Generative Adversarial Networks for Hardening Cloud Intrusion Detection Systems

Adaptive intrusion detection system for cloud security using deep learning

Cloud computing environments are increasingly vulnerable to sophisticated cyber threats due to the rapid growth of cloud-native infrastructures, high-volume network traffic, and evolving attack strategies such as zero-day exploits, adversarial attacks, and polymorphic malware. Traditional intrusion detection systems often struggle to maintain high detection accuracy, scalability, adversarial robustness, and real-time processing capability in dynamic cloud environments. To address these challenges, this study proposes an adaptive Intrusion Detection System-as-a-Service (IDSaaS) framework using a Modified Attention-Gate based BiLSTM-GRU architecture integrated with GAN-assisted synthetic anomaly generation. The proposed framework combines Bidirectional Long Short-Term Memory networks for temporal dependency learning, Gated Recurrent Units for computational efficiency, a custom attention mechanism for dynamic feature prioritization, a modified recurring gate structure for optimized information retention, and a Revamping Input Sequence Weighing Structure (RISWS) loss function for improved anomaly classification performance. Experiments were conducted using the CICIDS-2018, UNSW-NB15, SCAPY-based, and SCADANet datasets within an AWS cloud deployment environment. The proposed model achieved strong intrusion detection performance with 97.91% multi-class detection accuracy, 98.67% precision, 97.93% recall, and 98.18% F1-score while maintaining low inference latency and high throughput suitable for real-time deployment. Additional evaluation on the SCADANet industrial cybersecurity dataset achieved 99.69% test accuracy, further validating the adaptability of the framework across heterogeneous cloud and industrial network environments. Throughput analysis demonstrated stable processing capability of approximately 48,000 packets per second and 12,500 flows per second under high traffic conditions. The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.

ADAPTIVE GAN-DRIVEN XGBOOST FRAMEWORK FOR REAL-TIME DETECTION OF EMERGING NETWORK INTRUSIONS

Background The fast rate at which cyber threats are evolving brings a lot of challenges to the conventional signature-based intrusion detection systems (IDS) that do not always identify new or zero-day attacks. The paper introduces an AI-based, adaptable Network Intrusion Detection System (NIDS) which, using Generative Adversarial Networks (GANs) with XGBoost, will enhance the detection of known and novel cyberattacks. Objective The suggested framework is designed to process network traffic data by preprocessing network traffic data, realistically simulates the samples of synthetic attacks based on a feature-driven GAN, and uses XGBoost as a powerful feature selection and classification tool. The system decreases the false positives and increases the detection of rare and previously unseen attacks by managing class imbalance. Results Large-scale experiments, using benchmark network intrusion datasets, reveal the proposed approach to be much better than the conventional machine learning and deep learning-based IDS models with regards to accuracy, precision, recall and F1-score. In addition, the framework facilitates dynamic learning in changing patterns of network traffic to allow real-time monitoring in dynamic environments. Conclusion Data augmentation using GAN and explainable XGBoost classification is a scalable, interpretable, and practical intelligent network security solution. This research contributes to the work on the creation of active, AI-based intrusion detection systems that can react to cybersecurity threats that change rapidly.

Adversarial Detection in Software Systems Using Stacked Ensemble Machine Learning Model

Detecting adversarial evasion in deep learning intrusion detection systems using explainable AI

Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.

Federated learning-driven cloud intrusion detection using transfer learning and ablation frigate-fairy hybrid optimization

Defending and mitigating the impact of targeted white-box adversarial attacks in computer network security

A detailed empirical assessment of targeted adversarial vulnerability and defensive behaviour in a multi-class NIDS setting is presented and the results highlight long-standing, class-specific, robustness gaps and provide insights that could be used to design more robust intrusion detection systems.