Security Analytics Using Machine Learning Methods for Federal Government Cloud Systems

Abstract

In cloud security analytics framework based on AI for cloud systems used in US federal government which can be used in AWS GovCloud and Azure GovCloud. The growing sophistication of cloud-native cyberattacks and poor performance metrics of static and rule-based defenses motivating this work, our proposed framework enables seamless and automated detection of cloud misconfigurations and malicious behaviors while being aligned with federal compliance requirements including FedRAMP and CISA SCuBA. We perform experiments on a scale synthetic multi-GovCloud dataset (~2.5 million records (≈ 6.2 GB)) developed in this study, that closely mimics near-realistic configuration states & audit logs & attack scenarios. It incorporates compliance-aware feature engineering, cross-platform feature alignment and supervised learning-based misconfiguration detection, as well as behavioral analytics for anomalies and insider-threat detection. We present an optimal transport–based domain adaptation mechanism to alleviate the domain shift between the cloud providers, resulting in a effective transfer from AWS (source accuracy 96.54%, F1 0.9642) to Azure (target accuracy 96.25%, F1 0.9616) with a small adaptation gap of 0.29%. Detection accuracy is above 96 percent across providers (AWS 97.10%, Azure 97.00%, Google Cloud 96.85%, IBM Cloud 96.80%). Differential privacy guarantees privacy preservation, resulting in a final privacy budget of ε = 13.00 with a membership inference attack accuracy (52.05%) close to random guessing. The robustness evaluation shows 97.25% clean accuracy and 96.00% adversarial accuracy under FGSM perturbations, resulting in a small 1.56% robustness gap. Additionally, compliance gap analysis indicates a broad 5.5 percentage point decrease across the core federal control areas. The results demonstrate that the proposed[1] framework can provide correct, privacy-sensitive, robust, and compliant security analytics over federal multi-clouds environments.