💻 computer science

CAMF-Zero: Contradiction-Aware Reasoning for Zero-Day Threat Detection in Federated Multi-Cloud Environments

This paper proposes CAMF-Zero, a contradiction-aware reasoning framework that leverages a novel Consistency-Aware Contradiction Score (CACS) to detect zero-day threats in federated multi-cloud environments by explicitly evaluating semantic disagreements across heterogeneous telemetry sources, thereby significantly improving detection recall and reducing false positives compared to existing methods.

Original authors: Deafallah Alsadie, Ahmed Alzahrani

Published 2026-08-20

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Deafallah Alsadie, Ahmed Alzahrani

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital world, large organizations often spread their computing work across many different cloud services, such as those run by Amazon, Microsoft, or Google. This approach, known as a federated multi-cloud environment, offers great flexibility and resilience, but it also creates a complex maze for security teams to navigate. Instead of having a single, clear view of their systems, these organizations must monitor a chaotic mix of data streams: text logs that record who did what, complex maps showing how different computer resources are connected, and real-time numbers tracking system performance like processor speed and network traffic. The most dangerous threats are not the loud, obvious attacks that trigger alarms in a single data stream. Instead, the most elusive dangers are "zero-day" threats—new, unseen attacks that hide by appearing normal in one type of data while behaving strangely in another. They slip through the cracks because no single piece of evidence looks suspicious on its own; the danger only becomes visible when you look at how the different pieces of evidence contradict one another.

Researchers Deafallah Alsadie and Ahmed Alzahrani have developed a new system called CAMF-Zero to solve this specific problem. Their work focuses on teaching computers to reason about these contradictions rather than just adding up data points. Traditional security tools often try to detect attacks by looking for patterns that match known bad behaviors or by simply combining different data sources to see if they agree. However, the authors argue that this approach fails against zero-day threats because these attacks are designed to look innocent in isolation. The researchers propose that the key to finding these hidden threats lies in identifying subtle inconsistencies. For instance, a user might have a legitimate permission to access a file according to the text logs, but if the map of the network shows that file is being accessed from a strange location at the same time the system metrics show unusual activity, the combination of these facts creates a logical conflict. The system is designed to spot this conflict, even if every individual piece of data looks harmless.

To achieve this, the team built a framework that acts like a team of specialized analysts, each looking at a different type of data. One analyst examines the text logs, another studies the network maps, and a third watches the system performance numbers. Instead of just reporting their findings separately, these analysts generate specific hypotheses about what is happening. The system then uses a retrieval mechanism to bring in outside knowledge, such as records of past security rules or known attack patterns, to help interpret these hypotheses. The core innovation is a new method for calculating a "contradiction score." This score does not just measure how similar the data looks; it actively looks for disagreements. It asks whether the story told by the logs makes sense when compared to the story told by the network map and the system numbers. If the logs say everything is fine, but the network map shows a suspicious connection, the system flags this as a contradiction. This process is combined with a way to measure uncertainty, allowing the system to admit when it is not sure, rather than making a confident guess that could be wrong.

The researchers tested their system using data from public cybersecurity benchmarks, which they carefully modified to simulate the messy, incomplete conditions found in real-world cloud environments. They introduced scenarios where data was missing, delayed, or noisy, mimicking the reality that security teams rarely have a perfect, synchronized view of their entire infrastructure. In these tests, the new system consistently outperformed existing methods. While older tools struggled to detect the subtle, distributed attacks, the new framework identified them with significantly higher accuracy. Specifically, the system improved the detection of these unknown threats by between 18 and 25 percent compared to the best previous methods, while simultaneously reducing the number of false alarms by 30 to 40 percent. This means it is much better at finding the real danger without crying wolf too often.

A crucial part of the study was proving that the system remains reliable even when the data it receives is imperfect. In the simulations, the researchers removed up to 40 percent of the data from one of the sources to see how the system would cope. Even with such a large gap in information, the framework maintained a high level of detection performance, whereas other methods saw their accuracy drop sharply. This resilience comes from the system's ability to fill in the missing pieces using the context provided by the other data sources and its ability to weigh the reliability of each piece of evidence. If one data stream is noisy or missing, the system automatically trusts the other streams more, ensuring that the final decision is based on the strongest available evidence.

