AI-Assisted Detection of Malicious Changes in Infrastructure-as-Code for Secure DevOps

Infrastructure-as-Code (IaC) has become the cornerstone of modern DevOps practices, enabling organizations to provision and manage cloud infrastructure through declarative configuration files. However, this paradigm introduces novel security challenges, as malicious modifications to IaC configurations can lead to catastrophic breaches affecting entire cloud deployments. Traditional static analysis tools fail to capture the semantic context and temporal patterns inherent in infrastructure changes, leaving organizations vulnerable to sophisticated supply chain attacks. In this paper, we propose a novel AI-assisted detection framework that combines Abstract Syntax Tree (AST) structural analysis with lightweight Large Language Model (LLM) embeddings to identify malicious changes in Terraform, Kubernetes, and GitHub Actions configurations. We collected 4,200 Infrastructure-as-Code change samples from 130 opensource repositories including Terraform (AWS/GCP), Kubernetes manifests, and GitHub Actions workflows. All samples were manually reviewed and labeled as benign, misconfiguration, or malicious by reviewers with cloud security experience. Our proposed LLM-AST fusion model achieves an F1 score of 0.92 and ROC-AUC of 0.94, significantly outperforming existing static analyzers and standalone deep learning approaches. The system integrates seamlessly into CI/CD pipelines, providing real-time risk scoring and actionable alerts for security teams.