Artificial Intelligence for Cybersecurity and Cloud Security: Predictive Threat Detection, Risk Analytics, and Decision Support for Critical Infrastructure

Abstract

Artificial intelligence (AI) can strengthen cyber and cloud security by detecting weak signals, estimating operational risk, and prioritizing interventions before disruptions propagate across critical infrastructure. Yet high benchmark accuracy does not by itself establish operational utility: infrastructure operators must control false alarms, account for concept drift, explain recommendations, and preserve human authority over consequential actions. This study develops a governance-aware architecture that fuses network telemetry, identity events, cloud control-plane logs, vulnerability context, asset criticality, and threat intelligence into a calibrated decision-support pipeline. A design-science methodology is combined with a reproducible synthetic benchmark of 60,000 temporally ordered security events, including an induced distribution shift in the final 20 percent. Synthetic data were used because authentic enterprise telemetry is difficult to release without exposing personal information, regulated health or identity data, network topology, vulnerabilities, and proprietary defensive controls. Logistic regression, random forest, and histogram-based gradient boosting models are evaluated using discrimination, calibration, false-positive rate, and analyst-capacity-constrained triage metrics. Under a top-decile investigation budget, logistic regression achieved the strongest overall discrimination (ROC-AUC 0.736; 95% bootstrap CI 0.724–0.748) and a PR-AUC of 0.343. This moderate performance is intentionally reported rather than inflated: the benchmark contains overlapping classes and temporal shift, and no test-set tuning was performed. The experiment is illustrative, not evidence of field effectiveness; external validation on public and operational datasets remains necessary. The architecture therefore emphasizes shadow deployment, drift monitoring, adversarial validation, audit trails, and human approval for high-impact containment.