Anomaly Detection in User Behaviour Using Machine Learning For Cloud Platforms

Abstract

In the era of rapid digital transformation, cloud platforms have become the backbone of modern computing infrastructure, offering scalability, flexibil- ity, and cost-efficiency. However, their widespread adoption has also made them prime targets for sophisticated cyber threats, especially those involv- ing anomalous user behavior. Detecting anomalies in user activities is critical for identifying potential insider threats, account takeovers, privilege misuse, and other malicious actions that may evade traditional rule-based security systems. This research paper explores the implementation of machine learn- ing techniques for real-time anomaly detection in user behavior across cloud platforms, providing a proactive approach to cloud security. The study emphasizes the limitations of static rule-based systems and tra- ditional SIEM (Security Information and Event Management) tools, which often fail to adapt to evolving behavioral patterns and generate high false- positive rates. By leveraging supervised, unsupervised, and semi-supervised machine learning models, we propose an intelligent system capable of learn- ing normal usage patterns and identifying deviations indicative of threats. Key algorithms such as Isolation Forest, One-Class SVM, Autoencoders, and clustering techniques like DBSCAN and K-Means are examined for their ef- fectiveness in identifying anomalies in large-scale, multidimensional datasets generated by user activity logs, API calls, access records, and system meta- data. Our methodology involves the preprocessing of cloud log data, feature engineering for behavior profiling, and training models on both labeled and unlabeled data. The study also incorporates techniques for dimensionality re- duction (e.g., PCA, t-SNE) and explains model interpretability using SHAP and LIME to foster trust among cybersecurity teams. Performance metrics such as precision, recall, F1-score, and ROC-AUC are used to evaluate de- tection capabilities, with a focus on reducing false alarms while maintaining high detection accuracy. Additionally, the paper addresses the challenges of real-time deployment, scalability, data privacy, and the integration of anomaly detection modules with existing cloud security architectures like SIEM, SOAR, and CASB. A case study simulating behavioral anomalies on a public cloud environment (e.g., Microsoft Azure or AWS) demonstrates the practical applicability of the proposed solution. By integrating intelligent, adaptive anomaly detection systems, organiza- tions can significantly enhance their cloud security posture, respond proac- tively to emerging threats, and reduce dwell time of malicious actors. This research contributes to the evolving field of AI-driven cybersecurity and lays the foundation for future advancements in autonomous threat detection for dynamic cloud ecosystems.