Detecting the Abuse of Cloud Services for C&C Infrastructure Through Dynamic Analysis and Machine Learning

Aug 5, 2026

Upload by Liam

Cybercriminals increasingly misuse cloud and legitimate services as covert command and control (C&C) infrastructure to coordinate malicious operations and evade security monitoring. The paper presents a detection system that combines dynamic analysis with machine learning to differentiate benign from malicious cloud interactions. A comprehensive VirusTotal-derived dataset supports feature extraction from host behavior and network traffic using Cuckoo and Triage sandboxes. Results show nearly 98% accuracy and stronger robustness against adversarial attacks that manipulate feature values.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Abstract

Index Terms

Introduction

ORCA – Online Research @ Cardiff This is an Open Access document downloaded from ORCA, Cardiff University's institutional repository:[https://orca.cardiff.ac.uk/id/eprint/174655/](https://orca.cardiff.ac.uk/id/eprint/174655/) This is the author’s version of a work that was submitted to / accepted for publication. Citation for final published version: Al Lelah, Turki, Theodorakopoulos, George , Javed, Amir and Anthi, Eirini 2024. Detecting the abuse of cloud services for C&C infrastructure through dynamic analysis and machine learning. Presented at: 2024 International Symposium on Networks, Computers and Communications (ISNCC), Washington DC, USA, 22-25 October 2024. 2024 International Symposium on Networks, Computers and Communications (ISNCC) . IEEE, pp. 1-7. 10.1109/isncc62547.2024.10758940 Publishers page: [https://doi.org/10.1109/isncc62547.2024.10758940](https://doi.org/10.1109/isncc62547.2024.10758940) Please note: Changes made as a result of publishing processes such as copy-editing, formatting and page numbers may not be reflected in this version. For the definitive version of this publication, please refer to the published source. You are advised to consult the publisher’s version if you wish to cite this paper. This version is being made available in accordance with publisher policies. See [http://orca.cf.ac.uk/policies.html](http://orca.cf.ac.uk/policies.html) for usage policies. Copyright and moral rights for publications made available in ORCA are retained by the copyright holders. Detecting the Abuse of Cloud Services for C&C Infrastructure Through Dynamic Analysis and Machine Learning Turki Al lelah, George Theodorakopoulos, Amir Javed, Eirini Anthi School of Computer Science and Informatics Cardiff University Cardiff, UK Email: {allelaht,theodorakopoulosg,javeda7,[anthies](anthies}@cardiff.ac.uk)[}](anthies}@cardiff.ac.uk)[@cardiff.ac.uk](anthies}@cardiff.ac.uk) Abstract—Cybercriminals increasingly abuse cloud and legitimate services (CLS) as covert command and control (C&C) infrastructure to orchestrate malicious operations and evade detection. This paper addresses the critical challenge of detecting such abuse of cloud platforms. We introduce a detection system that integrates dynamic analysis with Machine Learning (ML) to accurately distinguish between benign and malicious interactions with cloud services. By utilising a comprehensive data set from VirusTotal, the system uses advanced feature extraction techniques from both host behaviour and network traffic, using Cuckoo and Triage sandboxes to extract behaviors, to develop a detection model. The results demonstrate that the model achieves nearly 98% accuracy in identifying cloud service abuse, substantially outperforming previous efforts. Furthermore, we evaluate the model’s robustness against adversarial attacks that aim to decrease accuracy by manipulating the feature values. Comparative evaluations show that our method maintains a higher detection accuracy under attack compared to related systems. Index Terms—Cloud computing security, Command and control, Malware detection, Machine learning, Dynamic analysis, Adversarial machine learning attack I. INTRODUCTION The digital landscape is undergoing a rapid transformation, highlighted by the increasing reliance on cloud and legitimate services (CLS) in critical sectors such as healthcare, finance, education and government. This dependence is driving the global public cloud services market towards an anticipated value of $2.5 trillion by 2031, according to research by Allied Market Research (AMR) [1], up from $551.8 billion in 2021 . CLS deployment can save organisations more than 35% of their annual operating costs. By 2028, cloud computing will shift from being a technology disruptor to becoming a necessary component for maintaining business competitiveness. Gartner [2] predicts that more than 50% of enterprises will use industry cloud platforms by 2028 to accelera

FAQs

What problem does the paper address?

The paper addresses detecting abuse of cloud and legitimate services when they are used as covert command and control (C&C) infrastructure to orchestrate malicious activity and evade detection.

How does the proposed detection system work?

It integrates dynamic analysis with machine learning, extracting features from host behavior and network traffic using Cuckoo and Triage sandboxes to distinguish benign and malicious interactions.

How effective is the method and how is robustness evaluated?

The model achieves nearly 98% accuracy and is evaluated for robustness against adversarial attacks designed to reduce accuracy by manipulating feature values, where comparative results show improved detection under attack.

Aug 5, 2026

Upload by Liam