Graph Neural Recognition of Malicious User Patterns in Cloud Systems via Attention Optimization

Abstract

To address the growing issue of malicious user behavior in cloud computing environments, this paper proposes a recognition algorithm based on an Improved Graph Attention Network (IGAT). The method leverages the structural modeling capability of graph neural networks for behavioral data. By introducing a Multi-Scale Neighbor Attention mechanism and a Context-Aware Attention Adjustment strategy, the model improves its ability to represent hidden abnormal relationships in user behavior graphs. The Multi-Scale Neighbor Attention mechanism builds neighbor information across different hop ranges. This enhances the global awareness of node representations. The Context-Aware Attention Adjustment strategy uses historical behaviors and interaction context to dynamically refine the original attention distribution. This improves the model's ability to capture complex behavioral semantics. The public UNSW-NB15 security dataset is used to construct user behavior graphs. A series of comparative and ablation experiments is conducted to evaluate the model. The proposed method demonstrates superior performance in terms of accuracy, F1-Score, and AUC. It is also tested under different attack types, node densities, and model complexities to assess its stability and efficiency. Experimental results show that the model offers strong detection ability and robustness. It also maintains good inference performance under resource constraints. These findings demonstrate their practical value for large-scale cloud platforms.