Evidence Hub

CAMF-Zero: Contradiction-Aware Reasoning for Zero-Day Threat Detection in Federated Multi-Cloud Environments

Alsadie D, Alzahrani A

2026

Abstract

Abstract Zero-day threats remain difficult to detect in federated multi-cloud environments because attack behaviors are often distributed across heterogeneous telemetry, including textual security logs, graph-structured resource relationships, and temporal system metrics. Unlike known attacks, zero-day behaviors rarely manifest as strong anomalies within a single modality, but instead emerge through subtle inconsistencies across multiple sources of evidence. Existing unimodal, multimodal, and LLM-assisted detection approaches primarily emphasize feature aggregation or contextual interpretation, while providing limited support for explicit reasoning over contradictory cross-modal evidence under uncertainty. To address this challenge, this paper proposes CAMF-Zero, a contradiction-aware reasoning framework for zero-day threat detection in federated multi-cloud environments. The principal methodological contribution is the proposed Consistency-Aware Contradiction Score (CACS), which performs reasoning-level evaluation of semantic disagreement among modality-specific hypotheses by jointly incorporating semantic inconsistency, symbolic security constraints, retrieved knowledge support, and predictive uncertainty into a unified contradiction measure. Modality-specific encoders, retrieval-grounded agentic hypothesis generation, self-supervised cross-modal alignment, context-aware modality completion, and evidential uncertainty estimation are integrated as supporting mechanisms to…

Read the paper

Related studies

Go deeper in Evidence Hub

Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.

Open this study Sign up free