Our cloud computing infrastructures are recently facing the more and more advanced internet threats such as zero-day malware, DDoS attacks and high- level intrusion trials. Traditional security defenses using rule-based firewalls and signatures can no longer suffice to secure multi-tenant cloud infrastructures with dynamic attack patterns. In this paper we present CPGUARD, an AI-based firewall and malware defense system for cloud servers. CPGUARD, which includes supervised traffic classification, unsupervised anomaly detection and behavioral deviation analysis components as well as automated response functionality. MOTIVATION We develop mathematical models for classification and anomaly scoring and introduce a novel integrated risk-scoring decision mechanism adopted through an unified mitigation algorithm. Experimental results on a large-scale cloud traffic trace demonstrate better detection effectiveness, fewer false positives and run- time delay compared with traditional firewall and IDS only approaches. The findings confirm the value of layered AI-based security to enhance cloud trustworthiness and robustness.

Keywords—Cloud Security, Artificial Intelligence, Intrusion Detection, Malware Analysis, Anomaly Detection, Firewall, Risk Scoring.