Predictive Threat Intelligence for Cloud-Native Security using Graph Neural Networks and Behavioral Anomaly Detection

Abstract

Cloud-native environments introduce complex security challenges due to their distributed architectures, dynamic workloads, microservices, containerized applications, and extensive use of application programming interfaces. Traditional security mechanisms often rely on predefined rules and known attack signatures, limiting their ability to identify emerging threats and coordinated malicious activities. This research proposes a predictive threat intelligence framework that integrates Graph Neural Networks (GNNs) with behavioral anomaly detection to improve threat identification and proactive defense in cloud-native infrastructures. The proposed framework represents cloud resources, containers, identities, network connections, and application services as interconnected graph structures to capture relationships and dependencies across the environment. Graph Neural Networks analyze these relationships to identify suspicious interaction patterns, propagate contextual threat information, and predict potentially compromised resources. Behavioral anomaly detection complements graph-based analysis by identifying deviations from established baselines of normal system activity, including unusual authentication attempts, abnormal network traffic, unexpected privilege escalation, and irregular resource access. The framework combines graph-derived representations, temporal behavioral features, and threat indicators to generate risk scores and prioritize security alerts. A proposed evaluation methodology uses representative cloud security datasets, controlled attack simulations, and established classification metrics to assess detection accuracy, precision, recall, F1-score, false-positive rate, and prediction latency. The research aims to demonstrate how combining relational learning with behavioral analytics can support earlier threat detection, improve security visibility, and strengthen adaptive threat intelligence in dynamic cloud-native environments.