💻 computer science

CLOUDBURST: Cloud-Layer Observations Using Beacons for Unified Real-time Surveillance and Threat Attribution

This paper introduces CLOUDBURST, the first formal framework for cloud-native passive beacons that defines a new Cloud Attribution Score to measure threat detection across six vector classes, revealing that IAM Canary Roles and S3 Presigned URLs offer the highest resistance to modern cloud scanners while highlighting the rapid degradation of attribution value due to ephemeral infrastructure churn.

Original authors: Abraham Itzhak Weinberg

Published 2026-05-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Abraham Itzhak Weinberg

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard for a massive, ever-changing city made of digital buildings (the Cloud). In the old days, if a thief stole a physical file, you could track them by the footprints they left behind. But in this modern city, the buildings themselves are made of mist. They appear, disappear, and rebuild themselves every few minutes. If a thief steals a "key" to a building, that building might vanish before you even finish your report.

This paper, CLOUDBURST, is a new rulebook and a new set of tools designed to catch thieves in this misty, shifting city.

Here is the breakdown of their ideas using simple analogies:

1. The Problem: The "Ghost City"

In traditional security, you track a thief by the specific computer they used. But in the cloud, the "computer" (a container or server) might exist for only 10 minutes before it is deleted and replaced.

The Analogy: Imagine a thief steals a key from a hotel room, but the hotel room is demolished and rebuilt instantly. By the time you arrive to check the room, the thief is gone, and the room is brand new. You can't tell who was there.
The Paper's Claim: Existing tracking tools don't work here because they assume the "room" is still there. CLOUDBURST admits the room might be gone and builds a new way to track the thief anyway.

2. The Solution: Six Types of "Traps" (Beacons)

The researchers created a "menu" of six different types of traps (called Beacons) that look like valuable things to a thief but are actually traps. When a thief touches one, it sends a silent signal back to the security team.

Think of these as different types of bait:

The "Fake Key" (S3 Presigned URLs): A link that looks like a secret document. If a thief clicks it to download the "stolen" data, the trap springs. This is very hard for scanners to spot.
The "Ghost Key" (IAM Canary Roles): A fake security badge that no real employee should ever use. If a thief tries to use it, it's like walking into a room where a silent alarm is already wired to the ceiling. This is the best trap because it leaves a very clear record of who tried to use it.
The "Poisoned Blueprint" (Terraform Modules): A fake construction plan for the city. If a thief tries to build with it, the plan calls home to say, "Hey, someone is using my blueprint."
The "Magic Box" (Container Images): A software box that calls home every time it's opened.
The "Secret Note" (Kubernetes Secrets): Hidden notes inside the city's instructions that trigger an alarm if read.
The "Dead Code" (Serverless Triggers): A piece of code that does nothing unless someone accidentally runs it, at which point it screams "I'm being used!"

3. The Scorecard: The "Cloud Attribution Score" (CAS)

How do you know which trap is the best? The authors invented a score called CAS. It's like a "Thief-Catching Grade" that weighs three things:

Did the signal get through? (Was the thief using a mask like a VPN?)
Did we catch their ID? (Did the cloud system log exactly who touched the trap?)
Did the building disappear? (Did the trap vanish before we could analyze it?)

The Big Discovery:

The Winner: The "Ghost Key" (IAM Canary Roles) got the highest score. It is the most reliable because even if the building vanishes, the cloud system keeps a permanent log of who tried to use the key.
The Runner-Up: The "Fake Key" (S3 URLs) is the hardest for thieves to detect. It looks so normal that security scanners often miss it.
The Loser: The "Dead Code" (Serverless Triggers) is the weakest. It's too obvious and often gets caught by security scanners before the thief even touches it.

4. The "Fading Ink" Problem (Ephemeral Decay)

This is the paper's most important finding.

The Analogy: Imagine you write a thief's name in ink on a foggy window. If you wait 10 minutes, the fog clears and the ink fades. If you wait 2 hours, the ink is gone.
The Finding: The paper proves that the ability to identify a thief drops dramatically over time.
- At the start (0 hours): You have a 79% chance of identifying the thief.
- After 48 hours: That chance drops to 18–22%.
Why? Because the "buildings" (servers) keep getting rebuilt. The longer you wait to analyze the data, the more likely the evidence has been wiped out by the system's automatic cleaning.

