AI-Driven Software Security Engineering In CI/CD Microservice Pipelines: A Leakage-Aware Shift-Left/Shift-Right Evidence Integration Framework

Abstract

DevSecOps requires security evidence to be continuously integrated throughout the software development lifecycle and across operational runtime stages. In this study, we propose a reproducible proof-of-concept framework that integrates Shift-Left pre-deployment security evidence with Shift-Right runtime anomaly detection. The framework employs four unsupervised anomaly detection methods: Isolation Forest (IF), Local Outlier Factor (LOF), One-Class Support Vector Machine (OCSVM), and an Autoencoder (AE). A controlled synthetic dataset comprising 4,600 sessions was generated, including 4,000 benign sessions, 300 sessions representing known attacks, and 300 sessions representing synthetic runtime-only anomalies. Each session contained 18 features, comprising eight Shift-Left pre-deployment security indicators and ten Shift-Right runtime telemetry features. The dataset was stratified into training (70%), validation (15%), and testing (15%) subsets. Only benign training samples were used for feature scaling and unsupervised detector training, while the labeled validation partition was used exclusively to calibrate fusion weights and decision thresholds. The test partition remained untouched until the final evaluation to reduce the risk of data leakage.In the primary run, validation-only selection reduced the four-component fusion to the Autoencoder alone, which achieved an F1-score of 0.9570, an MCC of 0.9510, a PR-AUC of 0.9982, a false-positive rate of 0.0117, a known-attack recall of 1.0000, and a runtime-only recall of 0.9778 on the locked test set. An exploratory primary-run ablation showed that the equal-weight Isolation Forest–Autoencoder configuration achieved a higher test F1-score of 0.9677; however, this configuration was not retrospectively selected, thereby preserving the independence of the locked test evaluation. To assess the robustness of the findings, the complete experimental pipeline, including synthetic data generation, data partitioning, model training, validation-based tuning, and locked-test evaluation, was independently repeated across 30 runs. Logistic Stacking achieved the highest mean F1-score (0.9704 ± 0.0163; 95% empirical percentile interval: 0.9362–0.9944), followed by LOF (0.9619 ± 0.0169), OCSVM (0.9584 ± 0.0154), and the validation-tuned four-component fusion (0.9568 ± 0.0175; 95% empirical percentile interval: 0.9210–0.9862). Paired Wilcoxon signed-rank tests with Holm correction showed that Logistic Stacking significantly outperformed the validation-tuned fusion, whereas no statistically significant differences were observed between the tuned fusion and the individual anomaly detectors.These findings highlight the importance of repeated experimentation, ablation analysis, leakage-aware evaluation, and validation-only calibration for obtaining reliable performance estimates. They further demonstrate that weighted evidence fusion does not consistently outperform strong standalone anomaly detectors and should therefore be selected based on validation evidence rather than the assumption that combining additional evidence sources necessarily improves predictive performance. Nevertheless, integrating Shift-Left and Shift-Right evidence provides an architectural mechanism for connecting security information across different stages of the software development lifecycle. Because all experiments were conducted using controlled synthetic data, the proposed framework should be interpreted as a methodological proof-of-concept rather than a production-ready security solution.