Securing Cloud-Native Microservices Using AI-Driven Threat Detection Models

The increasing migration of enterprise operations to Amazon Web Services (AWS) has amplified the need for robust, scalable, and intelligent cybersecurity solutions. Security Information and Event Management (SIEM) systems have become vital for detecting threats, correlating logs, and maintaining compliance in cloud environments. This systematic review explores the integration of SIEM tools within AWS-based infrastructures, focusing on their effectiveness in threat detection and log correlation. It examines leading SIEM solutions such as Splunk, IBM QRadar, Sumo Logic, and AWS-native services like Amazon GuardDuty, AWS CloudTrail, and AWS Security Hub. Emphasis is placed on key integration approaches, including API-based ingestion, agentless data capture, and real-time event streaming through AWS services like Kinesis and S3. The review critically analyzes studies published between 2018 and 2023, highlighting trends in the automation of log management, enrichment of security alerts through machine learning, and orchestration via Security Orchestration, Automation, and Response (SOAR) platforms. Challenges such as data normalization, scalability limitations, cross-service visibility, and compliance adherence in multi-account AWS architectures are discussed. The findings indicate that SIEM integration enhances threat detection efficiency by enabling proactive anomaly detection, facilitating rapid incident response, and improving forensic investigation capabilities. However, the review identifies gaps, particularly in cost optimization, handling high-velocity log streams, and adapting traditional SIEM models to dynamic, serverless AWS architectures. Best practices for successful SIEM deployment include leveraging AWS-native integrations, prioritizing event prioritization algorithms, applying continuous tuning, and aligning with security frameworks like NIST and CIS AWS Foundations Benchmark. Future research directions propose the development of AI-driven adaptive SIEM systems tailored for cloud-native environments, advanced correlation engines for serverless and containerized workloads, and strategies to optimize licensing and resource utilization. This systematic review provides cybersecurity practitioners, cloud architects, and researchers with a comprehensive understanding of SIEM integration complexities and evolving practices in AWS infrastructures, ultimately contributing to improved cloud security postures and operational resilience in the face of sophisticated cyber threats.

Risk management is one of the fundamental pillars of IT program management, particularly as organizations navigate the increasingly complex digital landscape of the 21st century. With the growing reliance on digital infrastructures, data, and interconnected systems, the challenges associated with cybersecurity, artificial intelligence (AI) integration, and infrastructure stability are becoming more pronounced. These three components—cybersecurity, AI, and infrastructure stability—are intricately linked, and their balance is essential for ensuring the long-term viability, resilience, and security of an organization’s IT systems. As organizations adopt new technologies and expand their digital footprints, IT managers face the critical task of balancing these elements in order to build robust, future-proof IT programs. The role of cybersecurity in IT program management has evolved significantly over the past few decades. Historically, cybersecurity was often relegated to being a peripheral concern, managed in isolation by dedicated security teams. Traditional approaches primarily focused on perimeter defenses, such as firewalls, intrusion detection systems (IDS), and antivirus software, to keep cyber threats at bay. While these methods provided some degree of protection, they were largely reactive and could only address known threats. As cyber adversaries have become more sophisticated, cyber threats have transcended basic attacks and evolved into more complex and persistent tactics, such as advanced persistent threats (APTs), zero-day exploits, and ransomware attacks. These evolving threats have highlighted the limitations of traditional cybersecurity measures and underscored the need for more proactive, dynamic security solutions. As cyber threats continue to evolve, organizations are increasingly turning to artificial intelligence (AI) to enhance their cybersecurity capabilities. AI, particularly in the form of machine learning (ML) and deep learning (DL), is enabling IT teams to move from traditional, rule-based security systems to more adaptive and intelligent systems that can detect anomalies, predict vulnerabilities, and respond to incidents in real-time. AI-driven cybersecurity solutions offer a range of capabilities, such as threat detection, incident response, and automated remediation, all of which can significantly reduce the time it takes to detect and mitigate security breaches. AI-powered systems can analyze vast amounts of data, identify patterns and anomalies, and learn from past incidents to improve detection accuracy over time. This enables organizations to identify and respond to threats much more quickly and effectively than traditional systems that rely on predefined rules or signatures. The integration of AI into IT program management offers numerous benefits, including improved efficiency, scalability, and accuracy in detecting and responding to cyber threats. However, the implementation of AI also presents new challenges. For one, AI technologies themselves are not immune to vulnerabilities. Adversarial attacks, where malicious actors manipulate AI systems by feeding them false data or exploiting weaknesses in their models, represent a significant risk. AI models can also be vulnerable to bias if not properly trained on diverse, representative datasets. Additionally, AI-driven systems require large amounts of data to function effectively, raising concerns about data privacy and security. Organizations must carefully consider how to manage and protect the vast amounts of sensitive data needed to train AI models, while also ensuring compliance with data protection regulations, such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

