{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T01:39:30Z","timestamp":1767836370966,"version":"3.49.0"},"reference-count":31,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2025,11,23]],"date-time":"2025-11-23T00:00:00Z","timestamp":1763856000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"EU NextGenerationEU through the Recovery and Resilience Plan for Slovakia","award":["09I05-03-V02-00012"],"award-info":[{"award-number":["09I05-03-V02-00012"]}]},{"name":"Improving the quality of education in the field of cyber security","award":["004ZU-4\/2024"],"award-info":[{"award-number":["004ZU-4\/2024"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Modern on-premises threat detection increasingly relies on deep learning over network and system logs, yet organizations must balance infrastructure and resource constraints with maintainability and performance. We investigate how adopting MLOps influences deployment and runtime behavior of a recurrent-neural-network\u2013based detector for malicious event sequences. Our investigation includes surveying modern open-source platforms to select a suitable candidate, its implementation over a two-node setup with a CPU-centric control server and a GPU worker and performance evaluation for a containerized MLOps-integrated setup vs. bare metal. For evaluation, we use four scenarios that cross the deployment model (bare metal vs. containerized) with two different versions of software stack, using a sizable training corpus and a held-out inference subset representative of operational traffic. For training and inference, we measured execution time, CPU and RAM utilization, and peak GPU memory to find notable patterns or correlations providing insights for organizations adopting the on-premises-first approach. Our findings prove that MLOps can be adopted even in resource-constrained environments without inherent performance penalties; thus, platform choice should be guided by operational concerns (reproducibility, scheduling, tracking), while performance tuning should prioritize pinning and validating the software stack, which has surprisingly large impact on resource utilization and execution process. Our study offers a reproducible blueprint for on-premises cyber-analytics and clarifies where optimization yields the greatest return.<\/jats:p>","DOI":"10.3390\/computers14120506","type":"journal-article","created":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T13:09:25Z","timestamp":1763989765000},"page":"506","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Evaluating Deployment of Deep Learning Model for Early Cyberthreat Detection in On-Premise Scenario Using Machine Learning Operations Framework"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-6818-4673","authenticated-orcid":false,"given":"Andrej","family":"Ralbovsk\u00fd","sequence":"first","affiliation":[{"name":"Faculty of Informatics and Information Technologies, Slovak University of Technology in Bratislava, Ilkovicova 2, 842 16 Bratislava, Slovakia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1811-1580","authenticated-orcid":false,"given":"Ivan","family":"Kotuliak","sequence":"additional","affiliation":[{"name":"Faculty of Informatics and Information Technologies, Slovak University of Technology in Bratislava, Ilkovicova 2, 842 16 Bratislava, Slovakia"}]},{"given":"Dennis","family":"Sobolev","sequence":"additional","affiliation":[{"name":"Faculty of Informatics and Information Technologies, Slovak University of Technology in Bratislava, Ilkovicova 2, 842 16 Bratislava, Slovakia"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Ralbovsk\u00fd, A., and Kotuliak, I. (2025, January 14\u201316). Early Detection of Malicious Activity in Log Event Sequences Using Deep Learning. Proceedings of the 2025 37th Conference of Open Innovations Association (FRUCT), Narvik, Norway.","DOI":"10.23919\/FRUCT65909.2025.11008245"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"31866","DOI":"10.1109\/ACCESS.2023.3262138","article-title":"Machine Learning Operations (MLOps): Overview, Definition, and Architecture","volume":"11","author":"Kreuzberger","year":"2023","journal-title":"IEEE Access"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Khan, A., and Mohamed, A. (2025). Optimizing Cybersecurity Education: A Comparative Study of On-Premises and Cloud-Based Lab Environments Using AWS EC2. Computers, 14.","DOI":"10.3390\/computers14080297"},{"key":"ref_4","unstructured":"Amazon (2025, March 10). What Is MLOps?\u2014Machine Learning Operations Explained\u2014AWS. Available online: https:\/\/aws.amazon.com\/what-is\/mlops\/."},{"key":"ref_5","first-page":"2494","article-title":"Hidden Technical Debt in Machine Learning Systems","volume":"28","author":"Sculley","year":"2015","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Horvath, K., Abid, M.R., Merino, T., Zimmerman, R., Peker, Y., and Khan, S. (2024). Cloud-Based Infrastructure and DevOps for Energy Fault Detection in Smart Buildings. Computers, 13.","DOI":"10.3390\/computers13010023"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Subramanya, R., Sierla, S., and Vyatkin, V. (2022). From DevOps to MLOps: Overview and Application to Electricity Market Forecasting. Appl. Sci., 12.","DOI":"10.3390\/app12199851"},{"key":"ref_8","unstructured":"Skogstr\u00f6m, H. (2025, March 10). What Is The Difference Between DevOps And MLOps?. Available online: https:\/\/valohai.com\/blog\/difference-between-devops-and-mlops\/."