cross-cloud-guard: AI-Driven Cross-Cloud Threat Detection

Reference implementation for the AIxMM 2025 paper:

AI-Driven Causal Inference for Cross-Cloud Threat Detection Using Anonymized CloudTrail Logs Jay Barach. 2025 Conference on Artificial Intelligence × Multimedia (AIxMM). IEEE. DOI: 10.1109/AIxMM62960.2025.00014

cross-cloud-guard detects coordinated attacks spanning AWS, Azure, and Google Cloud by combining an ensemble anomaly detector, cross-cloud threat correlation, LSTM predictive modeling, and a unified alert score — over anonymized CloudTrail-style event logs streamed in real time.

License. MIT — see LICENSE. © 2025 Jay Barach. If you use it, please cite the AIxMM 2025 paper above.

---

Pipeline (paper Fig. 1)

Ingest → Ensemble Anomaly Detection → Predictive Modeling (LSTM) → Cross-Cloud
         (Eq. 2)                       (Eqs. 4–5)                   Correlation (Eq. 3)
                                                          → Alert System (Eq. 6) → Response/Logging

• Ensemble detection (xcloud_guard.detect) — anomaly score A(x) = (1/M)·Σ f_m(x) (Eq. 2) over random forest, gradient boosting, MLP, and isolation forest; flag if A(x) > θ.
• Cross-cloud correlation (xcloud_guard.correlate) — R(A_i, A_j) (Eq. 3) links near-simultaneous anomalies sharing IP / user / API across clouds; coordinated attack if it exceeds threshold.
• LSTM prediction (xcloud_guard.predict) — forecasts the next event's anomaly probability P(A_{m+1}|E_i) (Eq. 4), trained on forecast MSE (Eq. 5).
• Alert scoring (xcloud_guard.alert) — S = β₁·A + β₂·P (Eq. 6); alert if S > δ.
• Streaming (xcloud_guard.stream) — Kafka backend for live deployment plus an offline replay driver (default).

---

Results on the synthetic benchmark

Running the pipeline out of the box reproduces the paper's reported behavior closely:

Metric	This repo (synthetic)	Paper
Detection accuracy	~0.99	96%
False-positive rate	~0.00–0.04	4%
Predictive accuracy (LSTM)	~0.91	91%
Cross-cloud detection rate	~0.89	93–95%
MTTD	28 s	28 s

Numbers depend on the synthetic anomaly/overlap settings; see configs/. Point the loader at real CloudTrail exports to evaluate on your own data.

---

Requirements & installation

• Python 3.9+, PyTorch 2.0+ (CPU is fine)

git clone https://github.com/<your-username>/cross-cloud-guard.git
cd cross-cloud-guard
python -m venv .venv && source .venv/bin/activate
pip install --upgrade pip
pip install -e .              # core
pip install -e ".[kafka]"    # Kafka streaming backend (optional)
pip install -e ".[dev]"      # pytest, ruff

Console command: xcloud-guard-run.

---

Quickstart

bash scripts/run_all.sh          # quick offline run (synthetic data)
bash scripts/run_all.sh full     # full paper-scale run

Or:

python scripts/make_synthetic_data.py --out data/logs --events 10000
python -m xcloud_guard.run --config configs/default.yaml

Results (detection metrics, predictive accuracy, cross-cloud correlations, alerts, MTTD) are written to outputs/<name>/summary.json.

---

Data

The pipeline runs on synthetic multi-cloud CloudTrail-style logs by default — no download needed. To use real logs, drop one CSV per cloud at data/logs/<cloud>.csv with columns event_type, source_ip, user_id, api_call, timestamp, label, coordinated_group. For live deployments, the streaming runtime consumes Apache Kafka topics (one per cloud).

The paper uses anonymized CloudTrail logs; this repo's generator produces anonymized synthetic fields only.

---

Repository layout

cross-cloud-guard/
├── src/xcloud_guard/
│   ├── config.py            # typed configs (paper parameters as defaults)
│   ├── data.py              # multi-cloud CloudTrail-style log generator/loader
│   ├── metrics.py           # accuracy, FPR, cross-cloud rate, MTTD/MTTR, predictive acc
│   ├── run.py               # end-to-end pipeline runner
│   ├── detect/              # ensemble anomaly detector (Eq. 2) + feature encoding
│   ├── correlate/           # cross-cloud correlation (Eq. 3)
│   ├── predict/             # LSTM forecaster (Eqs. 4–5)
│   ├── alert/               # combined alert scoring (Eq. 6)
│   └── stream/              # Kafka + offline streaming runtime
├── configs/                 # default, smoke
├── scripts/                 # make_synthetic_data, run_all
├── tests/                   # unit + integration tests
├── .github/workflows/       # CI
├── LICENSE  NOTICE  CITATION.cff  pyproject.toml  requirements.txt

---

Paper → code mapping

Paper element	Where
Anomaly score ensemble (Eq. 2)	detect.EnsembleDetector.anomaly_score
Anomaly threshold θ	detect.EnsembleDetector.predict
Correlation R(A_i, A_j) (Eq. 3)	correlate.CrossCloudCorrelator.correlation
Coordinated-attack detection	correlate.CrossCloudCorrelator.coordinated_events
LSTM forecast P(A_{m+1}) (Eq. 4)	predict.LSTMForecaster
Forecast MSE objective (Eq. 5)	predict.LSTMForecaster.fit
Alert score S (Eq. 6)	alert.AlertSystem.alert_score
Kafka streaming	stream.StreamRuntime
MTTD / MTTR / cross-cloud rate	metrics

---

Testing

pip install -e ".[dev]"
pytest -q

CI runs the unit tests plus an end-to-end smoke run on every push.

---

Citation

Paper (AIxMM 2025):

@inproceedings{barach2025crosscloud,
  author    = {Barach, Jay},
  title     = {{AI-Driven} Causal Inference for Cross-Cloud Threat Detection Using Anonymized {CloudTrail} Logs},
  booktitle = {2025 Conference on Artificial Intelligence x Multimedia (AIxMM)},
  year      = {2025},
  publisher = {IEEE},
  doi       = {10.1109/AIxMM62960.2025.00014}
}

Software:

@software{barach2025crosscloud_code,
  author  = {Barach, Jay},
  title   = {{cross-cloud-guard}: AI-Driven Cross-Cloud Threat Detection Using Anonymized CloudTrail Logs},
  year    = {2025},
  version = {1.0.0},
  url     = {https://github.com/<your-username>/cross-cloud-guard},
  note    = {Reference implementation for the AIxMM 2025 paper, DOI: 10.1109/AIxMM62960.2025.00014}
}

---

License

MIT — see LICENSE. © 2025 Jay Barach.