AI-Driven Intelligent Threat Detection Frameworks Using Large Language Models for Hybrid Cloud Security Operations

Abstract

Hybrid cloud environments combine private infrastructure, public cloud platforms, edge resources, and third-party services, creating complex security ecosystems with diverse attack surfaces, heterogeneous telemetry, and rapidly changing configurations. Traditional security operations increasingly struggle to correlate high-volume logs, alerts, network events, identity signals, and contextual threat intelligence across these distributed environments. Large Language Models (LLMs) offer a promising capability for augmenting security operations by interpreting heterogeneous security data, supporting natural-language investigation, correlating multi-stage attack indicators, and assisting analysts in incident triage and response. This study examines an AI-driven intelligent threat detection framework that integrates LLMs with conventional security controls, Security Information and Event Management (SIEM), Extended Detection and Response (XDR), cloud-native monitoring, threat intelligence, and automated response mechanisms. The proposed framework emphasizes contextual reasoning, multimodal security evidence, human oversight, privacy protection, prompt-security controls, and continuous evaluation. The research methodology adopts a design-oriented approach combining systematic literature analysis, framework development, experimental evaluation, and comparative assessment against conventional detection approaches. Key evaluation dimensions include detection accuracy, precision, recall, false-positive rate, response latency, contextual correlation, scalability, and computational cost. The framework is intended to improve the analytical capabilities of hybrid cloud Security Operations Centers while maintaining explainability and operational safeguards. The study contributes a structured architecture and evaluation methodology for deploying LLM-assisted threat detection in security-critical hybrid cloud environments.