HAVE: Host Active Verification Engine for Closing the Contextual Reality Gap in Security Digital Twins

Abstract: Security Digital Twins (SDTs) provide continuously updated virtual replicas of infrastructure for threat simulation, yet they rely on theoretical CVSS scores to assign lateral-movement probabilities -- creating the Contextual Reality Gap: risk is overestimated where unacknowledged mitigations neutralize exploits, and drastically underestimated where logic flaws bypass all memory-safety defenses. We present the Host Active Verification Engine (HAVE), an SDT extension that deploys a safety-constrained host agent to measure the empirical probability of compromise $\hat{p}$ via maximum-likelihood estimation over snapshot-isolated Bernoulli trials. A Wilson interval-width confidence weight $α<em>w$ propagates $\hat{p}$ into Monte Carlo simulations via a Bayesian blending rule formally related to the Beta-Binomial posterior. Evaluation across four vulnerability classes, three security tiers, and two production binaries shows HAVE reduces $P</em>{\text{reach}}$ by 38.2% in false-positive scenarios and increases it by 132.4% in false-negative scenarios, with a net +124.1% correction; post-HAVE estimates vary by only $1.12\times$ across calibration exponents $κ$, versus $4.6\times$ for CVSS-only baselines.

• The paper introduces HAVE, which empirically quantifies host-specific exploitability to close the contextual reality gap in SDT risk models.
• The methodology comprises a two-phase pipeline with static analysis and snapshot-based dynamic trials, using Bayesian blending to refine risk estimates.
• Empirical validation demonstrates that HAVE mitigates false risk predictions compared to CVSS-only models, thereby improving security operations.

Host Active Verification Engine: Empirical Closure of the Contextual Reality Gap in Security Digital Twins

Problem Formulation: The Contextual Reality Gap in SDT-Based Risk Assessment

Standard Security Digital Twin (SDT) approaches synthesize continuously updated attack graphs from passive network telemetry and host inventories, assigning lateral-movement probabilities using static CVSS-derived models. This produces a critical “Contextual Reality Gap”: the separation between context-free, theoretical risk (as scored by CVSS and related frameworks) and practical, host-specific exploitability. In practice, this gap results in systematic overestimation of risk in presence of effective, unaccounted mitigations (e.g., PIE+ASLR+Canary binaries), and dangerous underestimation when logic flaws bypass all memory-safety defenses. The empirical quantification and closure of this gap is non-trivial due to the operational risk and technical constraints of running active tests in IT and OT settings.

Proposed Architecture: HAVE Design and Safety Model

The Host Active Verification Engine (HAVE) is introduced as a feedback component embedded in the SDT ecosystem, tasked with synthesizing host-specific empirical probabilities of compromise ($\hat{p}$) using safety-constrained exploit trials. HAVE is architected with a hub-and-spoke model: the central controller orchestrates campaigns, while agile, privileged agents perform static and dynamic analysis. The agent instantiates three core safety primitives: (1) strict cgroups v2 CPU capping, (2) path-level allow-list enforcement on exploit targets, and (3) mutual TLS (mTLS) command channels with cryptographic authentication. In OT contexts, all dynamic trials are run within snapshot-restored VMs, fundamentally eliminating stability and artifact risks. This safety model is necessary to satisfy industrial requirements for non-intrusive security testing and aligns with prior recommendations for live attack simulation [muench2018whatyou].

Methodological Contributions

Formalization of the Contextual Reality Gap

This work provides a formal definition and quantification of the “Contextual Reality Gap”: the divergence between CVSS-derived exploitability estimates and empirically rooted host-level probabilities. This definition is substantiated by cross-validated experiments on synthetic and real-world binaries, with Cohen’s weighted $\kappa$-agreement measured and reported.

Two-Phase Empirical Verification Pipeline

HAVE’s measurement mechanism is divided into:

• Phase I: Granular Static Analysis: Extraction of a host+binary-specific Defense Profile $\Pi_i$ encompassing ASLR level, PIE status, stack canaries, RELRO, and additional hardening features. The effective interaction of mitigation techniques is precisely modeled (see their $R_{eff}$ formulation), capturing contexts where defense layering is either synergistic or ineffective.
• Phase II: Dynamic Empirical Trials: Execution of snapshot-isolated Bernoulli trials using pre-validated, non-destructive exploits targeted per vulnerability class. Each trial’s outcome determines $\hat{p}$, with rigorous statistical characterization using Wilson confidence intervals. By restoring the VM state prior to each trial, independence and stationarity are enforced, and resource isolation is guaranteed.

