AI-Driven Threat Intelligence Framework for Securing Next-Generation Cloud Networks

Abstract

Next-generation cloud networks require security approaches capable of analysing heterogeneous observations and supporting timely, context-aware threat assessment. This study presents and evaluates an AI-driven threat intelligence framework for securing cloud-native environments by integrating network, identity, application, and infrastructure telemetry with contextual threat information. The framework comprises six interconnected layers: telemetry collection, data processing and correlation, AI-assisted detection, contextual enrichment, threat prioritisation and explanation, and policy-controlled response recommendations. It combines supervised machine learning, behavioural anomaly detection, and rule-based analysis to identify suspicious activities and generate evidence-supported alerts, while retaining human approval for potentially disruptive response actions. The framework was evaluated in an isolated cloud-native testbed using 10,000 labelled observation windows, comprising 8,000 benign and 2,000 malicious observations. Four configurations were compared through detection-performance, component-ablation, workload-adaptation, robustness, and processing-load experiments. The full framework achieved an F1-score of 95%, compared with 80% for the rule-based baseline. At a matched recall of 90%, it reduced the false-positive rate to 1.50%, compared with 4.00% for the comparison configuration. Under changing workloads, the F1-score declined by 4 percentage points for the controlled-update configuration, compared with 11 percentage points for the fixed model. Robustness experiments further examined performance under incomplete and delayed telemetry, feature perturbation, and training-data contamination. Processing performance remained complete up to 2,000 incoming events per second, while throughput decreased to 3,800 events per second at an input rate of 4,000 events per second, with event loss. Analyst-level improvements were not established because participant evaluation results were unavailable. The findings demonstrate promising detection, contextual integration, and workload-adaptation performance within the evaluated environment, while highlighting operational limitations and the need for further validation across broader cloud settings. framework with three components: a cost-effective institutional implementation model, a tiered teacher-training roadmap, and a privacy- and ethics-compliant governance protocol tailored to the Pakistani regulatory context. The expected contribution is twofold. First, the study provides a quantified, tool-specific evidence base on the differential impact of AI on teaching and learning outcomes in a developing-country setting. Second, it offers a practical, context-adapted framework that policymakers and university administrations can use to scale AI integration equitably and sustainably. This work narrows the gap between perception-based advocacy and evidence-driven AI adoption in resource-constrained higher education systems.

REFERENCES

[1] R. Chandramouli and Z. Butcher, “A zero trust architecture model for access control in cloud-native applications in multi-location environments,” NIST Special Publication 800-207A, National Institute of Standards and Technology, Gaithersburg, MD, USA, Sep. 2023, doi: 10.6028/NIST.SP.800-207A.

[2] Z. Maasaoui, M. Merzouki, A. Battou, and A. Labath, “Anomaly based intrusion detection using large language models,” in Proc. 2024 IEEE/ACS 21st Int. Conf. Computer Systems and Applications (AICCSA), Sousse, Tunisia, Oct. 2024, pp. 1–8, doi: 10.1109/AICCSA63423.2024.10912623.

[3] A. Vassilev, A. Oprea, A. Fordyce, H. Anderson, X. Davies, and M. Hamin, “Adversarial machine learning: A taxonomy and terminology of attacks and mitigations,” NIST AI 100-2e2025, National Institute of Standards and Technology, Gaithersburg, MD, USA, Mar. 2025, doi: 10.6028/NIST.AI.100-2e2025.

[4] MITRE Corporation, “MITRE ATT&CK®,” [Online]. Available: https://attack.mitre.org/. [Accessed: Nov. 3, 2026].

[5] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Proc. 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia, 2015, pp. 1–6, doi: 10.1109/MilCIS.2015.7348942.

[6] N. Moustafa and J. Slay, “The evaluation of network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set,” Information Security Journal: A Global Perspective, vol. 25, nos. 1–3, pp. 18–31, 2016, doi: 10.1080/19393555.2015.1125974.

[7] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM Computing Surveys, vol. 41, no. 3, Art. no. 15, pp. 1–58, 2009, doi: 10.1145/1541880.1541882.

[8] J. M. Alonso, A. B. Arrieta, N. Díaz-Rodríguez, J. Del Ser, F. Herrera, and F. Tabik, “Explainable artificial intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI,” Information Fusion, vol. 58, pp. 82–115, 2020, doi: 10.1016/j.inffus.2019.12.012.

[9] B. Strom, A. Applebaum, D. Miller, K. Nickels, A. Pennington, and C. Thomas, “MITRE ATT&CK: Design and philosophy,” MITRE Corporation, Mar. 2020. [Online]. Available: https://www.mitre.org/news-insights/publication/mitre-attack-design-and-philosophy.

[10] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” NIST Special Publication 800-207, National Institute of Standards and Technology, Gaithersburg, MD, USA, Aug. 2020, doi: 10.6028/NIST.SP.800-207.