The increasing sophistication and frequency of cyberattacks necessitate advanced and transparent decision-making frameworks for threat intelligence and risk assessment. While artificial intelligence (AI) has demonstrated significant potential in automating threat detection, predicting attack patterns, and prioritizing incident response, the opaque nature of many AI models particularly deep learning poses challenges in trust, interpretability, and regulatory compliance. This paper presents an Explainable AI (XAI)-driven framework for enhancing Cyber Threat Intelligence (CTI) and risk assessment, enabling security analysts to understand, validate, and act upon AI-generated insights with confidence. The proposed approach integrates state-of-the-art machine learning algorithms with model-agnostic and model-specific interpretability techniques, such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), Layer-wise Relevance Propagation (LRP), and attention-based visualization. The framework processes diverse CTI data sources including network traffic logs, vulnerability feeds, malware signatures, and open-source intelligence (OSINT) to identify malicious patterns, quantify risks, and generate actionable intelligence. By coupling predictive accuracy with transparency, the system not only improves detection and classification of advanced persistent threats (APTs), phishing campaigns, and zero-day exploits, but also facilitates compliance with emerging AI governance frameworks, such as the EU AI Act and NIST AI Risk Management Framework. Experimental evaluations on benchmark cybersecurity datasets demonstrate that the XAI-enabled models maintain high precision and recall while offering interpretable outputs that significantly reduce analyst decision latency and improve collaborative threat response. The paper further discusses the role of XAI in mitigating bias, enhancing accountability, and fostering human–machine teaming in security operations centers (SOCs). Practical implementation considerations including scalability, computational efficiency, and integration with existing Security Information and Event Management (SIEM) platforms are addressed, along with recommendations for future research in multi-modal XAI for cybersecurity. This research underscores the critical value of explainability in AI-driven CTI, ensuring that automated systems are not only effective but also transparent, trustworthy, and aligned with organizational and regulatory requirements for responsible AI deployment in cyber defense.

The fast-changing digital environment, increasingly targeted by cyber-attacks, demands a dynamic approach to safeguarding organizational assets and providing effective IT service desk support. In this paper, it is stated that the application of Artificial Intelligence (AI), Security Information and Event Management (SIEM) tools, Multi Factor Authentication (MFA) and incident response plans can be interlinked to assist in enhancing cybersecurity, along with the IT service desk efficiency. We examine the application of AI: to automate threat detection and response through automation of SIEM in the form of AI-driven SIEM automation, to attack real-time Security Monitoring with SIEM tools and as one of the key dimensions of ensuring the enhancement of the access control via Multi-Factor Authentication (MFA). In addition, the paper also explains the role that a joint incident response mechanism has in alleviating the effects of breaches and enhancing the organizational resilience of large organizations. Implementing these technologies will allow institutions to achieve more precise detection and faster response times, and less overhead, which will eventually lead to more investment in cybersecurity and IT support systems. The paper also provides a case study and implementation issues to provide a full picture of the practical implications of the integrated solutions.

