Abstract

Managing security across heterogeneous cloud platforms such as AWS, Azure, and Google Cloud remains a major challenge for modern Security Operations Centers (SOCs). Each provider generates distinct log formats and behavioral signatures, complicating unified monitoring. Traditional signature-based detection systems often struggle with “living-off-the-land” attacks, where adversaries abuse legitimate administrative tools, while the scarcity of well-labeled multi-cloud datasets limits the practical application of supervised deep learning models. To address these challenges, this paper presents a real-time, unsupervised threat detection architecture. The proposed system aggregates security logs via Wazuh, streams them through Apache Kafka, and processes them in real-time using Apache Flink to extract behavioral features. An Isolation Forest model is employed to detect anomalous activities without reliance on labeled training data. Furthermore, to enhance interpretability, we integrate a Large Language Model (LLM) that translates anomaly scores into plain language explanations and maps suspicious behaviors to MITRE ATT&CK techniques. Evaluation using simulated attack scenarios demonstrates a 99.9% alert reduction rate and effective vendor-agnostic threat detection.