💻 computer science

AI-Enabled System for Efficient and Effective Cyber Incident Detection and Response in Cloud Environments

This research proposes an integrated, AI-powered cyber incident response system for cloud environments that utilizes machine learning models—specifically Random Forest and deep learning—to achieve high accuracy in network traffic classification, web intrusion detection, and malware analysis.

Original authors: Mohammed Ashfaaq M. Farzaan, Mohamed Chahine Ghanem, Ayman El-Hajjar, Deepthi N. Ratnayake

Published 2026-02-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Mohammed Ashfaaq M. Farzaan, Mohamed Chahine Ghanem, Ayman El-Hajjar, Deepthi N. Ratnayake

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your digital life—your bank accounts, private photos, and work files—is a massive, high-tech skyscraper (the Cloud). Because this building is so huge and important, it is constantly being targeted by professional burglars, hackers, and digital vandals.

Traditionally, security guards in this building would rely on manual patrols and old-fashioned alarms. But the burglars are getting faster and smarter. This paper proposes a new way to protect the skyscraper: hiring an army of super-intelligent, automated robot guards (AI and Machine Learning) that never sleep.

Here is how this "AI Security System" works, broken down into three main roles:

1. The Traffic Inspector (Network Traffic Classifier)

The Analogy: Imagine the skyscraper has a massive revolving door where thousands of people enter every minute. A human guard can’t check every single person’s ID without causing a massive traffic jam.
The AI Solution: This is like having a high-speed scanner at the door. It looks at the "vibe" of the crowd. It doesn't just look at faces; it looks at how people are walking, if they are moving in suspicious patterns, or if they are trying to rush the door all at once. Using a method called "Random Forest" (think of it as a panel of expert judges voting on whether someone looks suspicious), the system can instantly spot a "bad actor" trying to sneak in and shut the door before they even reach the elevator.

2. The Secret Agent (Web Intrusion Detection)

The Analogy: Imagine the building has a gift shop (a Website) where customers interact with staff. A thief might not break a window; instead, they might try to trick the clerk into giving them the keys to the safe by asking weird, nonsensical questions.
The AI Solution: This system acts like a "secret shopper." It listens to the conversations (the web logs) happening in the gift shop. If it hears someone asking questions that don't make sense or trying to follow a path they shouldn't (like trying to walk through a wall), the AI flags it as "weird behavior." It uses a technique called "Isolation Forest," which is like a game of "Spot the Odd One Out"—it's very good at finding the one person in a crowd who is acting completely differently from everyone else.

3. The Forensic Lab (Malware Analysis)

The Analogy: Suppose a suspicious, unmarked package is left in the lobby. You don't want to open it manually because it might contain a trap.
The AI Solution: This is a high-tech, automated laboratory. The system takes the "package" (a suspicious file), puts it in a safe, robotic testing chamber, and examines its "DNA" (the code). It uses two layers of protection: first, a quick scan to see if it looks like known junk, and second, a "Deep Learning" brain (the Keras model) that acts like a master detective, looking at the tiniest, most complex details to see if the file is secretly a ticking time bomb.

The "Secret Sauce": Why is this special?

The Honeypot (The Decoy): The researchers didn't just build walls; they built a "fake" room in the skyscraper that looks like it's full of gold but is actually a trap. When hackers break into this room, the AI watches exactly how they work. This "practice" makes the AI smarter every single day.
The Shipping Containers (Scalability): Instead of building one giant, heavy security machine, they built the security tools in "containers" (like LEGO blocks). If the building grows from 10 floors to 1,000 floors, they can just snap more security LEGOs into place instantly.
The Cloud Advantage: Because the system lives in the Cloud (like Google or Microsoft), it has access to massive amounts of "brain power" (computing strength) whenever it needs to solve a difficult puzzle.

The Bottom Line

In short, this paper isn't just about building a better lock; it's about building a living, learning, and breathing security ecosystem that can predict, detect, and stop digital criminals in real-time, making our "Cloud Skyscrapers" much safer places to live and work.

