AI-Powered AWS Cloud Security: Build Machine Learning Threat Detection & Explainable AI Defense

Aim

Workshop Objectives

Workshop Structure

Day 1: DETECT: AWS Cloud Security Architecture, Behavioral Analytics & ML-Based Threat Detection

Focus: Understand AWS cloud security fundamentals, analyze security logs and develop machine learning models to identify unusual cloud activities.

• Understand AWS EC2, S3, IAM, VPC and the Shared Responsibility Model.
• Explore identity management, authentication, access controls and CloudTrail security events.
• Identify common cloud security concerns, including unusual logins, suspicious API activity and unauthorized configuration changes.
• Understand CloudTrail JSON fields, including event time, user identity, event name, source IP and event source.
• Parse and preprocess cloud security logs using Python and Pandas.
• Perform feature engineering using activity frequency, failed requests, access times and behavioral patterns.
• Apply Isolation Forest for anomaly detection and Random Forest for security-event classification.

Hands-on:

Import and preprocess AWS CloudTrail-style JSON events. , analyze user activity and identify unusual API usage patterns. Create behavioral features using Python and Pandas.

Tools: Python, Google Colab, Jupyter Notebook, Pandas, NumPy, Scikit-learn and Matplotlib.

Day 2: DEFEND: Deep Learning, Network Intrusion Detection & Cloud-Native Threat Analytics

Focus: Analyze cloud network traffic and apply machine learning and deep learning techniques to identify abnormal network behavior and potential intrusion indicators.

• Understand AWS VPC networking, subnets, security groups and network access controls.
• Explore AWS VPC Flow Logs and cloud network traffic monitoring.
• Analyze network-flow features, including IP addresses, ports, protocols, packets and bytes.
• Understand network intrusion detection and abnormal traffic patterns.
• Apply Random Forest and Isolation Forest for network traffic classification and anomaly detection.
• Explore Artificial Neural Networks and autoencoder architectures.
• Understand reconstruction errors, anomaly thresholds, model training and validation.
• Evaluate false positives and compare machine learning and deep learning performance.
• Explore Docker, Kubernetes and container security fundamentals.
• Introduce advanced research approaches, including Transformers and self-supervised learning.

Hands-on:

Load and explore prepared AWS VPC Flow Log-style datasets. Extract network-flow features and visualize unusual traffic patterns. Apply a machine learning baseline for network anomaly detection.

Tools: Python, Google Colab, Pandas, Scikit-learn, TensorFlow/Keras and Matplotlib.

Practical Output: An AI-Based Cloud Network Intrusion Detection Model with anomaly visualization, threshold analysis and comparative model evaluation.

Day 3: EXPLAIN: Explainable AI, AWS ThreatIntelligence & Intelligent Security Monitoring

Focus: Integrate AI-based security predictions with explainable analytics, threat prioritization and interactive cloud security monitoring.

• Understand Amazon GuardDuty security findings, threat categories and severity levels.
• Explore affected cloud resources and security investigation workflows.
• Correlate prepared CloudTrail events with network-flow anomalies.
• Understand security incident investigation, alert prioritization and SOC workflows.
• Introduce Explainable AI (XAI) and its applications in cybersecurity.
• Apply SHAP for model interpretation and feature contribution analysis.
• Understand anomaly scores, security-risk indicators and false-positive identification.
• Integrate security-event datasets, intrusion predictions and model explanations.
• Develop interactive cloud security dashboards using Python and Plotly.
• Explore LLM-assisted security reporting, responsible AI and cloud security research challenges.

Hands-on:

Interpret selected model predictions using SHAP.Analyze prepared Amazon GuardDuty-style findings.Combine related sample security events into a unified investigation table.Generate a prioritized security alert report and investigation summary.

Tools: Python, Google Colab, Pandas, SHAP, Plotly and prepared AWS security findings

Important Dates

Workshop Outcomes

Fee Structure