An adaptive federated learning framework with tenant-aware non-IID partitioning and LLM-narrated explainability for multi-tenant cloud intrusion detection
Multi-tenant cloud environments generate heterogeneous, privacy-sensitive traffic that cannot be centralised for intrusion analysis. Conventional intrusion detection systems require raw data aggregation, while standard federated learning degrades under non-IID (non-independent and identically distributed) conditions and produces opaque numeric attributions that hinder analyst response. This paper introduces CloudTenantShield, a three-tier framework combining FedProx-based federated learning, a bidirectional LSTM detection engine, and a locally deployed TinyLLaMA large language model (LLM) narrative explainability moule. Five tenant partitions with deliberately heterogeneous attack distributions simulate realistic multi-tenant conditions. The FedProx proximal term stabilises convergence under non-IID skew, while the LLM converts numerical alert features into actionable natural-language explanations for security operations centre (SOC) analysts, reducing cognitive load and enabling faster alert triage. Evaluated on CICIDS2017 (15 classes, multi-seed) and CICIoT2023 (34 IoT-specific classes), CloudTenantShield achieves 97.87% ± 0.06% accuracy and weighted F1 of 0.9780 ± 0.0007 on CICIDS2017, and 96.43% ± 0.04% accuracy on CICIoT2023 (five seeds). Across both datasets the framework incurs less than 1 percentage-point gap relative to the centralised upper bound and outperforms standard FedAvg by over 2 percentage points. Two-sample paired t-tests (\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$p<0.0001$$\end{document}) confirm all CICIDS2017 improvements. A rubric-based evaluation of 50 LLM narratives confirms content faithfulness; a controlled SOC user study is identified as essential future validation. These results align with UN SDG 9 on resilient and inclusive digital infrastructure.