In this era of ubiquitous and highly developed cyber dangers, cybersecurity has emerged as an essential issue for modern organisations. Interest in using AI to improve cyber threat detection and response skills is on the rise as conventional approaches fall behind the dynamic threat environment. Recent advancements, problems, and future prospects are highlighted in this review paper's thorough overview of cyber threat detection and response systems augmented with AI. At the outset, we cover the basics of artificial intelligence (AI) in cybersecurity and trace the development of systems to identify cyber threats. We continue by outlining the benefits and drawbacks of supervised, unsupervised, and reinforcement learning, three of the AI-driven threat detection methods now available. Here, we show how AI-powered systems may effectively mitigate cyber risks in many sectors using real-world applications and case studies. Data quality, adversarial assaults, and ethical issues are just a few of the constraints and problems that we highlight and provide solutions for. Lastly, we go into the latest developments and potential paths forward in AI-powered cybersecurity, highlighting the need of working together across disciplines and continuously doing research to keep up with ever-changing threats. Researchers, practitioners, and policymakers may use this paper as a guide to better understand AI in cybersecurity, where it is now, and how to make future breakthroughs.

Within today’s organizations, a Security Information and Event Management (SIEM) system is the centralized repository expected to aggregate all security-relevant data. While the primary purpose of SIEM solutions has been regulatory compliance, more and more organizations recognize the value of these systems for threat detection due to their holistic view of the entire enterprise. Today’s mature Security Operation Centers dedicate several teams to threat hunting, pattern/correlation rule creation, and alert monitoring. However, traditional SIEM systems lack the capability for advanced analytics as they were designed for different purposes using technologies that are now more than a decade old. In this paper, we discuss the requirements for a next-generation SIEM system that emphasizes analytical capabilities to allow advanced data science and engineering. Next, we propose a reference architecture that can be used to design such systems. We describe our experience in implementing a next-gen SIEM with advanced analytical capabilities, both in academia and industry. Lastly, we illustrate the importance of advanced analytics within today’s SIEM with a simple yet complex use case of beaconing detection.

An integrated approach to automated cyber threat response is explored in this paper, with Microsoft Sentinel's Security Information and Event Management (SIEM) capabilities being leveraged alongside Logic Apps' workflow automation within the Azure ecosystem. Efficient identification and automated mitigation of security incidents are enabled by a combination of AI-driven analytics and advanced threat-hunting capabilities, resulting in a substantial reduction of manual intervention and response times. The approach is demonstrated to contribute scientifically across three core areas: (1) a novel integration of Sentinel's SIEM with Logic Apps is proposed to streamline response workflows using automated playbooks; (2) the effectiveness of the system is assessed through multiple cyber threat scenarios, including automated account blocking and virtual machine isolation in response to identified threats; and (3) Sentinel's performance is evaluated relative to other SIEM solutions, such as Splunk and IBM QRadar, particularly in Azure-centric and hybrid environments. The potential of Microsoft Sentinel and Logic Apps to advance proactive cybersecurity defenses is underscored, while key limitations in scalability and cross-platform adaptability are also identified.

Abstract: Due to the increased complexity and damage of cyberattacks in this digital age, the security of national infrastructure networks has become a vital concern. However, a possible approach to improve the cybersecurity of these crucial networks is to incorporate artificial intelligence (AI) into threat detection and response systems; to rapidly evaluate large data sets, identify anomalies, and automate countermeasures to lessen the effects of cyberattacks. The impact, implementation and approaches for anomaly detection and response automation of AI-powered solutions for safeguarding national infrastructure are examined in this paper. Understanding how AI technologies are used to automate threat detection and response, reviewing the operational usefulness of AI in enhancing cybersecurity measures and evaluating the deployment of these systems in critical infrastructure settings were also examined. The study revealed that the speed and accuracy of threat detection and response are greatly increased by AI-powered systems. The automation capacity of AI can potentially reduce the need for human analysts, while also providing faster threat mitigation. Additionally, the usefulness of AI across sectors indicates its practicality in situations and how it may adapt in response to new threats. In conclusion, AI-driven threat detection and response systems are an important development in national infrastructure network cybersecurity. Therefore, by improving the capacity to recognize and address cyber-attacks these technologies can ultimately increase the overall resilience of national infrastructures.