[11] P. Cichonski, T. Millar, T. Grance, and K. Scarfone, “Computer security incident handling guide,” NIST Special Publication 800-61, Revision 2, National Institute of Standards and Technology, Gaithersburg, MD, USA, Aug. 2012, doi: 10.6028/NIST.SP.800-61r2.

[12] A. Khan, F. Amin, and U. Imtiaz, “SENTINEL-WHEEL: Entropy-compressed edge intelligence for explainable self-healing cyber defense in connected vehicles,” International Journal of Innovative Research, vol. 4, no. 1, pp. 227–237, 2026.

[13] U. Imtiaz and F. Amin, “The strategic role of threat intelligence in combating financially motivated cyber threats in the United States,” Journal of Computational Systems & Engineering Insights, vol. 4, no. 2, pp. 42–61, 2026.

[14] F. Amin, “Adaptive cyber risk management framework for critical infrastructures: Integrating IDS, SOC, and CSIRT for resilient threat mitigation,” in Data Science and Security (IDSCS 2025), S. Shukla, H. Sayama, K. Tiwari, J. P. George, and J. V. Kureethara, Eds., Lecture Notes in Networks and Systems, vol. 1945. Cham, Switzerland: Springer, 2026, doi: 10.1007/978-3-032-24075-0_20.

[15] F. Amin, “Binary flaw detection: A security analysis paper,” in Proc. 2025 International Conference on Advances in Machine Intelligence and Cybersecurity Technologies (AMICT), Kota Kinabalu, Sabah, Malaysia, 2025, pp. 325–330, doi: 10.1109/AMICT65811.2025.11402666.

[16] J. Jabed, M. P. Ahmed, F. M. Tofa, M. F. Islam, C. A. Gomes, and R. M. Sirazy, “Federated intrusion detection for Internet of Medical Things networks: Differential privacy, non-IID robustness, and cross-device generalization,” Journal of Computer Science and Technology Studies, vol. 8, no. 8, pp. 303–315, 2026.

[17] P. S. Ponduru, P. P. V. Nandanavanam, and S. K. K. Ponduru, “SAFE-HealCloud: Safety-aware, agentic self-healing for cloud infrastructure,” International Journal of Scientific Research in Computer Science, Engineering and Information Technology, vol. 12, no. 4, pp. 163–188, 2026.

[18] M. D. Rasheed, W. Khan, M. Imran, N. Ahmad, Y. Khan, M. Akram, and M. Sultana, “Leveraging artificial intelligence for advance data networking and cybersecurity,” Spectrum of Engineering Sciences, vol. 4, no. 3, pp. 286–298, 2026.

[19] M. Akram, W. Khan, M. D. Rasheed, M. Imran, M. W. Iqbal, A. Delshadi, and M. Sultana, “Cybersecurity risk assessment model for Internet of Medical Things (IoMT) devices in healthcare systems,” Spectrum of Engineering Sciences, vol. 4, no. 3, pp. 312–326, 2026.

[20] M. A. Rahman, R. K. Devnath, S. B. Niloy, C. M. Mehedi, T. H. Chowdhury, and M. I. K. Jabed, “A stacking ensemble framework for predicting employee turnover: Explainable AI with SHAP,” in Proc. 2025 IEEE 2nd Int. Conf. Computing, Applications and Systems (COMPAS), Oct. 2025, pp. 1–6.

[21] M. A. Rahman, M. I. K. Jabed, R. K. Devnath, C. M. Mehedi, M. Begum, and T. Mahmud, “MSRFF: An interpretable CNN-Vision Transformer framework for diabetic retinopathy detection,” in Proc. 2026 2nd International Conference on Computational Intelligence Approaches and Applications (ICCIA), 2026, pp. 1–7.

[22] M. I. K. Jabed, M. Imran, C. A. Gomes, P. S. Ponduru, S. Mandal, and S. Hassan, “Deep learning and explainable AI framework for predicting lung cancer severity,” Journal of Computer Science and Technology Studies, vol. 7, no. 12, pp. 573–598, 2025.

[23] M. I. K. Jabed, M. A. Manzoor, F. M. Tofa, and M. H. Khan, “Interpretable ensemble learning approach for breast cancer diagnosis using SHAP-based explainable AI,” Journal of Computer Science and Technology Studies, vol. 8, no. 8, pp. 244–255, 2026.

[24] M. I. K. Jabed, M. Imran, C. A. Gomes, and P. S. Ponduru, “Machine learning-based prediction of poor self-rated health among U.S. adults using behavioral and socioeconomic factors,” World Journal of Advanced Research and Reviews, vol. 27, no. 1, pp. 2817–2829, 2025, doi: 10.30574/wjarr.2025.27.1.2649.

[25] P. S. Ponduru, “Decision intelligence for AI and emerging technologies: The AEGIS-DM framework for trustworthy, cost-aware, and low-latency decision making,” 2024.