Real-Time Cyber Threat Visibility in Cloud Saas Platforms: A Novel Architecture and Implementation of a Self-Healing Monitoring System

Abstract

As more and more people use cloud-based Software-as-a-Service (SaaS) platforms, the necessity for real-time cybersecurity solutions that can find threats before they happen and respond automatically has grown. Traditional log-based monitoring systems frequently don't give you timely visibility and protection against advanced assaults. This research came up with and put into action a new self-healing monitoring architecture that is made just for multi-tenant SaaS settings. The system included lightweight data gathering agents, AI/ML-driven models for finding anomalies, and an autonomous remediation engine to make sure that threats were always visible and the system was strong. The identification engine had a very high accuracy rate of 96.2% and a very low false positive rate of 3.2% when tested on benchmark datasets like CICIDS 2017 and UNSW-NB15. The system did better than traditional tools when it came to Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). It was able to recover from simulated attacks in seconds and keep service interruptions to a minimum. The performance study also showed that the system had low computational overhead and good scalability, which means it can be used in real-world cloud SaaS infrastructures. This study is a big step toward smart, automated cloud security and sets the stage for future improvements in self-adaptive cybersecurity systems.