Part 1: Samsung Account Service AI SecOps — Detecting Evolving Threats with Multi-Agent Systems | Amazon Web Services

Samsung Account is a unified authentication platform connecting 2 billion users worldwide.

It handles 2.7 million requests per second continuously, 24/7.

AWS WAF produces 1–2 TB of logs daily, and Amazon CloudWatch logs are roughly ten times larger.

AWS WAF is the first line of defense; its log data feed security analysis and are core inputs for the AI SecOps system.

The service is targeted by credential stuffing, SMS and captcha bypasses, and L7 DDoS; rule-based/manual responses struggle with unknown attacks, so they pursued large-scale log analysis, rule-effectiveness validation, automation, and an AI-based approach.