Abstract

Cloud computing has transformed IT infrastructure, but protecting Virtual Machines (VMs) remains challenging due to increasingly sophisticated cyber threats. We present a machine learning framework for predicting VM compromise of cloud systems based on the UNSW-NB15 dataset, which includes 257,673 network traffic records. We evaluated twelve classification algorithms that include seven base models (Decision Tree, Random Forest, Logistic Regression, Naive Bayes, Support Vector Machine, K-Nearest Neighbors and Gradient Boosting), and five advanced ensemble learning ones (Stacking Ensemble, Voting Ensemble, XGBoost, LightGBM, and AdaBoost). Our experiments show that the Stacking Ensemble has higher performance in terms of 90.22% accuracy, 98.87% precision, 86.62% recall and 92.34% F1-score compared to traditional single classifier methods. We carefully selected features based on Random Forest importance metrics, shrinking the feature space to 30 dimensions, while still maintaining the same model performance, and decreasing the computational cost by 28.6%. Our analysis shows ensemble approaches are always better compared to individual base models by an average margin of 6.39%. Our system provides secure, scalable real time compromise detection with the lowest false alarm (2.05%) rate, which can be significantly used in the further development of cloud security infrastructure and provide real implementation opportunities in production settings. Future research will expand the validation to other real world cloud traffic datasets to enhance generalizability, even though the experiments are carried out on the UNSW-NB15 dataset.