The study also addressed the practical challenge of speed. Because the system involves complex reasoning steps, the researchers were concerned it might be too slow for real-time use. They tested the system in a streaming environment where data arrives continuously, similar to how a live security operation center works. They found that by adjusting the size of the time windows they analyzed and the depth of the reasoning, they could balance speed and accuracy. In a standard configuration, the system could process a window of data in about 320 milliseconds, a speed fast enough for real-time monitoring. They also demonstrated that by using optimization techniques, such as caching frequently used information, they could make the system even faster without sacrificing much of its detection power.

Ultimately, the work by Alsadie and Alzahrani suggests that the future of cloud security lies not in collecting more data, but in reasoning better about the data we already have. By shifting the focus from simple pattern matching to active contradiction detection, the system can uncover threats that were previously invisible. The findings indicate that when different sources of information tell conflicting stories, that conflict is often the most reliable signal of a new, unseen attack. This approach offers a more robust way to protect complex digital infrastructures, providing security teams with a tool that can think through inconsistencies and make decisions even when the picture is incomplete. The research confirms that by explicitly modeling these contradictions and accounting for uncertainty, it is possible to detect the most dangerous threats in the cloud with greater precision and fewer errors.

Technical Summary: CAMF-Zero

Problem Statement
Zero-day threat detection in federated multi-cloud environments remains a critical challenge due to the heterogeneous and distributed nature of security telemetry. In these environments, attack behaviors are often not confined to a single data stream but emerge through subtle inconsistencies across textual security logs, graph-structured resource relationships, and temporal system metrics. Unlike known attacks that exhibit strong anomalies within a single modality, zero-day threats frequently appear benign when individual data sources are analyzed in isolation. Existing approaches, including unimodal detectors, conventional multimodal fusion, and recent LLM-assisted systems, primarily focus on feature aggregation or contextual interpretation. However, they lack explicit mechanisms for reasoning over contradictory cross-modal evidence under uncertainty. Furthermore, existing methods often treat uncertainty estimation, missing-data handling, and modality reliability as independent optimization objectives rather than integral components of a unified reasoning process, leading to overconfident predictions in open-set scenarios and degraded performance when telemetry is incomplete or asynchronous.

Methodology: CAMF-Zero
To address these limitations, the authors propose CAMF-Zero (Contradiction-Aware Reasoning for Zero-Day Threat Detection), a framework designed to detect weak, distributed threats by explicitly reasoning over semantic contradictions among heterogeneous modalities. The methodology is structured around several key components:

Modality-Specific Encoders: The system processes three distinct modalities locally within each cloud environment to preserve data privacy:
- Textual Logs: Encoded using Transformer-based architectures with attention pooling to capture semantic event dependencies.
- Graph Topology: Represented via Graph Attention Networks (GAT) or Graph Transformers to model structural relationships and dependencies between cloud resources.
- Temporal Metrics: Processed using Temporal Transformers or attention-based LSTMs to capture dynamic system behavior and subtle drifts.
  These encoders project modality-specific embeddings into a shared semantic space to facilitate cross-modal interaction.
Retrieval-Grounded Agentic Reasoning: The framework employs a retrieval-augmented mechanism where current observations are grounded in a knowledge base containing security policies, ATT&CK mappings, and historical patterns. Modality-specific "analyst agents" (LLM-based) generate structured semantic hypotheses from the encoded data and retrieved context.
Consistency-Aware Contradiction Score (CACS): This is the core methodological contribution. Unlike traditional consistency measures that rely on feature similarity, CACS performs reasoning-level evaluation of semantic disagreement. It quantifies contradiction by jointly integrating:
- Semantic Disagreement: Measured via cosine similarity between hypothesis embeddings.
- Symbolic Inconsistency: Derived from violations of security constraints (e.g., IAM policies, graph rules).
- Retrieval Support: Evaluated through entailment scores indicating how well hypotheses align with retrieved knowledge.
- Predictive Uncertainty: Derived from evidential deep learning.
  These factors are combined into a unified score ( $CACS_t$ ) that serves as a direct signal for potential zero-day behavior.
Robustness Mechanisms: To handle the incomplete and noisy nature of federated telemetry, the framework includes:
- Self-Supervised Cross-Modal Alignment: Uses contrastive learning and consistency regularization to ensure representations from different modalities remain semantically coherent.
- Context-Aware Modality Completion: Reconstructs missing or degraded modality representations using available data and retrieved context.
- Adaptive Modality Reliability Weighting: Dynamically adjusts the contribution of each modality based on its evidence strength and uncertainty.
Uncertainty-Calibrated Open-Set Detection: The system utilizes evidential modeling (Dirichlet distribution) to estimate predictive uncertainty. Final decisions are made using a rule that classifies inputs as "unknown/zero-day" if the contradiction score or uncertainty exceeds calibrated thresholds, preventing overconfident misclassification of novel attacks.
Scalable Streaming Architecture: The framework is designed for deployment in streaming environments with optimizations such as parallel agent execution, retrieval caching, quantization, and early-exit reasoning for low-risk inputs to manage latency.

