CloudWatch IDS: Time-Series Anomaly-Based Machine Learning Intrusion Detection for Cloud

Abstract

Cloud computing environments face an exponentially growing threat landscape characterised by sophisticated, low-and-slow intrusion campaigns that evade traditional signature-based intrusion detection systems (IDS). Temporal patterns in cloud network traffic—subtle deviations in packet inter-arrival times, API call sequences, and authentication event rates—carry rich anomaly signals that signature-based tools cannot exploit. This paper presents CloudWatch IDS, a time-series anomaly-based machine learning intrusion detection system for cloud infrastructure that combines an LSTM Autoencoder (LSTM-AE) for unsupervised reconstruction-error anomaly detection with an Isolation Forest for oneclass novelty scoring, ensembled with an XGBoost alert classifier for multi-class attack type identification and severity ranking. Trained on a curated dataset of 52,800 annotated 60-second slidingwindow traffic segments derived from AWS VPC flow logs, CloudTrail audit events, and system call traces spanning five attack categories—DDoS, port scanning, brute force login, SQL injection, and privilege escalation—CloudWatch IDS achieves an overall classification accuracy of 97.2%, precision of 96.4%, recall of 95.8%, and F1-score of 96.1%, with a false positive rate of 1.9%. Field deployment in a simulated enterprise cloud environment reduced mean time to detect (MTTD) from 42 to 3.2 minutes, mean time to respond (MTTR) from 74 to 11 minutes, and daily alert volume from 1,240 to 87 actionable alerts—a 93% reduction in alert fatigue. CloudWatch IDS provides a scalable, cloud-native intrusion detection solution deployable across AWS, Azure, and GCP environments with 178 ms inference latency.