Reseach Article
Architecting Behavioural Anomaly Detection for Cloud-Scale Security Operations: An Interpretable Statistical Framework for SOC-Driven Cyber Threat Analytics
| Journal of Advanced Artificial Intelligence |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 2 - Number 7 |
| Year of Publication: 2026 |
| Authors: Justice Opara-Martins |
Justice Opara-Martins . Architecting Behavioural Anomaly Detection for Cloud-Scale Security Operations: An Interpretable Statistical Framework for SOC-Driven Cyber Threat Analytics. Journal of Advanced Artificial Intelligence. 2, 7 ( Oct 2026), 53-65. DOI=None
Abstract
Cloud-native enterprises generate high-volume behavioural telemetry across identity, session, file-access, network, and privilege-management systems. Signature-based controls remain necessary but may miss compromised legitimate accounts and low-and-slow deviations that do not match known indicators. This paper develops an interpretable statistical framework for behavioural anomaly triage within Security Operations Centre (SOC) workflows. The framework comprises four stages: telemetry preparation, entity-specific baseline construction, standardised deviation scoring, and SOC correlation and response. The method uses means, standard deviations, Z-scores, and explicitly defined thresholds to identify observations requiring investigation. A cold-start procedure moves new entities from documented heuristic thresholds to statistical baselines only after a prespecified minimum history is available. The framework is demonstrated using a 30-day synthetic enterprise dataset containing approximately 500 user entities and more than 100,000 activity events, with behavioural indicators including authentication, access latency, privilege escalation, and failed authentication activity. A worked example shows how an unusual login count can be transformed into an auditable anomaly score. The study does not claim that this demonstration establishes population-level detection accuracy or production-scale performance: the supplied evidence does not include independently labelled attack events, a confusion matrix, comparative baselines, or reproducible MTTD/MTTR calculations. Its contribution is therefore a transparent and extensible detection architecture that can be evaluated in a subsequent labelled, multi-source cloud experiment.
References
- V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM Computing Surveys, vol. 41, no. 3, pp. 1–58, 2009.
- A. Patcha and J. M. Park, “An overview of anomaly detection techniques: Existing solutions and latest technological trends,” Computer Networks, vol. 51, no. 12, pp. 3448–3470, 2007.
- R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symposium on Security and Privacy, pp. 305–316, 2010.
- J. Opara-Martins, “Architecting Behavioural Anomaly Detection for Cloud-Scale Security Operations: A Statistical Framework for SOC-Driven Cyber Threat Analytics,” EU Digital4Business Consortium, 2026.
- IBM Security, “IBM QRadar SIEM: Security Information and Event Management,” 2025. [Online]. Available: https://www.ibm.com/security/security-intelligence/qradar. [Accessed: 7 Mar. 2026].
- European Commission, “Network and Information Security Directive 2 (NIS2),” Official Journal of the European Union, 2023.
- European Parliament, “Digital Operational Resilience Act (DORA),” Official Journal of the European Union, 2022.
- NIST, Framework for Improving Critical Infrastructure Cybersecurity, National Institute of Standards and Technology, 2018.
- ISO/IEC, ISO/IEC 27001:2013 Information technology—Security techniques—Information security management systems—Requirements, 2013.
- A. Oprea, Z. Li, A. Juels, M. K. Reiter, and M. Robinson, “Detection of early-stage insider attacks using behavioral models,” in Proc. ACM SIGSAC Conference on Computer and Communications Security, pp. 109–120, 2015.
- M. Ahmed, A. N. Mahmood, and J. Hu, “A survey of network anomaly detection techniques,” Journal of Network and Computer Applications, vol. 60, pp. 19–31, 2016.
- G. Kim, S. Lee, and S. Kim, “A novel hybrid intrusion detection method integrating anomaly detection with misuse detection,” Expert Systems with Applications, vol. 41, no. 4, pp. 1690–1700, 2014.
- Y. Zhang, N. Meratnia, and P. Havinga, “Outlier detection techniques for wireless sensor networks: A survey,” IEEE Communications Surveys & Tutorials, vol. 12, no. 2, pp. 159–170, 2010.
- F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. IEEE International Conference on Data Mining, pp. 413–422, 2008..
- C. Zhang, D. Song, C. Huang, A. Swami, and N. V. Chawla, “Deep learning on graphs: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 34, no. 1, pp. 249–270, 2019.
- M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you?: Explaining the predictions of any classifier,” in Proc. ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1135–1144, 2016.
Index Terms
Keywords