The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.
Abstract
Cloud computing environments are increasingly vulnerable to sophisticated cyber threats due to the rapid growth of cloud-native infrastructures, high-volume network traffic, and evolving attack strategies such as zero-day exploits, adversarial attacks, and polymorphic malware. Traditional intrusion detection systems often struggle to maintain high detection accuracy, scalability, adversarial robustness, and real-time processing capability in dynamic cloud environments. To address these challenges, this study proposes an adaptive Intrusion Detection System-as-a-Service (IDSaaS) framework using a Modified Attention-Gate based BiLSTM-GRU architecture integrated with GAN-assisted synthetic anomaly generation. The proposed framework combines Bidirectional Long Short-Term Memory networks for temporal dependency learning, Gated Recurrent Units for computational efficiency, a custom attention mechanism for dynamic feature prioritization, a modified recurring gate structure for optimized information retention, and a Revamping Input Sequence Weighing Structure (RISWS) loss function for improved anomaly classification performance. Experiments were conducted using the CICIDS-2018, UNSW-NB15, SCAPY-based, and SCADANet datasets within an AWS cloud deployment environment. The proposed model achieved strong intrusion detection performance with 97.91% multi-class detection accuracy, 98.67% precision, 97.93% recall, and 98.18% F1-score while maintaining low inference latency and high throughput suitable for real-time deployment. Additional evaluation on the SCADANet industrial cybersecurity dataset achieved 99.69% test accuracy, further validating the adaptability of the framework across heterogeneous cloud and industrial network environments. Throughput analysis demonstrated stable processing capability of approximately 48,000 packets per second and 12,500 flows per second under high traffic conditions. The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.
Traditional signature-based and static machine-learning-based intrusion detection systems (IDSs) have limited ability to adapt to changing traffic characteristics, and dynamic cloud-based infrastructures are increasingly vulnerable to new and zero-day attacks. Given this drawback, this study aims to develop a hybrid deep reinforcement learning framework for proactive cloud-network intrusion detection, called ShieldDRLNet. It employs a convolutional neural network and a long short-term memory encoder to obtain a spatiotemporal traffic representation and uses a Double Deep Q-Network agent for adaptive sequential decision-making. It features a latency-aware reward function that optimizes the detection correctness, reduces false alarms, penalizes for missed attacks and optimizes the response time. Training stability is achieved by using experience replay and target network updates. Experiments conducted at CICIDS2017 demonstrate that the accuracy, precision, recall, and F1-score of ShieldDRLNet are 97.2%, 95.6%, 96.8%, and 96.2%, respectively, with an average end-to-end detection latency of 4.7 ms per traffic window. It achieves better performance than the classical machine-learning, deep-learning, Transformer and reinforcement-learning baselines, following a shared chronological evaluation protocol. The proposed components also contribute to and generalize the results of ablation, sensitivity and statistical analyses, as well as cross-dataset analyses with UNSW-NB15. The results provide an encouraging deployment-oriented solution to low latency and adaptive intrusion detection in dynamic cloud environments for ShieldDRLNet.
S. Venkatramulu, Anitha Patil, K. R. Pradeep et al.· Discover Computing· 0 citations
With the widespread adoption of cloud computing, securing enterprise networks against cyber threats has become increasingly important. Cloud environments are highly dynamic and constantly changing, making them susceptible to sophisticated cyberattacks that traditional Intrusion Detection Systems (IDS) often fail to detect. This study focuses on Intelligent Intrusion Detection Systems (IIDS) and their critical role in strengthening cloud security. Unlike conventional signature-based IDS that rely on fixed attack patterns, IIDS employ advanced Machine Learning (ML) and Artificial Intelligence (AI) techniques including deep learning, decision trees, and ensemble models to identify both known and emerging threats with greater accuracy. The paper proposes an integrated framework that combines real-time anomaly detection with automated response capabilities for cloud networks. Key architectural elements of IIDS are examined, alongside major deployment challenges such as scalability, false-positive rates, and computational requirements. Additionally, practical case studies and performance evaluations illustrate how IIDS enhance threat detection by improving accuracy, adaptability, and efficiency. Finally, the paper outlines future research directions to further advance IIDS capabilities and address the evolving security needs of modern cloud infrastructures.
R. Velu· 2026 4th International Confe...· 0 citations
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.
The rapid growth of heterogeneous network environments such as the Internet of Things (IoT), Industrial IoT (IIoT), cloud computing, and software‐defined networks has significantly increased exposure to sophisticated cyberattacks, making intrusion detection a critical component of modern cybersecurity infrastructures. Traditional intrusion detection systems and conventional machine learning techniques often face limitations when handling high‐dimensional network traffic, class imbalance, and evolving attack patterns, resulting in reduced detection performance and limited scalability under complex network environments. These challenges reduce their effectiveness in practical, large‐scale deployments. To overcome these issues, this paper proposes a hybrid intrusion detection framework based on an Autoencoder and a TabTransformer, optimized using the Whale Optimization Algorithm (WOA). The Autoencoder is employed to perform unsupervised feature learning, transforming high‐dimensional network traffic data into compact and noise‐resistant latent representations. These latent features are then processed by the TabTransformer, which utilizes multi‐head self‐attention to capture complex inter‐feature relationships and enhance classification performance. The WOA is incorporated to automatically optimize key hyperparameters, improving convergence speed, stability, and generalization capability of the model. The proposed framework is primarily evaluated using the CIC‐IDS2018 benchmark dataset. In addition, supplementary cross‐dataset validation on the CIC‐IDS2017 and UNSW‐NB15 datasets is conducted to assess the generalization capability of the proposed framework. Experimental results demonstrate that the proposed model achieves an accuracy of 99.87%, precision of 99.85%, recall of 99.88%, and an F1‐score of 99.86% while maintaining very low false alarm and false negative rates. Comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method. Overall, the Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations