Security-Oriented Forensic Correlation for Advanced Persistent Threat Detection Across Distributed Enterprise Cloud Networks

Abstract

The increasing sophistication of advanced persistent threats (APTs) presents significant cybersecurity challenges for organizations operating distributed enterprise cloud networks. APT attacks typically involve prolonged unauthorized access, stealthy lateral movement, privilege escalation, data manipulation, and targeted information exfiltration across interconnected infrastructure. Traditional security monitoring systems often struggle to identify these coordinated activities because security evidence is distributed across multiple cloud platforms, network devices, identity services, endpoints, and enterprise applications. This research proposes a security-oriented forensic correlation framework that integrates artificial intelligence, machine learning, behavioral analytics, and contextual threat intelligence to improve APT detection across distributed cloud environments. The proposed methodology combines multi-source evidence acquisition, event normalization, temporal correlation, attack pattern identification, and forensic relationship analysis. Machine learning algorithms identify anomalous activities, while graph-based correlation mechanisms reconstruct potential attack paths and reveal relationships between suspicious events. Threat intelligence integration improves contextual understanding of known attack indicators, attacker behaviors, and emerging security risks. Explainable AI techniques provide transparent investigation insights and support analyst-driven decision-making. The framework additionally incorporates evidence integrity verification, secure provenance management, and automated incident prioritization to strengthen forensic reliability. Performance evaluation considers detection accuracy, precision, recall, false-positive rates, correlation efficiency, and attack reconstruction effectiveness. The proposed approach aims to improve enterprise threat visibility, accelerate forensic investigations, and strengthen proactive defense against persistent cyber threats.