Key Contributions
The paper identifies the following specific contributions:

C1: A contradiction-aware reasoning framework that transforms heterogeneous telemetry into structured semantic hypotheses and explicitly reasons over their agreement and contradiction before prediction.
C2: The Consistency-Aware Contradiction Score (CACS), a novel mechanism that jointly evaluates semantic disagreement, symbolic inconsistencies, retrieved knowledge support, and predictive uncertainty.
C3: A retrieval-grounded agentic reasoning process supported by self-supervised alignment and context-aware modality completion to maintain robustness under incomplete telemetry.
C4: Integration of evidential uncertainty modeling with adaptive modality reliability weighting to support open-set inference.
C5: Provision of interpretable threat analysis by combining modality-level hypotheses, contradiction reasoning, and confidence-aware explanations.
C6: Extensive evaluation demonstrating the framework's effectiveness across diverse datasets and conditions, including ablation and robustness analyses.

Experimental Results
The framework was evaluated on augmented versions of the CIC-IDS2017, CSE-CIC-IDS2018, and UGRansome datasets, simulating federated multi-cloud conditions with injected zero-day patterns and missing/noisy data.

Performance: CAMF-Zero achieved a 94.1% Recall@FPR=5% and 95.7% AUC-PR, significantly outperforming unimodal, conventional multimodal (early/late fusion), LLM-based, and agentic baselines. Specifically, it showed up to 18–25% higher zero-day recall and 38.7% lower false-positive rates compared to the strongest baselines.
Robustness: Under conditions of 30% missing modalities, CAMF-Zero maintained over 85% recall, demonstrating graceful degradation compared to the steeper performance drops of baseline models.
Calibration: The framework achieved a significantly lower Expected Calibration Error (ECE) of 0.041, indicating more reliable uncertainty estimates.
Ablation Studies: Removing the CACS component resulted in a 16.7% drop in recall, confirming that contradiction-aware reasoning is the primary driver of performance.
Latency: In streaming scenarios, the system demonstrated a controllable trade-off between latency and accuracy, with optimized configurations achieving ~320ms latency while maintaining high detection rates.

Significance and Claims
The authors claim that the principal significance of this work lies in shifting the paradigm of multimodal security analysis from feature aggregation to contradiction-aware reasoning. They argue that zero-day threats in federated multi-cloud environments are best identified not by finding strong anomalies in single data streams, but by detecting subtle, distributed inconsistencies across modalities. By explicitly modeling the logical contradictions between semantic hypotheses, symbolic constraints, and retrieved knowledge, CAMF-Zero provides a structured approach to detecting weak attack signals that traditional fusion methods miss. The framework offers a principled method for handling uncertainty and incomplete data, making it suitable for realistic, privacy-preserving federated deployments where raw telemetry cannot be centrally aggregated. The authors conclude that while the approach introduces computational overhead, the integration of agentic reasoning with contradiction scoring provides a necessary foundation for trustworthy, interpretable, and robust zero-day detection in complex cloud infrastructures.

More like this