A Behavioral Swarm Intelligence Framework with a Hybrid 1D-CNN for Identifying Zero-Day Attacks in Kubernetes-Driven Hybrid Clouds

Abstract

Zero-day exploitation in hybrid clouds based on Kubernetes is difficult to detect, as traditional signature detection systems and standalone anomaly detection models are running out of context and are prone to generating numerous false positives in dynamic workloads. In this paper, we bridge this gap with Cerberus, a hybrid detection framework that integrates, in a unique manner, a container-level behavioral analysis running a lightweight one-dimensional convolutional neural network (1D-CNN) and a collective level of analysis based on behavioral swarm intelligence (BSI). The 1D-CNN captures low-level anomalies at runtime on system calls, network flows, and resource usage, whereas the BSI identifies anomalous interaction patterns among services. A weighted decision fusion scheme is a method that combines the two results aimed at improving the trustworthiness of detection. Cerberus, tested on three datasets including UNSW-NB15, CIC-IDS2017, and a custom Kubernetes-specific (termed as Kube-ZeroDay, KZD-2026) dataset, outperforms LSTM, autoendetraining and graph-based models with an accuracy of 96.8 and a false positive rate of 2.1. The framework also presents a low detection latency (29 ms) and has good behavior with cluster scalability, which demonstrates that it can be applied in practical cloud-native scenario.