<![CDATA[Cloud audit logs contain rich behavioral signals that can be leveraged for security monitoring, yet effective anomaly detection remains challenging due to the absence of labeled data and the limited use of contextual information. This study investigates whether contextual feature engineering improves unsupervised anomaly detection in AWS CloudTrail logs by incorporating temporal attributes, per-entity historical activity, and geographic diversity. A controlled experimental design is employed to compare contextual and non-contextual feature representations using two representative unsupervised algorithms: Isolation Forest and Autoencoder. Both models are evaluated under identical datasets and configurations to ensure that performance differences are attributable solely to feature representation. The results indicate that contextual features significantly enhance detection performance across various synthetic threat scenarios. The average detection rate across all scenarios for the Isolation Forest improved from 4.62% to 85.62%, while the Autoencoder demonstrated an increase from an average of 20.24% to 97.26%. In addition, contextual representations consistently improve sensitivity to behaviorally meaningful anomalies that are not identifiable through global statistical rarity alone. Stability analysis using top-1 percent overlap across multiple random seeds reveals a trade-off between robustness and expressiveness, where contextual models exhibit lower but still operationally acceptable stability compared to non-contextual baselines. Overall, the findings demonstrate that contextual feature engineering is a critical component for effective unsupervised anomaly detection in cloud audit logs. By shifting the detection paradigm from global rarity to entity-level behavioral deviation, contextual modeling enables more accurate identification of security-relevant anomalies in AWS environments. ]]>
Copyrights © 2026