5. The Verdict: What Should You Do?

The paper concludes with a simple guide for security teams:

Put "Ghost Keys" everywhere: Since they leave the clearest trail and don't disappear, they should be in every cloud account.
Use "Fake Keys" as a backup: They are hard for thieves to spot, so they are great for catching sneaky attackers.
Act Fast: Because the evidence fades so quickly (within 48 hours), you cannot wait to investigate. You must catch the thief the moment they touch the trap.

Summary

CLOUDBURST is a new manual for catching cloud thieves. It tells us that in a world where digital buildings vanish every hour, we can't rely on old tracking methods. Instead, we should use specific "Ghost Keys" (IAM roles) that leave permanent paper trails, and we must act immediately because the evidence fades away like ink on a foggy window.

Note: The paper explicitly states that while these tools are good, they didn't achieve "perfect" certainty (100% proof) in their tests. They identified that more clues are needed to reach that final level of certainty, but they successfully created the first system to measure and improve these chances.

Technical Summary: CLOUDBURST – Cloud-Layer Observations Using Beacons for Unified Real-time Surveillance and Threat Attribution

1. Problem Statement

Modern cloud-native environments (AWS, GCP, Azure, OCI) present a fundamentally different exfiltration threat surface compared to traditional file-based scenarios. Attackers no longer merely steal files; they steal ephemeral artifacts such as S3 presigned URLs, container images, Kubernetes secrets, Terraform state modules, and IAM role tokens. Existing academic literature and honeytoken frameworks (e.g., Passive hack-back, Canarytokens) focus primarily on file-based or mobile scenarios and fail to address unique cloud-native properties:

Infrastructure Ephemerality: In containerized environments (e.g., Kubernetes), the infrastructure triggering a beacon callback may cease to exist before attribution analysis begins, invalidating the assumption that "the machine that fired the beacon is still running."
IAM Complexity: Cloud API calls carry rich identity context (e.g., assumed role ARNs, service account emails) that offers superior telemetry but requires complex interpretation of role assumption chains and enabled audit logs (CloudTrail/Audit Log).
Multi-Provider Normalization: Attackers often route stolen credentials through different cloud providers, requiring attribution systems to normalize telemetry across disparate formats.

Current tools lack a formal taxonomy for cloud-native beacons and a metric that quantifies how infrastructure churn degrades attribution quality over time.

2. Methodology

The paper introduces CLOUDBURST, a formal taxonomy and measurement framework designed to evaluate cloud-native passive beacons.

2.1 Formal Framework: Cloud Attribution Score (CAS)

The core contribution is the Cloud Attribution Score (CAS), a unified metric defined as:
$CAS(c) = w_1C_f(1 - E_p) + w_2I_c + w_3(1 - E_p)I_c + w_4M_b$
Where:

$C_f$ : Callback fidelity (quality of information per callback).
$E_p$ : Ephemeral penalty, modeling the loss of attribution quality due to infrastructure churn (pod restarts, autoscaling).
$I_c$ : IAM coverage (fraction of identity context captured).
$M_b$ : Multi-cloud bonus (correlation gain from cross-provider evidence).
$w_i$ : Weights summing to 1.

The framework explicitly models Ephemeral Decay, where the penalty $E_p$ increases as a function of time, pod restarts, and scaling events, mathematically demonstrating how attribution quality degrades in containerized environments.

2.2 Beacon Vector Taxonomy

CLOUDBURST defines six distinct beacon vector classes, each with unique threat properties and provider support:

S3 Presigned URLs: Time-limited signed URLs embedded in stolen data.
Watermarked Container Images: OCI images with embedded health-check layers.
Canary IAM Roles: Dormant roles/service accounts with no legitimate invocation path.
Poisoned Terraform Modules: Modules with embedded HTTP data sources.
Kubernetes Secret Beacons: Secrets triggering callbacks via admission webhooks or audit logs.
Serverless Function Triggers: "Dead code" functions that fire on invocation.

