ARDAI/ML-ASSISTEDACCOUNT-INDEPENDENT TRUST
Dockfield ARD
Detect abnormal behaviour.
Protect the recovery decision.
ARD is Dockfield's intelligent detection and evidence layer for ransomware-aware recovery. It observes behaviour over time, compares independent anomaly signals, calibrates confidence and feeds explainable evidence into deterministic recovery policy.
ObserveAWS + recovery signals
→
DetectBehavioural anomalies
→
CalibrateEvidence confidence
→
DecidePolicy + explainability
→
QuarantineUntrusted boundary
→
RecoverValidated path
Macro AI/ML architecture
Independent evidence first. Complexity only where it adds measurable value.
Self-supervised temporal detectionModels normal behavioural context over time and highlights sequences that no longer fit the learned operating pattern.
Independent statistical detectionBaseline deviation, bursts and change patterns provide a second, interpretable anomaly family.
Optional multi-resolution featuresMexican-hat and other multi-scale signal features can contribute where telemetry density makes that analysis useful; they are not treated as universal truth.
Why the Mexican hat? Conceptually, it can highlight a local change against its surrounding context at different scales. Dockfield treats this kind of signal processing as optional supporting evidence, not as the foundation of ransomware classification.
Evidence fusion
One anomaly does not become one automatic recovery.
BEHAVIOURTemporal patterns and sequence changes.
STATISTICSIndependent deviation and change evidence.
SECURITYSignals from the security estate when available and trusted.
RECOVERYIntegrity, provenance and trust of candidate recovery points.
Calibrated evidenceSignals with different scales are normalised into a comparable confidence view while preserving provenance.
→
Explainable decisionThe system records what changed, which evidence contributed and which deterministic policy allowed the next action.
→
Deterministic safety policyFinal recovery actions are gated by explicit, auditable policy rather than by any single model score.
Where ARD lives
Outside the assumption that the Security account will always survive.
Security & workload estateImportant evidence source, but never the only trust anchor. Security accounts can themselves be treated as suspect.
→
ARD / resilience decision planeCorrelates independent evidence and continuously asks whether the current control plane can still be trusted.
→
Isolated recovery boundaryQuarantine, validation and recovery can move outside the affected trust domain, including fresh-account or independent-organisation recovery patterns.
Security account affectedSecurity evidence becomes degraded or untrusted; independent evidence remains available to the resilience decision path.
Multiple accounts affectedRecovery selection and quarantine move toward an isolated recovery boundary.
Existing organisation untrustedFresh-account / independent-organisation recovery patterns can be selected when the protected recovery authority and evidence remain available.
No single-account dependency. ARD is designed so workload, security and recovery accounts are separate trust domains. For severe compromise, the architecture can treat the existing AWS estate as evidence to be investigated rather than as the authority that approves its own recovery.
ARD + Intelligent Recovery
Detection is useful only when it improves the recovery decision.
Dockfield connects anomaly evidence directly to quarantine, validation and isolated recovery patterns while keeping the final safety policy explicit.