An AI-Driven Adaptive Risk Assessment Framework for Secure and Resilient Cloud Infrastructure

Abstract

Cloud infrastructure is increasingly used to host academic, enterprise, and public-sector services, but its dynamic and distributed nature makes traditional static risk assessment insufficient. Static rule-based scoring is often unable to com-bine vulnerability severity, threat likelihood, workload impact, anomalous behavior, and recent operational context into a single actionable risk view. This paper proposes an AI-driven adap-tive risk assessment framework for secure and resilient cloud infrastructure. The framework integrates cloud log collection, preprocessing, Isolation Forest-based anomaly detection, Random Forest-based risk classification, weighted adaptive risk scoring, alert generation, mitigation recommendation, and dashboard-based visualization. The proposed risk engine computes a nor-malized score using vulnerability score, threat probability, impact score, and anomaly risk. The system was implemented as a defensive Flask-based prototype using simulated cloud infrastruc-ture logs. Experimental evaluation on 600 simulated cloud events produced an average risk score of 39.6, identified 108 high-risk and 13 critical-risk events, generated 746 explainable alerts, and produced 1048 defensive recommendations. The proposed hybrid model achieved 95.20% accuracy and a 93.75% F1-score in risk-level classification, outperforming a static rule-based baseline. The results demonstrate that adaptive AI-assisted risk assessment can improve cloud security monitoring, decision support, and resilience planning.

Introduction

The paper proposes an AI-driven adaptive cloud risk assessment framework designed to improve security and resilience in cloud environments. Traditional cloud risk assessment methods rely on static rules, periodic audits, and manual reviews, making them less effective for continuously changing cloud infrastructures. Since cloud risks often arise from a combination of factors—such as failed login attempts, privilege changes, abnormal network activity, and vulnerabilities—the proposed framework adopts an adaptive and intelligent approach.

The framework integrates Isolation Forest for unsupervised anomaly detection, Random Forest for supervised risk classification, and a weighted risk scoring model that combines vulnerability severity, threat probability, operational impact, and anomaly scores into a normalized risk value ranging from 0 to 100. It also includes an adaptive threshold mechanism that dynamically adjusts risk sensitivity based on recent system behavior and alert frequency.

The system architecture consists of six layers: data input, preprocessing, AI risk engine, adaptive risk scoring, decision support, and visualization. Cloud log data are validated, cleaned, encoded, and normalized before being processed by the machine learning models. The framework generates explainable alerts, assigns risk categories (low, medium, high, and critical), and provides mitigation recommendations such as enabling multi-factor authentication, reviewing IAM changes, closing unnecessary ports, patching vulnerable systems, and increasing monitoring.

A full-stack prototype was implemented using Python Flask, Scikit-learn, SQLite, Pandas, NumPy, and Chart.js. The system processes simulated cloud infrastructure logs uploaded through CSV files and presents results through an interactive dashboard with service-wise, region-wise, and event-level risk analysis, along with reporting and export capabilities.

The framework was evaluated using 600 simulated cloud events across multiple cloud services and regions. Experimental results demonstrated that the hybrid AI approach outperformed traditional rule-based methods by improving anomaly detection and risk classification accuracy. The dashboard identified 348 low-risk, 131 medium-risk, 108 high-risk, and 13 critical-risk events, while generating actionable alerts and recommendations. Service-wise analysis indicated that IAM and Network services exhibited the highest simulated risk levels.

Overall, the proposed framework provides an adaptive, explainable, and defensive cloud risk assessment solution that combines machine learning, dynamic risk scoring, and decision support to enhance cloud security monitoring. Although currently limited to simulated datasets and batch processing, the system demonstrates the potential of AI-driven approaches for continuous cloud risk management and future real-time security applications.

Conclusion

This paper presented an AI-driven adaptive risk assessment framework for secure and resilient cloud infrastructure. The proposed system combines cloud log preprocessing, Isolation Forest anomaly detection, Random Forest risk classification, adaptive risk scoring, explainable alerting, mitigation recom-mendations, dashboard visualization, and reporting. Prototype evaluation using 600 simulated cloud infrastructure events demonstrated that the proposed hybrid risk engine improves classification performance over static rule-based methods and provides practical decision support for security analysts. The framework offers a safe and extensible foundation for cloud risk monitoring, resilience planning, and future DevSecOps integration.

References

[1] Joint Task Force Transformation Initiative, “Guide for Conducting Risk Assessments,” NIST Special Publication 800-30 Revision 1, National Institute of Standards and Technology, 2012. [2] Joint Task Force, “Security and Privacy Controls for Information Sys-tems and Organizations,” NIST Special Publication 800-53 Revision 5, National Institute of Standards and Technology, 2020. [3] FIRST.Org, Inc., “Common Vulnerability Scoring System Version 3.1: Specification Document,” 2019. [4] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. [5] Scikit-learn Developers, “RandomForestClassifier,” Scikit-learn docu-mentation, 2026. [6] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. 8th IEEE International Conference on Data Mining, 2008, pp. 413–422. [7] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation-based anomaly detection,” ACM Transactions on Knowledge Discovery from Data, vol. 6, no. 1, pp. 1–39, 2012. [8] Scikit-learn Developers, “IsolationForest,” Scikit-learn documentation, 2026. [9] F. Pedregosa et al., “Scikit-learn: Machine learning in Python,” Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011. [10] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Proc. Advances in Neural Information Processing Systems, 2017, pp. 4765–4774. [11] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. ICISSP, 2018, pp. 108–116. [12] ISO/IEC, “ISO/IEC 27017: Code of practice for information security controls based on ISO/IEC 27002 for cloud services,” International Organization for Standardization, 2015. [13] Cloud Security Alliance, “Cloud Controls Matrix,” Cloud Security Alliance, 2024. [14] Amazon Web Services, “AWS Well-Architected Framework: Security Pillar,” AWS Documentation, 2024. [15] Microsoft, “Microsoft Cloud Security Benchmark,” Microsoft Learn, 2024.

Copyright

Copyright © 2026 Gandikota Nikhileswari, N. Shiva Lingam. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.