AI-Driven Threat Detection for Kubernetes-Based Cloud Systems

Kubernetes' recent rise in popularity in cloud-native environments has led to new security concerns, as it brings a dynamic, decentralized and highly configurable architecture. Conventional rule-based security approaches can be ineffective in identifying advanced and zero-day attacks, especially those involving misconfigurations, privilege escalation, and container runtime vulnerabilities. An AI-based threat detection system that supports intelligent and flexible security monitoring by using multi-telemetry data sources such system calls, audit logs, and network traffic is suggested as a solution to these problems. The system adopts a multi-layered approach for telemetry collection, ingestion, feature engineering, machine learning-based detection and automated response. Anomaly detection based on unsupervised and semi-supervised ML approaches, such as IsolationForest and neural network models, is applied to detect abnormal patterns without the need for labeled data. The approach is evaluated in experiments and shows high accuracy (0.94), recall (0.96) and an AUC (0.97). This suggests the method offers effective, scalable, and real-time threat monitoring capabilities for protecting Kubernetes-based cloud systems.