Cross-Domain Threat Investigation for Enterprise Cloud Security Using Distributed AI Learning and Event Correlation

Abstract

Enterprise cloud environments increasingly span public, private, hybrid, and multi-cloud infrastructures, creating complex security challenges that require coordinated investigation across multiple administrative and technological domains. Conventional security monitoring systems often analyze alerts independently, limiting their ability to identify sophisticated attacks that generate interconnected events across identities, networks, applications, containers, and data services. This research proposes an intelligent cross-domain threat investigation framework that integrates distributed artificial intelligence learning with event correlation to improve enterprise cloud security. The framework collects security events from heterogeneous cloud platforms, normalizes their representations, and correlates related activities using temporal relationships, entity associations, behavioral patterns, and attack sequences. Distributed AI learning enables participating domains to collaboratively improve threat detection while minimizing the need to exchange sensitive raw telemetry. Machine learning models identify anomalous behavior, prioritize suspicious event clusters, and support the reconstruction of potential attack paths. Graph-based correlation and contextual risk scoring connect isolated alerts into meaningful investigative narratives. The proposed architecture incorporates secure intelligence exchange, explainable predictions, privacy safeguards, and analyst-guided incident validation. Its evaluation methodology considers detection accuracy, correlation precision, investigation time, false-positive rates, processing latency, communication overhead, and cross-domain generalization. By combining distributed learning with contextual event analysis, the framework aims to improve visibility into coordinated cyberattacks, reduce fragmented investigations, and support timely, evidence-based incident response across enterprise cloud environments.