended through December 1, 2025. [48] Joint Service Committee on Military Justice, “Manual for Courts-Martial, United States,” 2024, includes the Military Rules of Evidence (MRE). [49] ISO, “Information technology – Security techniques – Guidelines for identification, collection, acquisition and preservation of digital evidence,” ISO/IEC, Standard 27037:2012, 2012. [50] ISO, “Information technology – Security techniques – Guidance on assuring suitability and adequacy of incident investigative method,” ISO/IEC, Standard 27041:2015, 2015. [51] ISO, “Information technology – Security techniques – Guidelines for the analysis and interpretation of digital evidence,” ISO/IEC, Standard 27042:2015, 2015. [52] NIST, “Security Requirements for Cryptographic Modules,” NIST, Tech. Rep. FIPS PUB 140-3, 2019. [53] E. Barker, “Recommendation for Key Management: Part 1 – General,” National Institute of Standards and Technology, NIST SP 800-57 Part 1, Revision 5, 2020. [54] SCOTUS, “Daubert v. Merrell Dow Pharmaceuticals, Inc.” 509 U.S. 579, 1993. [55] Okta Security, “Tracking unauthorized access to Okta’s support system,” https://sec.okta.com/articles/2023/10/ tracking-unauthorized-access-oktas-support-system/, 2023. [56] Microsoft Threat Intelligence, “Midnight Blizzard: Guidance for responders on nation-state attack,” https: //www.microsoft.com/en-us/security/blog/2024/01/25/ midnight-blizzard-guidance-for-responders-on-nation-state-attack/, 2024. [57] Mandiant, “UNC5537 targets Snowflake customer instances for data theft and extortion,” https://cloud.google.com/blog/topics/threat-intelligence/ unc5537-snowflake-data-theft-extortion, 2024. [58] CISA, “LockBit 3.0 affiliates exploit CVE-2023-4966 (Citrix bleed),” CISA, Tech. Rep. Alert AA23-325A, 2023. [59] CISA, “Threat actors exploit vulnerabilities in Ivanti connect secure and policy secure gateways,” CISA, Tech. Rep. Alert AA24-060B, 2024. [60] Mandiant, “Investigating Ivanti connect secure VPN exploitation and persistence,” https://cloud.google.com/blog/topics/threat-intelligence/ investigating-ivanti-exploitation-persistence/, 2024. [61] U.S. Department of Health and Human Services, “Security standards for the protection of electronic protected health information (hipaa security rule),” 45 C.F.R. Part 164, Subparts A and C (documentation retention §164.316(b)(2)), 2013. [62] PCI Security Standards Council, “Payment card industry data security standard (pci dss),” Version 4.0.1, 2024.

Related documents

• CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary#820609
• MST 8506 - Special topics in digital forensics#957070
• Reveal, Correct, Then Pay: Encrypted Mempools and Perpetual Funding Security#370269
• Dissecting Agentic Forensics: The Role of Triage, Prompting, and Evidence Arbitration in Open-World Fake Image Detection#1050538
• Dissecting Agentic Forensics: The Role of Triage, Prompting, and Evidence Arbitration in Open-World Fake Image Detection#1028592