GraphSeqDetect: A Hybrid Machine Learning Leveraged Adaptive Learning Framework for Insider-Driven DDoS Detection in Cloud Environments

Abstract

Distributed Denial of Service (DDoS) attacks from trusted entities originating within the cloud environment are a key challenge to cloud environments due to their origin from within the cloud and their insidious nature, which make them difficult to identify using conventional security countermeasures. In this paper, we present GraphSeqDetect which leverages Graph Neural Networks (GNN) for structural anomaly detection, Recurrent Neural Networks (RNN) for sequential pattern analysis, and Reinforcement Learning (RL) for adaptive mitigation. We model cloud interactions as a dynamic graph, which allows both relational and temporal analysis of user behaviors. The proposed method is run using the DARPA KDD dataset with which it achieves a detection accuracy of 94.1%, outperforming traditional classifiers like Random Forest and Autoencoder based methods in both classification performance and convergence speed. Experimental results demonstrate that GraphSeqDetect decreases false positives (4.3%) and latency of detection (300ms), and therefore represents a fast and scalable real-time solution. The study underscores the necessity of multi layered anomaly detection techniques for security in the cloud and promises the possibility of more adaptive and intelligent defense mechanisms against various types of cyber threats.