Real-Time Cyber Attack Classification for Enterprise Cloud Platforms Using Explainable AI and Distributed Threat Intelligence

Abstract

Enterprise cloud platforms support critical business applications, distributed data processing, and interconnected digital services, making them attractive targets for increasingly sophisticated cyberattacks. Traditional security mechanisms often depend on predefined rules and signature-based detection, which may struggle to identify previously unseen attacks, rapidly evolving threats, and coordinated malicious activities across multiple cloud environments. This research proposes an intelligent framework for real-time cyberattack classification by integrating explainable artificial intelligence (XAI) with distributed threat intelligence. The framework collects security telemetry from cloud workloads, network traffic, identity services, application programming interfaces, and endpoint protection systems. Machine learning models classify suspicious activities into attack categories, including distributed denial-of-service attacks, credential compromise, malware communication, reconnaissance, lateral movement, and data exfiltration. Explainability techniques provide interpretable evidence for predictions by identifying influential traffic features, behavioral indicators, and contextual threat signals. Distributed threat intelligence enables participating cloud environments to exchange privacy-aware indicators of compromise and relevant attack patterns, improving detection consistency across organizational boundaries. A streaming-based processing architecture supports continuous feature extraction, classification, alert prioritization, and automated security response. The proposed methodology emphasizes classification accuracy, precision, recall, F1-score, detection latency, computational overhead, and explanation quality. Comparative evaluation against conventional machine learning and signature-based approaches can establish the framework's effectiveness. The research aims to improve the speed, transparency, adaptability, and operational reliability of cloud cybersecurity while supporting analyst trust, incident investigation, and evidence-based security decisions.