Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks

• URL: http://arxiv.org/abs/2606.28923v1
• Date: Sat, 27 Jun 2026 13:56:56 GMT
• Title: Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks
• Abstract summary: We present an industrial case study of a self-supervised learning method using graph neural networks applied to AWS CloudTrail logs.<n>The proposed model produced substantially fewer alerts than a domain expert rule-based baseline in almost all cases.
• Score: 27.825233895068255
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Detecting security threats in an organization's cloud computing environment has become necessary due to the increased reliance on cloud infrastructure. Logging of all cloud computing events enables investigation into any incidents after they are detected. Automated detection of threats using the logs based on heuristics or anomaly detection could result in a high false positive rate due to its relatively static nature. In this article, we present an industrial case study of a self-supervised learning method using graph neural networks applied to AWS CloudTrail logs to surface suspicious events for analyst review. The model produces an anomaly score for each event and dynamically adapts to changes in the organization without requiring periodic retraining. Based on our experiments across five organizations, the proposed model produced substantially fewer alerts than a domain expert rule-based baseline in almost all cases, reducing alert volumes to approximately 1 per hour from thousands generated by traditional methods. We note that this evaluation covers only flagged events, and false negatives cannot be estimated from the current data; findings should therefore be interpreted as a practical deployment study offering insights into real-world constraints rather than a fully validated detection system. We discuss these limitations and the requirements for extending the approach to other cloud environments as future work.

Related papers

• X-WAD: eXplainable Web Anomaly Detection [0.0]
  Modern defenses increasingly model normal behavior, relying on semi-supervised approaches trained on only normal data.<n>This paper investigates the effectiveness of Transformer-based Language Models (TLMs) in the detection of anomalies in HTTP requests.
  arXiv  Detail & Related papers  (2026-08-27T14:23:01Z)
• Graph Neural Network Based Adaptive Threat Detection for Cloud Identity and Access Management Logs [0.0]
  This paper presents a Graph Neural Network Based Adaptive Threat Detection framework.<n>It learns latent user resource interaction patterns from IAM audit trails in real time.
  arXiv  Detail & Related papers  (2025-12-11T04:44:02Z)
• Reducing False Positives with Active Behavioral Analysis for Cloud Security [2.4631419586608225]
  Rule-based cloud security posture management (CSPM) solutions are known to produce a lot of false positives.<n>This paper introduces a validation-driven methodology that integrates active behavioral testing in cloud security posture management solution(s) to evaluate the exploitability of policy violations in real time.
  arXiv  Detail & Related papers  (2025-08-18T02:39:02Z)
• Few-Shot Learning-Based Cyber Incident Detection with Augmented Context Intelligence [2.036740192779817]
  This paper proposes a new few-shot learning-based attack detection with improved data context intelligence.<n>We collect operating system behavior data of cloud systems during realistic attacks and leverage an innovative semiotics extraction method to describe system events.
  arXiv  Detail & Related papers  (2025-06-19T21:53:02Z)
• Cloudy with a Chance of Anomalies: Dynamic Graph Neural Network for Early Detection of Cloud Services' User Anomalies [9.035212370386846]
  This paper introduces a pioneering time-based embedding approach for Cloud Services Graph-based Anomaly Detection (CS-GAD) Our method employs a dynamic tripartite graph representation to encapsulate the evolving interactions among cloud services, users, and their activities over time. Results demonstrate a notable reduction in false positive rates (2-9%) compared to prevailing methods, coupled with a commendable true positive rate (100%)
  arXiv  Detail & Related papers  (2024-09-19T12:50:31Z)
• SINDER: Repairing the Singular Defects of DINOv2 [61.98878352956125]
  Vision Transformer models trained on large-scale datasets often exhibit artifacts in the patch token they extract. We propose a novel fine-tuning smooth regularization that rectifies structural deficiencies using only a small dataset.
  arXiv  Detail & Related papers  (2024-07-23T20:34:23Z)
• PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning [58.85063149619348]
  We propose PULL, an iterative log analysis method for reactive anomaly detection based on estimated failure time windows. Our evaluation shows that PULL consistently outperforms ten benchmark baselines across three different datasets.
  arXiv  Detail & Related papers  (2023-01-25T16:34:43Z)
• Self-Supervised Training with Autoencoders for Visual Anomaly Detection [61.62861063776813]
  We focus on a specific use case in anomaly detection where the distribution of normal samples is supported by a lower-dimensional manifold. We adapt a self-supervised learning regime that exploits discriminative information during training but focuses on the submanifold of normal examples. We achieve a new state-of-the-art result on the MVTec AD dataset -- a challenging benchmark for visual anomaly detection in the manufacturing domain.
  arXiv  Detail & Related papers  (2022-06-23T14:16:30Z)
• Zero Day Threat Detection Using Graph and Flow Based Security Telemetry [3.3029515721630855]
  Zero Day Threats (ZDT) are novel methods used by malicious actors to attack and exploit information technology (IT) networks or infrastructure. In this paper, we introduce a deep learning based approach to Zero Day Threat detection that can generalize, scale, and effectively identify threats in near real-time.
  arXiv  Detail & Related papers  (2022-05-04T19:30:48Z)
• Convolutional generative adversarial imputation networks for spatio-temporal missing data in storm surge simulations [86.5302150777089]
  Generative Adversarial Imputation Nets (GANs) and GAN-based techniques have attracted attention as unsupervised machine learning methods. We name our proposed method as Con Conval Generative Adversarial Imputation Nets (Conv-GAIN)
  arXiv  Detail & Related papers  (2021-11-03T03:50:48Z)
• TELESTO: A Graph Neural Network Model for Anomaly Classification in Cloud Services [77.454688257702]
  Machine learning (ML) and artificial intelligence (AI) are applied on IT system operation and maintenance. One direction aims at the recognition of re-occurring anomaly types to enable remediation automation. We propose a method that is invariant to dimensionality changes of given data.
  arXiv  Detail & Related papers  (2021-02-25T14:24:49Z)
• Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models [59.04636530383049]
  Anomalies or failures in large computer systems, such as the cloud, have an impact on a large number of users. We propose a framework for anomaly detection in log data, as a major troubleshooting source of system information.
  arXiv  Detail & Related papers  (2021-02-23T09:17:05Z)
• Firearm Detection via Convolutional Neural Networks: Comparing a Semantic Segmentation Model Against End-to-End Solutions [68.8204255655161]
  Threat detection of weapons and aggressive behavior from live video can be used for rapid detection and prevention of potentially deadly incidents. One way for achieving this is through the use of artificial intelligence and, in particular, machine learning for image analysis. We compare a traditional monolithic end-to-end deep learning model and a previously proposed model based on an ensemble of simpler neural networks detecting fire-weapons via semantic segmentation.
  arXiv  Detail & Related papers  (2020-12-17T15:19:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.