2.3 Experimental Setup

The evaluation involved:

Deployment: 21 beacon instances across four cloud providers (AWS, GCP, Azure, OCI).
Attacker Simulation: Three sophistication levels (Naive, Advanced, APT) varying in routing (TOR/VPN), infrastructure rotation, and dwell time.
Scanner Models: Three detection models (AWS Macie/GCP DLP, Checkov/tfsec, Prisma Cloud/Wiz) to measure Detection Resistance (DR).
Metrics: CAS, Detection Resistance (DR), Callbacks to Detect (CTD), and Ephemeral Decay dynamics over 48 hours.

3. Key Results

3.1 Vector Performance

IAM Canary Roles achieved the highest mean CAS (0.450) and high Detection Resistance (DR = 0.873), making them the most deployable vector. They provide the richest telemetry (full principal ARNs) and have the lowest ephemeral risk.
S3 Presigned URLs achieved the highest Detection Resistance (DR = 0.890), surviving all three scanner models because their URL format and access patterns resemble legitimate data retrieval.
Serverless Function Triggers exhibited the worst Detection Resistance (DR = 0.611) due to explicit outbound HTTP callback patterns detectable by CNAPP scanners.
Kubernetes Secrets showed the fastest CAS degradation due to high pod churn.

3.2 Ephemeral Decay

A critical finding is the rapid decay of attribution quality. Across all vectors, CAS degraded from approximately 0.79 at deployment to 0.18–0.22 within 48 hours ( $p < 0.001$ ). This establishes a quantitative model of attribution decay, proving that cloud-native beacons must be designed for rapid firing or persistence, as the infrastructure triggering the callback often vanishes before analysis.

3.3 Provider Agnosticism

Statistical analysis (Kruskal-Wallis test, $H=1.99, p=0.57$ ) confirmed no significant difference in CAS across cloud providers. This indicates that CLOUDBURST's effectiveness is provider-agnostic, allowing for uniform deployment strategies across multi-cloud estates.

3.4 Attribution Confidence Gap

Despite high CAS values for specific vectors, no configuration achieved a high-confidence attribution posterior ( $P(H|E) \ge 0.85$ ). The maximum observed posterior was $\approx 0.52$ (IAM Canary vs. APT). The paper identifies this as an "honest null result," quantifying the gap between current beacon capabilities and operational attribution confidence.

4. Contributions

First Formal Taxonomy: A classification of six cloud-native beacon vector classes with quantified threat properties.
Cloud Attribution Score (CAS): A metric explicitly modeling ephemeral penalties, IAM coverage depth, and multi-cloud correlation.
Ephemeral Decay Model: A quantitative model demonstrating how containerized infrastructure churn degrades attribution quality.
Empirical Evaluation: A comprehensive study across four providers and three attacker sophistication levels, benchmarking against real-world scanner models.
Deployment Framework: A tiered recommendation strategy based on CAS and DR trade-offs.

5. Significance and Claims

The paper positions CLOUDBURST as the foundational layer for a complete post-exfiltration attribution stack, complementing existing work on beacon deployment (Passive hack-back), token generation (PHANTOM), and longitudinal accumulation (ARCANE).

Operational Reality: The primary significance is the establishment of the ephemeral decay problem as a measurable engineering challenge. The finding that attribution quality drops below actionable thresholds within 48 hours necessitates a shift in design principles: moving from "accumulation-based" attribution to "first-callback" attribution or using persistent anchors (like IAM roles).
Strategic Guidance: The study identifies IAM Canary Roles as the superior primary vector due to their balance of high CAS, low ephemeral risk, and provider agnosticism, while highlighting S3 Presigned URLs as the most evasion-resistant.
Limitations and Future Work: The authors modestly claim that current beacon vectors alone are insufficient for high-confidence attribution ( $P \ge 0.85$ ). They propose that closing this gap requires supplementary signals: cloud infrastructure graphs, victim sector targeting, and temporal clustering. The paper does not claim to solve attribution entirely but provides the necessary measurement framework and taxonomy to integrate cloud-native beacons into a broader attribution pipeline.