The increasing complexity and sophistication of cyber threats underscore the critical need for advanced threat detection mechanisms within Security Operations Centers (SOCs) to effectively mitigate risks and enhance cybersecurity resilience. This study enhances the capabilities of Wazuh, an open-source Security Information and Event Management (SIEM) system, by addressing its primary limitation: high false-positive rates in rule-based detection. We propose a hybrid approach that integrates machine learning (ML) techniques—specifically, Random Forest (RF) and DBSCAN—into Wazuh’s detection pipeline to improve both accuracy and operational efficiency. Experimental results show that RF achieves 97.2% accuracy, while DBSCAN yields 91.06% accuracy with a false-positive rate of 0.0821, significantly improving alert quality. Real-time deployment requirements are rigorously evaluated, with all models maintaining end-to-end processing latencies below 100 milliseconds and 95% of events processed within 500 milliseconds. Scalability testing confirms linear performance up to 500 events per second, with an average processing latency of 45 milliseconds under typical SOC workloads. This integration demonstrates a practical, resource-efficient solution for enhancing real-time threat detection in modern cybersecurity environments.

Ever enhancing computational capability of digital system along with upgraded tactics, technology and procedure (TTPs) enforced by the cybercriminals, does not match to the conventional security mechanism for detection of intrusion and prevention of threat in current cyber security landscape. Integration of artificial intelligence, machine learning and cyber threat intelligence platform with the signature-based threat detection models like intrusion detection system (IDS), SNORT, security information and event management (SIEM) which are being primarily implemented in the network for continuous analysis of the indicator of compromise (IoC) becomes inevitable, for prompt identification of true events and subsequent mitigation of the threat. In this paper, author illustrated the approach to integrate artificial intelligence and machine learning with the cyber threat intelligence for the collection of actionable threat intelligence from various sources like dark web, hacker’s forum, hacker’s assets, honeypot, etc. Furthermore, the application of threat intelligence in the aspect of cyber security has been discussed in this paper. Finally, a model has been proposed for generating actionable threat intelligence implementing a supervised machine learning approach employing Naive Bayes classifier.

In recent years, there has been a noticeable trend toward targeted threats to information security, where companies are now leveraging vulnerabilities and risks associated with widely used services in order to generate financial gain. Additionally, they implement numerous precautions and consistently carry out their tasks. One item that requires precautionary measures is the network devices utilized. Network devices in computer networks possess the capability to log events. These logs enable the identification of security events on the network and facilitate the implementation of precautionary measures. Various security measures can be implemented to handle such data. One of these measures is Security Information and Event Management (SIEM). It is a system that gathers and analyzes data from networks and security devices. SIEM is a technique employed to consolidate critical information within a cohesive structure. It allows for the correlation of events from different security devices, thereby improving the monitoring capabilities of cybersecurity operations centers. This study extensively covers the critical infrastructure-SIEM relationship, current studies, critical infrastructure, cyber security policies, and SIEM. Our system design was developed using the UNSW\_NB15 dataset, a widely recognized dataset in cybersecurity due to its comprehensive and realistic representation of cyber threats. This dataset consists of data obtained from network traffic, various attack activities, and real-life modern normal scenarios, making it particularly relevant to our study. With the studies, a total of 10 different categories were analyzed, with the category consisting of nine types of attacks, namely Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms and Normal activities. The study is divided into two as the basic structure. The first step was carried out on Google Collaboratory, and then some experimental studies were carried out in Weka. Classifications were made using several methods, including Logistic Regression (LR), Extra Trees (XT), Support Vector Machines (SVM), Random Forest (RF), and Decision Trees (DT). These methods were chosen for their proven effectiveness in similar studies. In the application developed with Google Colabratory, we achieved 98.62\% in Random Forest, 99.10\% in Decision Trees, 98.87\% in Logistic Regression, 95.13\% success in Extra Trees and 99.12\% success in Support Vector Machines. As a result of the studies and experiments carried out in Weka, we achieved 92.05\% in Random Forest, 100\% in Decision Trees, 100\% in k-Nearest Neighbours, 100\% in J48, 99.19\% in Naive-Bayes and 99.35\% in BayesNet achievements.

