Modern enterprises increasingly rely on multi cloud and hybrid computing environments, which introduce expanded attack surfaces and new security complexities. Traditional security monitoring and incident response struggle to cope with the scale and sophistication of threats across AWS, Azure, and GCP. This paper proposes an AI driven, deep learning based framework for autonomous threat hunting in multi cloud and hybrid architectures. The objective is to proactively identify stealthy tactics such as lateral movement, privilege escalation, and persistence across diverse cloud platforms, using an integrated Security Orchestration, Automation, and Response (SOAR) approach. We develop a unified threat hunting system that ingests cloud telemetry (logs, network flows, identity events) and applies deep learning models (e.g., LSTM neural networks for sequential log analysis and graph neural networks for privilege graph modeling). The system’s design is benchmarked against NIST and ISO/IEC security frameworks to ensure controls compliance. In simulated evaluations, the AI driven SOAR achieved higher detection rates (over 90% for complex attack scenarios) and significantly reduced response times (automated containment in minutes) compared to baseline rule based systems. The framework maintained strong alignment with NIST SP 800-53 and ISO/IEC 27001 controls, demonstrating improved regulatory compliance. The proposed autonomous threat hunting framework enhances enterprise resilience by adaptively detecting advanced threats in multi cloud environments with minimal human intervention. It empowers security teams with rapid, orchestrated responses while adhering to industry security standards. This work has implications for boosting organizational cyber defense maturity, meeting regulatory requirements, and guiding future research in explainable and federated AI security solutions. Keywords: Threat Hunting, Deep Learning, Cloud Security, Multi Cloud, Hybrid Architecture, SOAR, NIST Compliance, ISO Standards.
Paper
Full text
Autonomous threat hunting with AI in multi cloud and hybrid security architectures
Semantic Scholar · 2022
Abstract
Modern enterprises increasingly rely on multi cloud and hybrid computing environments, which introduce expanded attack surfaces and new security complexities. Traditional security monitoring and incident response struggle to cope with the scale and sophistication of threats across AWS, Azure, and GCP. This paper proposes an AI driven, deep learning based framework for autonomous threat hunting in multi cloud and hybrid architectures. The objective is to proactively identify stealthy tactics such as lateral movement, privilege escalation, and persistence across diverse cloud platforms, using an integrated Security Orchestration, Automation, and Response (SOAR) approach. We develop a unified threat hunting system that ingests cloud telemetry (logs, network flows, identity events) and applies deep learning models (e.g., LSTM neural networks for sequential log analysis and graph neural networks for privilege graph modeling). The system’s design is benchmarked against NIST and ISO/IEC security frameworks to ensure controls compliance. In simulated evaluations, the AI driven SOAR achieved higher detection rates (over 90% for complex attack scenarios) and significantly reduced response times (automated containment in minutes) compared to baseline rule based systems. The framework maintained strong alignment with NIST SP 800-53 and ISO/IEC 27001 controls, demonstrating improved regulatory compliance. The proposed autonomous threat hunting framework enhances enterprise resilience by adaptively detecting advanced threats in multi cloud environments with minimal human intervention. It empowers security teams with rapid, orchestrated responses while adhering to industry security standards. This work has implications for boosting organizational cyber defense maturity, meeting regulatory requirements, and guiding future research in explainable and federated AI security solutions. Keywords: Threat Hunting, Deep Learning, Cloud Security, Multi Cloud, Hybrid Architecture, SOAR, NIST Compliance, ISO Standards.