RISK CRITERIA AND ML ALGORITHMS FOR THREAT DETECTION IN A CLOUD ENVIRONMENT

Abstract

This paper proposes and experimentally validates an ML-oriented pipeline for detecting hazardous events in the API/HTTP traffic of cloud services. The approach combines two numerical channels: (i) a supervised channel based on structured event features for stable separation between benign events and attacks, and (ii) an auxiliary atypical-behavior channel that strengthens the response to rare or novel scenarios that are weakly represented in labeled data. The key methodological idea is to unify heterogeneous model outputs into a common probabilistic risk scale via calibration, temperature scaling, and prior attack-rate adjustment, which enables comparable scores across models of different nature. To achieve controlled management of false-positive activations, the decision threshold is selected under an FPR budget, while group-level score stability is improved through ensembling, including averaging in the additive log-odds domain. After combining channel signals, the final decision is stabilized with operational policies (including hysteresis) to avoid frequent state switching in streaming mode. Model quality is verified both with tabular metrics and visually by analyzing risk-score distributions for benign events and attacks, which helps interpret overlap regions and the impact of the threshold on false alerts. Experiments on a test set show high performance of the supervised channel: for the primary ML ensemble, ROC-AUC = 0.9843, PR-AUC = 0.9511, and F1 = 0.8400 are achieved at an FPR of approximately 0.051, whereas the baseline linear model yields substantially lower F1 values. The auxiliary atypical-behavior channel provides a practically useful signal that complements the supervised channel while maintaining a controlled false-alert rate. The proposed formulation scales to other API types and load profiles because it separates policies (thresholds, weights, calibration parameters) from the main event-processing flow. The results confirm the suitability of the approach for integration into cloud monitoring and incident-response infrastructure with controllable threshold policies and model updates.