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3708497","article-title":"Towards Trustworthy Machine Learning in Production: An Overview of the Robustness in MLOps Approach","volume":"57","author":"Bayram","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_10","unstructured":"(2025, March 10). Key Requirements for an MLOps Foundation. Available online: https:\/\/cloud.google.com\/blog\/products\/ai-machine-learning\/key-requirements-for-an-mlops-foundation."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Symeonidis, G., Nerantzis, E., Kazakis, A., and Papakostas, G.A. (2022, January 26\u201329). MLOps\u2014Definitions, Tools and Challenges. Proceedings of the 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), Virtual.","DOI":"10.1109\/CCWC54503.2022.9720902"},{"key":"ref_12","unstructured":"Hewage, N., and Meedeniya, D. (2022). Machine Learning Operations: A Survey on MLOps Tool Support. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Amou Najafabadi, F., Bogner, J., Gerostathopoulos, I., and Lago, P. (2024, January 3\u20136). An Analysis of MLOps Architectures: A Systematic Mapping Study. Proceedings of the Software Architecture: 18th European Conference, ECSA 2024, Luxembourg.","DOI":"10.1007\/978-3-031-70797-1_5"},{"key":"ref_14","unstructured":"Chen, Z., Liu, J., Gu, W., Su, Y., and Lyu, M.R. (2022). Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection. arXiv."},{"key":"ref_15","unstructured":"Partida, D. (2025, March 10). Integrating Machine Learning Techniques for Real-Time Industrial Threat Detection. Available online: https:\/\/gca.isa.org\/blog\/integrating-machine-learning-techniques-for-real-time-industrial-threat-detection."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Togbe, M.U., Chabchoub, Y., Boly, A., Barry, M., Chiky, R., and Bahri, M. (2021). Anomalies Detection Using Isolation in Concept-Drifting Data Streams. Computers, 10.","DOI":"10.3390\/computers10010013"},{"key":"ref_17","first-page":"2023","article-title":"A Review of Enhancing Intrusion Detection Systems for Cybersecurity Using Artificial Intelligence (AI)","volume":"29","author":"Markevych","year":"2023","journal-title":"Int. Conf. Knowl. Based Organ."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. Proceedings of the Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10\u201316). Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. Proceedings of the Proceedings of the 28th International Joint Conference on Artificial Intelligence, Macao, China.","DOI":"10.24963\/ijcai.2019\/658"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., and Zhang, W. (2021, January 22\u201330). Semi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation. Proceedings of the 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE), Madrid, Spain.","DOI":"10.1109\/ICSE-Companion52605.2021.00106"},{"key":"ref_21","unstructured":"(2025, March 10). Kubeflow Documentation. Available online: https:\/\/www.kubeflow.org\/docs\/."},{"key":"ref_22","unstructured":"(2025, March 10). ClearML Documentation. Available online: https:\/\/clear.ml\/docs\/latest\/docs\/."},{"key":"ref_23","unstructured":"(2025, March 13). Documentation. Available online: https:\/\/mlflow.org\/docs\/latest\/index.html."},{"key":"ref_24","unstructured":"Boyang, Y. (2024). MLOPS in a multicloud environment: Typical Network Topology. arXiv."},{"key":"ref_25","unstructured":"(2025, March 10). Scanning AI Production Pipeline\u2014Neural Guard. Available online: https:\/\/clear.ml\/blog\/scanning-ai-production-pipeline-neural-guard."},{"key":"ref_26","unstructured":"ClearML (2025, March 10). ClearML Agent Documentation. Available online: https:\/\/github.com\/allegroai\/clearml-docs\/blob\/main\/docs\/clearml_agent.md."},{"key":"ref_27","unstructured":"(2025, March 10). ClearML GitHub Repository. Available online: https:\/\/github.com\/clearml\/clearml."},{"key":"ref_28","unstructured":"(2025, March 10). ClearML Agents and Queues Documentation. Available online: https:\/\/clear.ml\/docs\/latest\/docs\/fundamentals\/agents_and_queues."},{"key":"ref_29","unstructured":"(2025, March 10). Research Computing Services: Parallel Computing\u2014Speedup Limitations. Available online: https:\/\/researchcomputingservices.github.io\/parallel-computing\/02-speedup-limitations\/."},{"key":"ref_30","unstructured":"Chen, X., Wu, Y., Xu, L., Xue, Y., and Li, J. (2009, January 2\u20134). Para-Snort: A Multi-Thread on Multi-Core IA Platform. Proceedings of the IASTED International Conference on Parallel and Distributed Computing and Systems (PDCS), Cambridge, MA, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Bak, C.D., and Han, S.J. (2024, January 2\u20135). Efficient Scaling on GPU for Federated Learning in Kubernetes: A Reinforcement Learning Approach. Proceedings of the 2024 International Technical Conference on Circuits\/Systems, Computers, and Communications (ITC-CSCC), Okinawa, Japan.","DOI":"10.1109\/ITC-CSCC62988.2024.10628145"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/12\/506\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,24]],"date-time":"2025-11-24T13:26:19Z","timestamp":1763990779000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/12\/506"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,23]]},"references-count":31,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["computers14120506"],"URL":"https:\/\/doi.org\/10.3390\/computers14120506","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,23]]}}}