Building a Real-Time Anomaly Detection Daemon for a Live Cloud Storage Platform

How we protected a Nextcloud instance against unpredictable attack traffic by building an adaptive, stateful Python daemon that learns what normal looks like — and responds automatically when it doesn't The Problem Cloud storage platforms are an attractive target. They hold files, credentials, and session tokens. They run 24/7. And because they are public-facing by design, distinguishing a legitimate user from an attacker is not a firewall rule you can write once and forget. The constraint for t