Multi-domain marker aggregation for threat detection in cloud environments

Cloud computing environments present complex security challenges, generating vast volumes of heterogeneous telemetry data across interconnected services. Current threat detection systems typically operate in isolation for specific data domains, failing to capture the holistic view necessary for identifying sophisticated attacks that traverse different cloud resources. This paper addresses a fundamental challenge: how to effectively combine predictions from different threat detection methods applied to various data domains to provide comprehensive security assessments. We propose a novel framework, MarkerFusion, that conceptualizes individual detection components as markers with varying applicability across domains. Our approach models the conditional distribution of markers and latent labels using a Gibbs distribution and develops a learning algorithm that systematically combines information from multiple markers while enabling knowledge transfer across contexts. The framework naturally accommodates both unsupervised and semi-supervised settings, allowing domain experts to contribute partial labels when available. Extensive experiments on 15 public datasets and Amazon proprietary data demonstrate that our method outperforms seven established approaches, improving accuracy by 9.95% compared to the second-best baselines. The framework has been successfully deployed at global scale as part of Amazon GuardDuty, processing billions of security alerts monthly and generating high-confidence attack findings.