Hybrid Reinforcement Learning-Based Anomaly Detection in AWS CloudTrail Logs

Cloud security threats are becoming increasingly sophisticated, necessitating proactive and adaptive anomaly detection systems. This paper presents HRL-AD (Hybrid Reinforcement Learning-Based Anomaly Detection), an AI-driven framework designed for real-time threat detection in AWS CloudTrail logs. The proposed model integrates multiple machine learning techniques: unsupervised learning (Autoencoders, Isolation Forest) to detect subtle anomalies, supervised classification (XGBoost, Random Forest) to enhance accuracy, and Deep Q-Learning (DQN) to dynamically adjust detection thresholds based on feedback. This hybrid approach significantly improves anomaly classification by continuously learning from cloud behavior patterns. Experimental results demonstrate that HRL-AD achieves a Silhouette Score of 0.85, Precision of 0.92, Recall of 0.89, and F1-Score of 0.91, outperforming traditional models in both accuracy and false positive reduction. The study underscores the potential of reinforcement learning in cloud security and paves the way for future research in multi-cloud anomaly detection, adversarial robustness, and explainable AI, offering scalable and adaptive protection for modern cloud environments.