The rise of connected devices over the internet has led to an increase in attacks on users, compromising their information exchange and revealing sensitive data. Modern cyber threats are becoming increasingly sophisticated and severe, taking advantage of security vulnerabilities in interconnected systems. With the growing complexity of cyber threats, effective threat detection systems are essential for maintaining network security. To improve the detection of various attack types and provide real- time warnings via Telegram, this project focuses on integrating Wazuh which is a security information and event management (SIEM) platform, with Suricata, a powerful network intrusion detection and prevention system (IDS/IPS). By offering a complete solution for log management and multi-attack detection, the integration seeks to strengthen an organization's entire security posture. From system analysis and design to implementation and testing, the process adheres to the Software Development Life Cycle (SDLC). To evaluate the effectiveness of the integrated system, several attack simulations were carried out, including DoS attacks (ICMP Ping and SYN flood), FTP brute-force attacks, and port-scanning activities. The system successfully detected all these attacks. This study highlights the strengths and limitations of integrating Wazuh with Suricata, providing valuable insights for future research aimed at developing more robust intrusion detection systems.

Index

In the digital age, cyber threats have become increasingly sophisticated, necessitating innovative approaches to bolster security measures. Artificial Intelligence (AI) has emerged as a formidable tool in the realm of cyber security, offering advanced capabilities in threat detection, anomaly detection, and response automation. This article provides an overview of AI applications in cyber security, highlighting its role in mitigating risks and fortifying defense mechanisms. AI techniques such as machine learning, deep learning, and natural language processing empower security systems to analyze vast amounts of data in real-time, identifying patterns indicative of malicious activities. Through the utilization of AI-driven algorithms, cyber security platforms can proactively detect and neutralize cyber threats before they inflict substantial damage. Moreover, AI enables the automation of incident response processes, reducing response times and minimizing the impact of security breaches. Case studies from leading cyber security firms from the integral part of the studies and demonstrate the practical implementation of AI-driven solutions in safeguarding critical infrastructures against cyber threats. Resilience towards cyber-attacks and safeguarding sensitive data assets through leveraging AI technologies has been focused in the study.

Application Programming Interfaces (APIs) have emerged as critical infrastructure components in modern digital services, yet traditional Web Application Firewalls (WAFs) prove inadequate against sophisticated attacks targeting business logic flaws and access control vulnerabilities. Behavioral threat detection platforms address these gaps by establishing baseline patterns of legitimate API usage and identifying deviations that signal potential threats such as credential stuffing, data scraping, and unauthorized data exfiltration. These systems leverage machine learning algorithms to analyze API traffic in real-time, generating contextual alerts that distinguish between benign anomalies and genuine security incidents. Advanced capabilities include automated discovery of undocumented or shadow APIs, classification of sensitive data flows, and implementation of tokenization strategies to protect information in transit. Integration with Security Information and Event Management (SIEM) systems enables orchestrated incident response, while continuous posture assessment ensures ongoing compliance with security policies. This comprehensive framework transforms API security from reactive rule-based filtering to proactive behavioral monitoring, significantly reducing the attack surface and enabling organizations to detect and respond to threats that would otherwise bypass conventional security controls.