TL;DR
A stacked ensemble ML model combining Random Forest and Logistic Regression and Logistic Regression as a meta-classifier, while Extreme Gradient Boosting as a meta-classifier is proposed in this study to improve software system cyberattack detection.
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
Abstract - Rising volumes of sophisticated cyber attacks have rendered conventional signature-driven security tools insufficient for protecting modern digital assets. This study introduces a multi-layered intelligent detection system that unites supervised learning, unsupervised anomaly analysis, and ensemble decision strategies to identify network intrusions, malicious software activity, and stealthy advanced persistent threats in near real time. The pipeline begins with rigorous data cleansing and feature refinement that combines mutual-information ranking with principal-component analysis. Classification is performed by a soft-voting ensemble of Random Forest, gradient-boosted trees (XGBoost), and a compact deep neural network. Parallel anomaly scoring is obtained from Isolation Forest and a reconstruction-error autoencoder trained solely on benign flows. Evaluation on the NSL-KDD, CIC-IDS2017 and UNSW-NB15 collections yields detection accuracy reaching 98.7 %, precision of 97.9 %, recall of 98.4 % and an F1-score of 98.1 %, accompanied by a low rate of false alarms. SHAP-based explanations are attached to every prediction, giving security analysts transparent insight into model behaviour. Comparative benchmarks against recent published methods confirm that the proposed architecture delivers both higher accuracy and practical deployability inside enterprise security operations centres. Key Words: network intrusion detection, ensemble machine learning, anomaly scoring, deep autoencoder, explainable artificial intelligence, cyber-attack classification, security operations.
A hybrid SDN-based IDS framework that integrates Generative Adversarial Networks (GANs) to handle imbalanced datasets, one-way ANOVA and Genetic Algorithm for feature selection, baseline classifier optimization using Grid Search and Explainable AI techniques to achieve robust, accurate, and interpretable intrusion detection.
A detailed overview of the security risks associated with adversarial attacks is offered, including evasion attacks carried out at inference time, data poisoning that corrupts the training process, backdoor insertion that hides dormant triggers inside a model, and model inversion that leaks private information back out of a trained system.
The review explores the key adversarial attack classes: poisoning, evasion, model extraction, model extraction, model inversion, and membership inference and also white-box, black-box, and grey-box threat models.
Distributed Denial-of-Service (DDoS) attacks remain among the most disruptive threats to modern network infrastructure, with adversaries continually adapting their strategies to overwhelm cloud platforms, Internet-of-Things (IoT) deployments, and Software-Defined Network (SDN) environments. Traditional signature-based intrusion detection systems exhibit inherent inflexibility against novel attack vectors, motivating a shift toward intelligent, data-driven defense mechanisms. This paper presents an intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies. Evaluated on the CICDDoS2019, NSL-KDD, and UNSW-NB15 benchmark datasets, the proposed hybrid framework incorporating XGBoost and a Bidirectional LSTM model achieves a classification accuracy of 99.31%, a precision of 99.18%, a recall of 99.27%, and an F1-score of 99.22%, outperforming standalone classifiers while sustaining sub-millisecond detection latency under realistic traffic loads. SDN-assisted rule insertion further reduces the mean mitigation response time to 8.4 ms. The results affirm the viability of deploying intelligent, explainable ML-based defense pipelines in production-grade network environments.