THOR-SEC

Research paper · Research archive

Mission-Invariant Architecture Morphing (MIAM)

Service-Graph Reconfiguration Against Post-Access Reconnaissance, with Cryptographic Epoch Isolation and Mission-Domain State Continuity.

· preprint · version 1.0.0 · CC BY 4.0 · DOI 10.5281/zenodo.23001045

Read the paper (PDF) DOI record

Research status

Design proposal and formal model. It reports no empirical security advantage, and the contribution of service-graph morphing is unmeasured until the ablation protocol in the paper is run.

Abstract

Modern moving-target defenses alter addresses, ports, hosts, software variants, workflows, or computing environments to reduce the useful lifetime of attacker observations. This paper proposes Mission-Invariant Architecture Morphing (MIAM), a research architecture that moves the defensive transformation boundary into the application itself, targeting post-initial-access reconnaissance such as dependency mapping, lateral movement, and credential reuse.

MIAM represents a workload as capability units assigned to runtime service graphs drawn from a certified grammar. For each candidate graph, machine-evaluable attack-prerequisite predicates estimate which previously learned conditions remain actionable, while a separate exposure term bounds new attack surface introduced by the candidate. A graph delta is combined with a capability-state map to derive a transition policy that permits only validated mission-domain state to cross the epoch boundary while blocking designated runtime and security state. A verified target graph is then instantiated under distinct epoch authority and cut over behind a stable logical interface.

The paper develops an operational reconnaissance-transfer model, architecture-distance measures, a recurrence-aware retention model showing that a finite variant pool imposes a nonzero knowledge floor, a cryptographic epoch-isolation construction, a graph-delta-driven State Continuity Firewall, an enterprise implementation path, an ablation-based experimental protocol, and a reference claim set released as a defensive publication. The work is a design proposal produced through independent open-source cybersecurity research; it reports no empirical security advantage and makes no patentability determination.

Known limitations

  • The work is a design and mathematical model without experimental data. Security efficacy and overhead remain open questions.
  • Common-mode vulnerabilities survive morphs when every variant shares the same vulnerable library, API logic, secret, or trust decision.
  • A finite certified pool leaves a nonzero recurrence floor: an attacker who maps every graph in a small pool keeps knowledge that no morph rate can remove.
  • Much of the benefit of an epoch transition may come from rejuvenation and credential rotation rather than graph change.
  • Control-plane compromise is catastrophic, and telemetry poisoning can turn adaptation into an attack primitive.

Summarized from the paper. The full list is in its section on limitations, failure modes, and open research problems.

Artifacts

Cite this work

Plain text

Thor, T. (2026). Mission-Invariant Architecture Morphing: Service-Graph
Reconfiguration Against Post-Access Reconnaissance, with Cryptographic Epoch
Isolation and Mission-Domain State Continuity (1.0.0). Zenodo.
https://doi.org/10.5281/zenodo.23001045

BibTeX

@misc{thor2026miam,
  author    = {Thor, Thor},
  title     = {Mission-Invariant Architecture Morphing: Service-Graph Reconfiguration Against Post-Access Reconnaissance, with Cryptographic Epoch Isolation and Mission-Domain State Continuity},
  year      = {2026},
  version   = {1.0.0},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.23001045},
  url       = {https://doi.org/10.5281/zenodo.23001045}
}

Version history

  • Version 1.0.0 · Initial public release, archived on Zenodo.

Disclosure status

Appendix A of the paper is a reference claim set released as a defensive publication. It places the mechanism in the public record as prior art. No patent or filing status is claimed. See Inventions.