Monte Carlo Simulation and Bayesian Blending

Post-measurement, HAVE infuses the empirically measured $\hat{p}$ into the SDT’s attack graph simulation via a Bayesian blending rule. The confidence weight $\alpha_w$ is derived from the Wilson interval width, enabling state-dependent fusion of CVSS priors and empirical posteriors, in contrast to canonical n-gram-based Beta-Binomial confidence updates. Extensive Monte Carlo evaluation demonstrates robust risk estimation even across graph topologies with nonlinear path competition.

Empirical Validation and Numerical Findings

Vulnerability Classes, Security Tiers, and Strong Claims

The study systematically evaluates stack buffer overflow, format string, heap UAF, and logic flaw vulnerabilities, each at three security hardening tiers (Low/Medium/High). Rigorous, high-$N$ statistical experimentation reveals:

• Stack/Heap Exploits: Modern defense-in-depth completely neutralizes blind stack and heap exploits; High-tier PIE+ASLR binaries yield $\hat{p}=0.00$ with a Wilson upper bound of $0.037$ at $\kappa$0 trials.
• Format-String Vulnerabilities: Despite full hardening, format string exploits retain nonzero exploitability ($\kappa$1, CI $\kappa$2 at High tier) due to address leakage primitives bypassing randomization.
• Logic Flaws: All memory-safety classes are irrelevant to logic flaws, which remain unconditionally exploitable ($\kappa$3), a claim validated across synthetic and real-world binaries (e.g., CVE-2021-42013).

Real-World Binaries and Generalizability

Production validation against sudo (CVE-2021-3156) and Apache httpd (CVE-2021-42013) demonstrates that synthetic mitigation-effectiveness patterns generalize. For instance, disabling PIE and ASLR in sudo enables reliable exploitation ($\kappa$4); their presence renders the same CVE non-exploitable ($\kappa$5).

Impact on SDT Risk Models

Monte Carlo simulation over a dual-path, five-node attack graph demonstrates pronounced non-linearity in full-path risk propagation. Correction of false-positive edges (hardening memory exploitation) reduces path probability by $\kappa$6, but simultaneous correction of false-negative logic flaw estimations increases global risk by $\kappa$7, netting a $\kappa$8 correction. CVSS-only models underestimate risk by a factor of $\kappa$9. Sensitivity analysis over prior mapping exponents ($\Pi_i$0) shows post-HAVE risk estimates are robust (varying only by $\Pi_i$1), while CVSS-only baselines are highly sensitive ($\Pi_i$2 variation).

Theoretical and Practical Implications

Theoretical Advances

The analysis confirms that exploitability is an emergent property of the full binary-host context, not solely a function of individual mitigations. Bayesian blending strategies anchored in empirical confidence intervals provide more epistemically defensible risk propagation than classic population-level scoring. The method offers a quantitative lower bound on risk, subject to exploit library coverage and modeled adversary capability.

Practical Impact

HAVE provides a direct operational mechanism for updating SDT-based attack graphs with empirically calibrated edge probabilities, substantially improving risk fidelity for both IT and OT infrastructures. It enables resource-bound, event-driven, and auditable verification, minimizing operational disruption.

Prospective Directions

Extending HAVE with Automated Exploit Generation and coverage-guided fuzzing would yield improved bounds for novel and zero-day exploit paths. Adapting hypervisor-based snapshotting for embedded and containerized environments (e.g., via CRIU or advanced container checkpointing) is a technical priority for broader deployment. At scale, assessing aggregate simulation accuracy under large-scale multi-node HAVE deployment is an open question with significant assurance implications.

Conclusion

The Host Active Verification Engine empirically closes a core structural limitation in SDT-based security risk assessment by directly measuring and propagating host-specific probabilities of compromise. Comprehensive statistical and operational experiments demonstrate its capacity to deliver robust, mitigation-aware, and context-sensitive risk estimates, producing outcomes that contradict static CVSS-based models in both quantitative and qualitative terms. With formal safety guarantees and extensible methodological primitives, HAVE constitutes an architectural advance in risk quantification, with direct applicability to security operations, compliance, and adversarial resilience modeling (2606.06968).