Performance Evaluation of Anomaly-Based Detection Approaches for Zero-Day Attack Early Warning in Cloud Infrastructure

The escalating sophistication of zero-day attacks poses unprecedented challenges to cloud infrastructure security, necessitating advanced detection mechanisms beyond traditional signature-based approaches. This paper presents a comprehensive performance evaluation of anomaly-based detection approaches specifically designed for early warning of zero-day attacks in cloud environments. We systematically analyze multiple detection strategies leveraging multi-source telemetry data, including network traffic patterns, system call sequences, and resource usage metrics. Through extensive experimentation on a realistic cloud infrastructure testbed using synthesized attack scenarios, we compare statistical-, machine learning-, and ensemble-based detection approaches across critical performance dimensions, including detection accuracy, false positive rates, and detection timeliness. Our evaluation reveals significant trade-offs among approaches, with ensemble methods achieving a recall (TPR) of 94.7% while maintaining a false positive rate of 0.20%. The findings provide actionable insights for cloud service providers seeking to optimize their zero-day threat detection capabilities.