DROS-PGM: Deterministic Kernel-Level Execution Control for Post-Compromise Security / DROS-PGM:基於內核級運行期安全之確定性執 行控制平面

Modern enterprise security architectures rely heavily on identity- (IAM) and network-centric (ZTNA) perimeter access control models. However, once a process passes authentication or becomes hijacked post-authentication by malicious workloads (e.g., ransomware, phishing payloads, privilege escalation attacks), these reactive mechanisms fail to provide deterministic access confinement at the binary execution layer, creating an Execution-to-Detection Latency Gap. We propose DROS-PGM (Deterministic Runtime Operation System – Physical Guard Module), establishing Execution Trust as a formal security abstraction at the kernel execution boundary.
If autonomous AI agents are to become auditable and accountable execution subjects in regulated enterprise environments,
the six dimensions—Principal, Authorization, Policy, Action Binding, Audit, and Expiry/Revocation (the 6P Operational Baseline)—should be viewed as the minimum operational baseline for governance completeness rather than optional features. Existing 2026 literature has advanced semantic defense, capability safety, runtime authorization, and capability kernels; however, to the best of our knowledge, no publicly available system concurrently demonstrates 6P governance completeness, native/OS execution enforcement depth, and high-concurrency inline survivability within a single reproducible implementation.
Under 1,000 controlled adversarial test cases (covering ransomware encryption, data exfiltration, and privilege escalation) and a 72-hour soak test, DROS-PGM achieved a 100% containment blocking rate (0/1,000 evasions) on the evaluated corpus, with a False Positive Rate (FPR) = 0.00% under benign workloads. In SPEC CPU2017 benchmarks, the system introduces a negligible 1.2% overhead while maintaining wirespeed performance up to 952,991 QPS (inline policy decisions per second). Security properties are formally proven under the stated threat model and TCB assumptions.

現代企業安全架構主要依賴基於身份(IAM)與網絡(ZTNA)的存取控制模型。然而,當進程通過身份驗證或在運行期間遭惡意程式(例如勒索軟體、釣魚酬載、特權提升攻擊)劫持後,現有的後驗檢測機制無法在二進位執行層提供確定性的存取約束,從而產生「執行與檢測間的時間滯後(Execution-to-Detection Latency Gap)」。我們提出了DROS-PGM(確定性運行期操作系統——物理防護模組,Deterministic Runtime Operation System – PhysicalGuard Module),將「執行信任(Execution Trust)」提出為
一種針對內核執行邊界的安全抽象(Security Abstraction)。DROS-PGM 採用執行強制、日誌遙測和密碼學證明三平面解耦模型,在亞微秒級帶內延遲(≈ 353 ns)下運行。若要使自主AI 代理人(Autonomous AI Agents)在受監管的企業環境中成為具備可追責性之執行主體,身分主體(Principal)、授權(Authorization)、策略(Policy)、工具動作綁定(Action Binding)、審計存證(Audit)與過期撤銷(Expiry/Revocation)六大維度(6P Operational Baseline)應被視為治理閉環之最低必要基準。
現有2026 年前沿研究已分別在語義防禦、能力安全、執行時授權與密碼學能力內核取得進展;惟據我們對公開系統之調查,尚無公開記錄系統能同時展示6P 治理閉環、原生OS 執行強制深度與高併發帶內存活性(High-Concurrency Inline Survivability)於單一可重現之實證系統中。
我們進一步引入基於僅可追加(append-only)遙測日誌與梅克爾樹(Merkle Tree)批次證明的密碼學可審證運行期基底。在1,000 次受控對抗性測試(涵蓋勒索軟體加密、數據外洩與特權提升)及72 小時浸泡測試中,DROS-PGM 在評估語料庫下達到了100% 的包含阻擋率(0/1,000 逃逸),正常工作負載下的誤報率(FPR)= 0.00%。在SPEC CPU2017基準測試中,系統僅引入1.2% 的開銷,並保持高達952,991QPS 的策略決策線速效能。在宣告之威脅模型與TCB 假設下,本文給出系統安全性質之形式化證明。