Technical Summary: AI-Enabled System for Efficient and Effective Cyber Incident Detection and Response in Cloud Environments

1. Problem Statement

As cyber threats become increasingly sophisticated and voluminous, traditional manual incident response (IR) strategies are proving inadequate, especially within cloud infrastructures. Organizations face significant challenges in detecting, analyzing, and mitigating threats in real-time. There is a critical need for automated, scalable, and precise systems that can handle diverse attack vectors—ranging from network-level intrusions and web-based attacks to malicious file executions—while minimizing the high costs associated with data breaches.

2. Methodology

The researchers propose a novel, three-tier AI-powered architecture designed for deployment in cloud environments (specifically Google Cloud and Microsoft Azure). The system leverages containerization (Docker/Kubernetes) to ensure modularity, scalability, and isolation. The architecture is divided into three functional environments:

Production Environment: Hosts critical infrastructure and mirrors network traffic to the analysis environment.
Honeypot Environment: Utilizes a T-Pot honeypot to attract attackers, providing a source of real-world, labeled data for continuous model retraining.
DFIR (Digital Forensics and Incident Response) Environment: The central hub for analysis, containing three specialized AI-driven components:

A. Network Traffic Classifier:

Mechanism: Uses a modular containerized approach (Capture Engine $\rightarrow$ Feature Engine $\rightarrow$ Model Classifier). It captures real-time traffic via the Scapy library and converts PCAP files into structured datasets.
Models: Primarily utilizes the Random Forest algorithm for real-time classification of network anomalies.

B. Web Intrusion Detection System (WIDS):

Mechanism: Employs lightweight agents on web servers to collect and forward HTTP server logs via Secure Copy Protocol (SCP).
Models: Uses the Isolation Forest algorithm for unsupervised anomaly detection. It features a novel "threshold-based" alerting mechanism to reduce false positives by triggering alerts only when a burst of anomalies is detected.

C. Malware Analysis System:

Mechanism: A Flask-based application that performs static analysis on uploaded executable files.
Models: Implements a hybrid dual-model architecture. A Random Forest model provides rapid initial classification. If the prediction is uncertain (probability between 0.5 and 0.7), a secondary Keras TensorFlow LSTM (Long Short-Term Memory) deep learning model is invoked to analyze sequential data (strings/features) for higher precision.

3. Key Contributions

End-to-End Integrated Framework: Unlike monolithic or single-purpose tools, this system provides a unified pipeline covering network, web, and file-based threats.
Continuous Learning Loop: The integration of a honeypot environment creates a proactive feedback loop where new attack patterns are captured, labeled, and used to retrain models automatically.
Hybrid Detection Strategy: The use of a dual-model approach in malware analysis effectively balances computational efficiency (Random Forest) with high-precision deep learning (LSTM).
Cloud-Native Scalability: The research demonstrates how containerization and cloud-specific resources (GPUs/TPUs) can be used to scale forensic operations dynamically.

4. Results

The system was validated using industry-standard datasets (NSL-KDD, UNSW-NB15, CIC-IDS-2017) and real-world attack simulations (using Kali Linux/Metasploit/sqlmap).

Network Traffic Classification: The Random Forest model achieved impressive accuracies: 90.92% (NSL-KDD), 75.64% (UNSW-NB15), and 99.82% (CIC-IDS-2017).
Web Intrusion Detection: Successfully identified directory traversal attacks in real-time on Azure, with an optimized contamination ratio of 0.01 providing the best balance between sensitivity and false positives.
Malware Analysis: The Random Forest model achieved 96.71% accuracy, while the Keras LSTM model reached 99% accuracy. The system successfully distinguished between benign files (e.g., Minesweeper) and malicious ones (e.g., IRC Bots).

5. Significance

This research bridges the gap between theoretical AI/ML models and practical, real-world cybersecurity deployment. By demonstrating a scalable, containerized, and multi-cloud-compatible framework, the authors provide a blueprint for modernizing Digital Forensics and Incident Response (DFIR). The system's ability to automate feature engineering and provide automated static analysis reports significantly reduces the manual workload for security analysts, ultimately enhancing organizational resilience against evolving cyber threats.