Proactive Cyber Threat Detection in Cloud-Native Environments Using Graph Neural Networks and Behavioral Intelligence
DOI:
https://doi.org/10.21590/Keywords:
Cloud-native security, cyber threat detection, Graph Neural Networks, behavioral intelligence, anomaly detection, Kubernetes security, microservices, threat intelligence, lateral movement, machine learning.Abstract
The rapid adoption of cloud-native technologies, including microservices, containers, Kubernetes orchestration, and serverless computing, has significantly expanded the cyber threat landscape. Traditional security mechanisms often struggle to detect sophisticated attacks that exploit dynamic service relationships, identity privileges, and abnormal behavioral patterns across distributed cloud infrastructures. This study proposes a proactive cyber threat detection framework that integrates Graph Neural Networks (GNNs) with behavioral intelligence to identify suspicious activities and potential attack pathways in cloud-native environments. The framework represents cloud resources, users, containers, workloads, network connections, and access permissions as interconnected graph entities. GNN-based learning analyzes structural relationships and contextual dependencies, while behavioral intelligence establishes normal activity profiles and identifies deviations in authentication, resource utilization, network communication, and service interactions. The proposed methodology combines telemetry collection, graph construction, behavioral feature extraction, threat classification, and risk-based alert prioritization within a continuous detection pipeline. The framework is designed to support early identification of lateral movement, privilege escalation, anomalous service communication, and compromised workload behavior. Its effectiveness can be evaluated using detection accuracy, precision, recall, F1-score, false-positive rate, and detection latency. By integrating relational learning with behavioral analysis, the proposed approach aims to improve detection capabilities in complex cloud-native infrastructures. The framework provides a foundation for adaptive, scalable, and context-aware cyber threat monitoring while emphasizing data quality, computational efficiency, explainability, and operational security.
