Trend-based Multi-Modal Anomaly and Cyber Threat Detection with Traceable Explainability for Cloud Services
| Autorzy | Nakip M.; Gibała R.; Grygar A.; Nowak S. |
|---|---|
| Tytuł | Trend-based Multi-Modal Anomaly and Cyber Threat Detection with Traceable Explainability for Cloud Services |
| Czasopismo | European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML-PKDD) |
| Rok | 2026 |
| Status | In Press |
| Abstrakt | <p>Multi-modal real-time monitoring systems based on AI are<br>essential for ensuring system reliability and cyber-defense in cloud computing,<br>but are challenged by context isolation, early-fusion computational<br>overhead, and insufficient transparency. In order to address these<br>issues, this paper introduces T-MATE, an explainable Trend-based Multimodal<br>Anomaly and Threat detector engineered for robust, secure cloud<br>infrastructure monitoring. Rather than treating multi-modal streams<br>monolithically, T-MATE structurally decouples data modalities into independent<br>neural network heads, using a specialized Recurrent Trend<br>Predictive Neural Network (rTPNN) to isolate underlying trends and levels<br>across quantitative performance telemetry, while qualitatively parsing<br>textual event logs via Gemini 2.5 Flash. These components output<br>bounded anomaly scores and are integrated at the decision level<br>using an Empirical Reliability-Weighted Max Fusion operator, which<br>scales individual outputs to enforce a max-safety posture and eliminate<br>parameter-explosion liabilities. In order to demonstrate operational deployment<br>readiness, the framework is thoroughly evaluated via 10-fold<br>cross-validation and compared against standalone rTPNN, LSTM, and<br>MLP models alongside the baseline Avg-Fuse paradigm on the public<br>CloudAnoBench dataset. The results reveal that T-MATE achieves a superior<br>overall F1 Score of 0.88, a top threshold-invariant AUC-ROC of<br>0.96, an exceptional True Positive Rate of 0.96, and a processing footprint<br>that confirms its viability for close to real-time inference in enterprise<br>cloud infrastructures.</p> |