# SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems

arXiv: https://arxiv.org/abs/2606.01741 · HTML: https://mlsanity.com/paper/2606.01741/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 20 references that are in the map.
- First posted on arXiv 1 Jun 2026.

## Builds on (most cited first, 8 of 8)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Efficient Representations for High-Cardinality Categorical Variables in Machine Learning](https://mlsanity.com/paper/2501.05646/) (2025)
- [SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection](https://mlsanity.com/paper/1806.09339/) (2018)
- [Automating Date Format Detection for Data Visualization](https://mlsanity.com/paper/2501.05640/) (2025)
- [Enhanced Estimation Techniques for Certified Radii in Randomized Smoothing](https://mlsanity.com/paper/2503.08801/) (2025)
- [Harmonizing Metadata of Language Resources for Enhanced Querying and Accessibility](https://mlsanity.com/paper/2501.05606/) (2025)
- [Machine Learning Based IoT Intrusion Detection System: An MQTT Case Study (MQTT-IoT-IDS2020 Dataset)](https://mlsanity.com/paper/2006.15340/) (2020)

## Abstract (arXiv)

Distributed event-based systems have become a common substrate for Internet-scale publish/subscribe services, IoT telemetry, cloud-native microservices, and security operations pipelines. Their loose coupling and asynchronous delivery improve scalability, but they also expand the attack surface: publishers, brokers, subscribers, topics, schemas, and temporal ordering can each be abused without a single component observing the whole behavior. This paper proposes SECUREVENT, a hybrid AI/ML security-monitoring architecture for distributed event-based systems. The architecture combines traditional protections such as authenticated transport, topic-level authorization, and signed events with online anomaly detection, graph-aware behavioral features, complex-event policy rules, federated learning, and adversarial-ML governance. A deterministic prototype study over synthetic event-stream attacks illustrates how a hybrid AI/CEP monitor can improve recall over static rules while retaining a low false-positive rate. The central claim is not that machine learning replaces cryptographic and access-control mechanisms, but that model-based security monitoring is necessary when event flows, identities, schemas, and timing relationships are too dynamic for static controls alone.