Time Series Anomalies based Attack Forecasting system in Cloud Environments using LSTM

Cloud computing provides elastic services like processing capacity, storage, and databases but is highly susceptible to threats from cybersecurity breaches in the form of DoS, DDoS, and botnet attacks because of its dynamic and multi-tenant nature. To tackle such threats in advance, this research proposes a time-series based anomaly detection system based on the CICIDS 2018 dataset. Emphasis is given to predicting future security violations through the detection of abnormal behavior departures-supporting early unknown or changing threat detection. The data is preprocessed by resampling, log scaling, and KPSS test- and Granger causality-based feature selection to ensure stationarity and temporal significance. Anomaly Detection Toolkit LevelShiftAD method of (ADTK) is first used to detect features with structural changes. Long Short-Term Memory (LSTM) neural networks are trained per feature selected to capture temporal patterns and forecast future values. Anomalies in new data are identified by inspecting reconstruction errors within a votingbased approach per feature. The LSTM models had an average Mean Absolute Error (MAE) of 0.29, Root Mean Squared Error (RMSE) of 0.35, and Median Absolute Percentage Error (MdAPE) of $\mathbf{4. 2 \%}$, indicating stable performance. The hybrid model nicely integrates statistical signal processing and deep learning to accurately detect anomalies in real time from cloud-based network environments.