GNNs Enhance Cloud Anomaly Detection, Reduce False Positives

Cloud cybersecurity faces challenges in detecting threats due to the sheer volume of logs and the high false positive rates of traditional heuristic or anomaly detection methods. This paper introduces an industrial case study focusing on a self-supervised learning approach using Graph Neural Networks (GNNs) to improve threat detection in cloud environments. The GNN model processes AWS CloudTrail logs, generating an anomaly score for each event. A key advantage is its dynamic adaptability to organizational changes, eliminating the need for periodic retraining. Experiments across five organizations demonstrated a substantial reduction in alerts, bringing down volumes from thousands to approximately one per hour, significantly outperforming domain expert rule-based baselines. While the study highlights practical deployment insights and reduced alert fatigue, it acknowledges limitations, particularly the inability to estimate false negatives from the current data. The findings primarily showcase the model's effectiveness in reducing noise for security analysts.