Distributed Intelligent Cloud Security Operations Using Graph Machine Learning for Advanced Threat Correlation

Abstract

The rapid adoption of distributed cloud infrastructures has significantly increased the complexity, scale, and dynamism of cybersecurity operations. Traditional Security Operations Centers (SOCs) frequently depend on centralized log analysis, predefined rules, and isolated security alerts, which can produce excessive false positives and fail to identify sophisticated multi-stage attacks. This study proposes a distributed intelligent cloud security operations framework based on Graph Machine Learning (GML) for advanced threat correlation. The proposed approach represents cloud entities, users, devices, applications, network connections, events, and security alerts as interconnected graph structures, enabling relationships among seemingly independent activities to be analyzed collectively. A distributed architecture is employed to support scalable processing across heterogeneous cloud environments while reducing dependence on a single analytical node. Graph-based learning techniques are used to identify anomalous subgraphs, propagate contextual information, and correlate attack indicators across temporal and spatial dimensions. The methodology integrates data preprocessing, graph construction, feature engineering, graph representation learning, anomaly detection, and multi-stage threat correlation. Performance is evaluated using detection accuracy, precision, recall, F1-score, false-positive rate, processing latency, and scalability. The proposed framework is expected to strengthen cloud SOC capabilities by providing contextualized threat intelligence, improving detection of coordinated attacks, and supporting faster and more accurate incident response