Recently cloud computing has emerged the IT world. It eventually promoted the acquisition of resources and services as needed, but it has also instilled fear and user’s renunciations. However, Machine learning processing has proven high robustness in solving security flaws and reducing false alarm rates in detecting attacks. This paper, proposes a hybrid system that does not only labels behaviors based on machine learning algorithms using both misuse and anomaly-detection, but also highlights correlations between network relevant features, speeds up the updating of signatures dictionary and upgrades the analysis of user behavior.