Cloud-Native AI Frameworks for Proactive Cybersecurity Threat Detection

Abstract

Overreliance on signature-based sensor data, automation, and information sharing often enables threat actors to perpetrate cyberattacks such as ransomware, cryptojacking, and other undetected activities for months. Even without prior knowledge of an attack, security teams have the opportunity to locate advanced persistent threats that have already evaded existing security controls. Organizations must thus embrace threat hunting—proactively seeking active adversaries in their environments using tailored detection capabilities. Information technology teams operating in public cloud environments can now empower hunting by observing attack paths, developing detection capabilities in a serverless, on-demand, and cost-effective manner, and storing massive amounts of data in a cloud-native architecture.

Threat hunting is defined as the hypothesis-driven exploration of an enterprise's environ­ ment to detect and isolate undiscovered malicious activity. The process relies on advanced knowledge of attackers and their techniques to create detection-focused intelligence that is then fed back into observability solutions. Conducting efficacious threat hunting involves defining clear objectives; selecting appropriate data sources, collection pipelines, and storage solutions; and developing detection capabilities that specifically target areas of interest. Despite the widespread adoption of threat hunting in traditional enterprise networks, cloud operating models introduce significant new characteristics and considerations that warrant development of a corresponding enterprise cloud threat-hunting framework.