Boomerang: Automated Threat Detection and Incident Response Framework for Virtual Machines in Cloud Environments

Cloud computing refers to the process of using services such as data storage, servers, databases, networking, and software hosted over the internet. It makes computer system resources, particularly data storage and processing capacity, readily available on demand without direct user management. However, this technology has created a new type of cybersecurity challenge, where attackers try to break into cloud networks using more sophisticated methods. This can result in data and financial loss, reputational damage, and legal trouble. To meet these challenges, it is pertinent to develop a security system to keep the cloud system secure. This paper presents Boomerang, an automated threat detection and incident response framework tailored for virtual machines (VMs) in cloud environments. Boomerang continuously monitors VMs across multiple hypervisors using Elastic Agents and integrates with threat intelligence feeds to detect anomalies in real-time. Unlike conventional systems, Boomerang is equipped with MITRE ATT&CK-aligned custom rules and a rules engine to classify threats and trigger automated mitigation responses. This framework comprises of several components, including the Automated Monitoring Tool (AMT), which continuously monitors all enrolled VMs located in different hypervisors within the cloud environment. Upon identifying threats or anomalies, the Incident Response Mechanism (IRM) activates its rules engine to classify the attack type and automatically trigger the appropriate response to mitigate the threat. Anticipated results include a significant reduction in threat detection and response time, accurate attack classification, and high coverage against other existing techniques.