A causality-aware and explainable intelligence framework for secure and resilient cloud systems

The cloud computing environment is becoming more vulnerable to advanced and dynamic cyber intrusions that take advantage of complex behavioural dependencies, dynamic access patterns, and vulnerabilities of shared infrastructures. Traditional cloud intrusion detection platforms are largely based on correlation-based machine learning or non-adaptive rule-based platforms that have problems generalizing when faced with changing attack plans and offer only limited interpretability of operations to give operational trust. The case of this paper consists of a causality-aware and explainable intelligence framework of secure and resilient cloud systems to address these challenges. The proposed framework will combine structural causal modelling with deep behavioural representation learning to reveal latent cause-and-effect relationships of malicious activities in cloud network traffic. Counterfactual reasoning is also used to increase resistance against low-rate and evasive attacks and a causal explainability module produces transparent and human interpretable security justifications. Experimental analysis is done over the UNSW-NB15 benchmark dataset which consists of various types of intrusion and realistic cloud traffic patterns. The proposed framework has the highest detection accuracy of 98.34, F1-score of 97.91 and a lower rate of false positive of 1.62, which is much better than traditional machine learning and deep learning baselines. Resilience analysis also illustrates that the training is resilient to adversarial perturbation and low-rate attack conditions and it is more resilient than correlation-based models, i.e., the resilience increases more than 12%. These findings substantiate the fact that incorporating causality and explainability in cloud security intelligence can enhance detection performances in addition to improving trust, transparency, and operational stability. The framework suggested is an interpretable and scalable tool that fits in the contemporary cloud structures and infrastructures that require a high level of security. Additional validation using the CICIDS2017 benchmark dataset further demonstrates the generalization capability and robustness of the proposed framework.