Advanced cloud intrusion detection framework using graph based features transformers and contrastive learning.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Cloud environments face complex and evolving cyber threats.
• Traditional intrusion detection systems struggle with the scale and dynamism of cloud networks.
• Effective detection requires advanced methods to analyze intricate network traffic patterns.

Purpose of the Study:

• To develop a modular and scalable intrusion detection framework for cloud environments.
• To enhance detection accuracy and efficiency using advanced machine learning techniques.
• To provide an interpretable and practical solution for real-time threat identification.

Main Methods:

• Modeling network flows as graphs to capture relational patterns.
• Utilizing Graph Neural Networks (GNNs) for structured embedding extraction.
• Employing Transformer-based autoencoders and contrastive learning for refined feature representation and classification.
• Evaluating the framework on NSL-KDD and CIC-IDS2018 datasets.

Main Results:

• Achieved an average accuracy of 99.97% across binary and multi-class scenarios.
• Demonstrated high precision and recall for all attack types, including minority classes (e.g., U2R, R2L).
• Exhibited low false-positive rates and real-time inference capabilities with modest resource usage.

Conclusions:

• The proposed framework offers a robust and accurate solution for intrusion detection in cloud networks.
• The integration of graph-based features, autoencoders, and contrastive learning significantly improves detection performance.
• The system's interpretability (via SHAP) and efficiency support its practical deployment in high-throughput environments.