EVENT PROPAGATION CONTAINMENT IN AWS SERVERLESS PIPELINES USING MACHINE LEARNING

This paper studies containment of cascading event propagation in AWS serverless pipelines when an authorized event source is compromised and falsifies self-reported metadata. It shows that a deterministic ingress risk-scoring gate, effective under trusted metadata, completely fails to contain propagation when the metadata are falsified. No malicious event is quarantined, and the previous 74 % reduction in the propagation factor disappears. A post-gate behavioral response loop with a trained model and source reputation is proposed, relying on the actual fan-out of an event and the reputation of its source. The model was evaluated in an autonomous testbed simulator validated against the AWS testbed for cascade dynamics. At intensities not represented during training, it detects known abuse types: masking with a recall of 1.00 and volume abuse with a recall of 0.997 at a test event-level false-positive rate of 0.011 ± 0.007. In a closed response loop simulated in the same environment, the absolute blast radius per malicious source decreases by 96.6 % for masking and by 99.0 % for volume abuse. The approach complements rather than replaces the early gate. Its limitations include residual post-gate leakage, reputation cold start, and false suppression of legitimate traffic.