Aug 2026· Discover Computing· Vol 29· 0 citations· 87 references
TL;DR
ShieldDRLNet is a hybrid deep reinforcement learning framework for proactive cloud-network intrusion detection that employs a convolutional neural network and a long short-term memory encoder to obtain a spatiotemporal traffic representation and uses a Double Deep Q-Network agent for adaptive sequential decision-making.
Abstract
Traditional signature-based and static machine-learning-based intrusion detection systems (IDSs) have limited ability to adapt to changing traffic characteristics, and dynamic cloud-based infrastructures are increasingly vulnerable to new and zero-day attacks. Given this drawback, this study aims to develop a hybrid deep reinforcement learning framework for proactive cloud-network intrusion detection, called ShieldDRLNet. It employs a convolutional neural network and a long short-term memory encoder to obtain a spatiotemporal traffic representation and uses a Double Deep Q-Network agent for adaptive sequential decision-making. It features a latency-aware reward function that optimizes the detection correctness, reduces false alarms, penalizes for missed attacks and optimizes the response time. Training stability is achieved by using experience replay and target network updates. Experiments conducted at CICIDS2017 demonstrate that the accuracy, precision, recall, and F1-score of ShieldDRLNet are 97.2%, 95.6%, 96.8%, and 96.2%, respectively, with an average end-to-end detection latency of 4.7 ms per traffic window. It achieves better performance than the classical machine-learning, deep-learning, Transformer and reinforcement-learning baselines, following a shared chronological evaluation protocol. The proposed components also contribute to and generalize the results of ablation, sensitivity and statistical analyses, as well as cross-dataset analyses with UNSW-NB15. The results provide an encouraging deployment-oriented solution to low latency and adaptive intrusion detection in dynamic cloud environments for ShieldDRLNet.
The findings confirm that the proposed IDSaaS framework provides an efficient, scalable, and adaptive solution for real-time cloud intrusion detection and significantly enhances the reliability and resilience of modern cloud and industrial cybersecurity infrastructures.
Unik B. Lokhande, Kavita Sonawane· Journal of Cloud Computing· 0 citations
Distributed Denial-of-Service (DDoS) attacks are constantly growing in scale, intensity, and attack plan strategies, which are causing significant threats to the heterogeneous network environments, including Internet of Things, edge, cloud, Software-Defined Networks, and 5G networks. This paper presents an adaptive framework of deep reinforcement learning (DRL) in early-stage detection and proactive mitigation of DDoS attacks. The proposed DRL agent operates in active network environments to develop policies through online learning. This helps it address new and unexpected attack patterns. Traditional machine learning and deep learning models depend on unchanging training methods, which run their training process from a fixed point in time. The framework combines the flow-level feature analysis and the packet-level feature analysis with the Deep Q-Network–based learning mechanism to facilitate real-time decision-making. Numerous experiments were carried out on benchmark datasets and heterogeneous traffic simulations. This indicates that the suggested methodology can be considered stable and offers an approximation of 98% accuracy, 96% precision, 96% recall, and 96% macro F1-score on the datasets with up to 300,000 network flows. Further flow analysis shows that flow duration, packet-level variability, and distribution of destination ports are critical in differentiating between benign and malicious traffic. The findings prove that the developed framework can offer detection and mitigation of DDoS threats, which are scalable, robust, and adaptive, to facilitate the creation of intelligent and self-educating cybersecurity systems in complex network settings.
Received: 6 March 2026 | Revised: 3 June 2026 | Accepted: 23 June 2026
Conflicts of Interest
The authors declare that they have no conflicts of interest to this work.
Data Availability Statement
The datasets used in this study, including CICDDoS2019, NSL-KDD, and UNSW-NB15, are publicly available through their respective repositories. The implementation details, preprocessing procedures, model configurations, and experimental settings are described within the manuscript to facilitate reproducibility. The source code and trained model configurations are available from the corresponding author upon reasonable request and will be considered for public repository release in future work to further enhance research transparency and reproducibility or can be accessed at https://www.kaggle.com/datasets/dhoogla/cicddos2019, https://www.kaggle.com/datasets/hassan06/nslkdd, and https://www.kaggle.com/datasets/mrwellsdavid/unswnb15.
Author Contribution Statement
Sujit Sutradhar: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Resources, Data curation, Writing – original draft, Writing – review & editing, Visualization, Project administration. Joy Lal Sarkar: Writing – review & editing, Visualization, Supervision, Project administration. Abhijit Biswas: Writing – review & editing, Supervision, Project administration.
Sujit Sutradhar, Joy Lal Sarkar, Abhijit Biswas· Journal of Data Science and...· 0 citations
An Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks, Dense Neural Networks, Transformers, XGBoost, and Random Forests is introduced.
SmartVille is introduced, a framework for formulating and studying deep learning-based NID under online, open-world, and multi-modal assumptions, and providing a principled way to design, train, and benchmark adaptive NID models under realistic assumptions while separating the theoretical contribution from its open-source implementation.
J. F. C. Moreno, A. Rizzardi, S. Sicari et al.· Journal of Network and Syste...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
The increasing adoption of cloud computing introduces security challenges due to dynamic network traffic. Traditional intrusion detection systems and single-model machine learning (ML) approaches struggle to detect sophisticated cyberattacks and adapt to changing patterns. This study proposes an Adaptive Hybrid Random Forest (RF) - LSTM Framework for Network Anomaly Detection in Dynamic Cloud Environments, designed to leverage the complementary strengths of ML and deep learning (DL) techniques for enhanced anomaly detection performance. Using the CICIDS2017 dataset, preprocessing included data cleaning, feature encoding, normalization, feature selection, and sequence generation. RF handled feature importance ranking and classification, while LSTM captured temporal dependencies. Their outputs were integrated via a weighted fusion mechanism with an adaptive strategy that dynamically adjusts model contributions based on prediction performance.
Experimental results showed RF achieved 99.99% precision; 99.98% across accuracy, recall, F1-score, and ROC-AUC. LSTM achieved 99.84% accuracy, 99.90% precision, 99.73% recall, 99.82% F1-score, and 99.83% ROC-AUC. The hybrid framework further improved performance to 99.96% across accuracy, precision, and ROC-AUC, 99.94% recall, and 99.95% F1-score. ROC analysis showed near-perfect class discrimination, and the adaptive weighting responded well to changing traffic. Statistical validation (Shapiro–Wilk and Wilcoxon signed-rank tests) confirmed that improvements were significant. The results show that the suggested Adaptive Hybrid Framework successfully integrates temporal sequence modeling, adaptive decision fusion, and feature-based learning to produce extremely reliable and accurate anomaly detection in dynamic cloud environments. By increasing detection reliability while preserving flexibility in response to changing cyberthreats, the framework provides a viable way to improve cloud security.
V. A. Tamakloe, Donald Terdoo Jam· FUDMA Journal of Sciences· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
