Targeted Detection of Advanced Persistent Threats in Cloud-Native Environments: A Focused Machine Learning Approach

Dixit, Chinmay Ramakrishna (2025) Targeted Detection of Advanced Persistent Threats in Cloud-Native Environments: A Focused Machine Learning Approach. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (686kB) | Preview
Preview	PDF (Configuration Manual) Download (2MB) | Preview

Abstract

This research presents a machine learning-based framework for detecting Advanced Persistent Threats (APTs) within containerized cloud-native environments systems increasingly targeted in attacks like the SolarWinds breach and Kubernetes API server exploits. Unlike traditional intrusion detection systems that struggle with dynamic cloud features such as ephemeral containers and interservice communication, our approach leverages real-time Zeek telemetry and Falco runtime alerts to capture both network and behavioral anomalies. Through synthetic attack simulations aligned with real-world CVEs and CWEs, we curated three threat datasets PT_TRAIN, OSCI, and UUF and benchmarked them alongside live Zeek logs. Feature engineering was applied on parsed conn.log data, and supervised (Random Forest) and unsupervised (Isolation Forest) models were trained. Random Forest achieved F1-scores between (0.94 to 1.00) on curated datasets, but performance collapsed to F1=0.10 on live Zeek data underscoring the need for labelled data in cloud threat detection. This work differs from prior studies by integrating both telemetry and runtime signals in a reproducible pipeline tailored for microservice-based systems. Our results demonstrate that data quality not algorithm choice is decisive factor and this is a scalable and practical approach to modern APT detection that bridges the gap between synthetic data modelling and real-world applicability.

Item Type:	Thesis (Masters)
Supervisors:	Name Email McLaughlin, Eugene UNSPECIFIED
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Cloud computing Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Machine learning
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	17 Aug 2026 14:32
Last Modified:	17 Aug 2026 14:32
URI:	https://norma.ncirl.ie/id/eprint/9529

Actions (login required)

View Item