Authors - Deepika K M, Girish Gowda J, Ravi Honnalli, Nikhil S G Abstract - Cloud computing environments face increasingly sophisticated cyber threats that demand advanced detection mechanisms capable of identifying anomalous behavior in real-time. This study introduces an innovative hybrid temporal anomaly modeling system that integrates Autoregressive Integrated Moving Average (ARIMA) with Long Short-Term Memory (LSTM) networks, augmented by meta-learning fusion strategies. Our method solves the difficult problem of getting high recall rates (>95%) that are needed to keep operational efficiency while reducing missed critical threats. We tested five meta-learning architectures—Logistic Regression, Random Forest, XG-Boost, Gradient Boosting, and Neural Network—along with four rule-based fusion strategies on a large Cloud Anomaly Dataset with 249,595 samples taken from 11 virtual machines over 30 days. The Hybrid-RF (Random Forest) model had the best balance, with a recall of 95.75%, an accuracy of 10.59%, and an F1-score of 11.37%. This was much better than the average in the literature (75-85% recall). We set up the system as a production-ready Flask REST API on Google Cloud Platform, with response times of less than 200 milliseconds. This shows that it is possible to use real-time cloud security monitoring. Our findings demonstrate that metalearning fusion of statistical and deep learning temporal models yields enhanced threat detection capabilities relative to single-model approaches, achieving recall improvements of 10-20% over state-of- the-art methods while adhering to real-time performance constraints.
Open Zoom