Cloud-Driven Threat Reconstruction Using Generative AI and Semantic Intelligence Across Distributed Enterprise Networks

Abstract

The increasing complexity of distributed enterprise networks has created significant challenges in identifying, investigating, and reconstructing sophisticated cybersecurity threats. Traditional security investigation techniques frequently depend on isolated security logs, predefined detection rules, and manual correlation processes, limiting their ability to identify complex attack sequences across hybrid and multi-cloud environments. This research proposes a cloud-driven threat reconstruction framework integrating Generative Artificial Intelligence (GenAI), semantic intelligence, and distributed security analytics to improve enterprise threat investigation. The proposed framework collects heterogeneous security information from cloud infrastructure, network devices, applications, identity management systems, and endpoint protection platforms. Semantic intelligence transforms collected security events into contextual relationships, enabling the identification of attack patterns, suspicious activities, and relationships between interconnected infrastructure components. Generative AI enhances investigation by correlating security evidence, reconstructing potential attack sequences, generating contextual incident explanations, and supporting automated threat intelligence analysis. A knowledge graph-based representation enables relationships among attackers, vulnerabilities, affected resources, and attack techniques to be examined systematically. The framework additionally incorporates explainable AI, continuous monitoring, and evidence validation to improve investigation transparency and reliability. The proposed approach aims to strengthen enterprise cyber resilience through faster incident reconstruction, improved threat visibility, and intelligent security decision-making across distributed cloud environments.