A two-stage generative-AI fusion intrusion detection system for calibrated and reliable cloud security

The rapid expansion of cloud computing has significantly increased the scale, sophistication, and frequency of cyber threats, making reliable intrusion detection essential for secure cloud environments. However, conventional single-stage intrusion detection systems exhibit high false-positive rates, poor probability calibration, and degraded performance under severe class imbalance, thereby limiting their real-world deployment. This paper proposes a novel two-stage Generative-AI fusion intrusion detection model that integrates discriminative and generative learning to enhance predictive reliability and decision confidence. In the first stage, a binary classifier combining a Feature-Token Transformer and a Variational Autoencoder differentiates normal from malicious traffic using class-balanced focal loss and a precision-oriented routing threshold to minimize false alarms while preserving detection sensitivity. In the second stage, detected attack samples are forwarded to a conditional multi-class classifier for fine-grained attack categorization, incorporating SMOTE-based rebalancing, class-balanced focal loss, and class-specific threshold optimization to improve minority-class detection. The post-hoc temperature scaling is applied at both stages to produce well-calibrated probability estimates and support risk-aware decision-making. The performance of the proposed model measured on the UNSW-NB15 and NSL-KDD benchmark datasets indicate that proposed model performed well as compared to the single-stage Generative-AI fusion and evolutionary feature-selection baselines model and obtained the accuracy score of 94.03% and 77.07%, respectively to delivered the improved calibration and reduced false-alarm, and provide the robust and deployment-ready solution for modern cloud security.