Advancing Cloud-Native Cyber Threat Detection with Graph-Based Feature Engineering

In light of the unprecedented proliferation of cloud-native applications, cyber threats targeting cloud services have escalated markedly, emerging as a critical concern for stakeholders. The intrinsic nature of cloud infrastructures renders them particularly susceptible to diverse attacks. In this context, effective attack identification becomes pivotal, facilitating swift responses and preventive measures to mitigate risks and bolster overall security resilience. Despite a range of solutions in literature, attack classification remains an arduous task in industrial environments. To address this, we propose a comprehensive and deployment-friendly graph-based framework. It leverages cloud activity traces, transforming system events to graph structures, and we enumerate 4 different types of attack within a controlled environment. We frame a multi-classification problem, and construct multi-level features to characterize distinct attacks amidst background activities, bypassing the complexity of Deep Learning (DL). To evaluate the efficacy, we compare with multiple Graph Neural Networks (GNNs), and our solution yields comparable performance, demonstrating a promising candidate for the practical and efficient cyber threat detection.