Adaptive Hybrid Random Forest–Lstm Framework for Network Anomaly Detection in Dynamic Cloud Environments

Abstract

The increasing adoption of cloud computing introduces security challenges due to dynamic network traffic. Traditional intrusion detection systems and single-model machine learning (ML) approaches struggle to detect sophisticated cyberattacks and adapt to changing patterns. This study proposes an Adaptive Hybrid Random Forest (RF) - LSTM Framework for Network Anomaly Detection in Dynamic Cloud Environments, designed to leverage the complementary strengths of ML and deep learning (DL) techniques for enhanced anomaly detection performance. Using the CICIDS2017 dataset, preprocessing included data cleaning, feature encoding, normalization, feature selection, and sequence generation. RF handled feature importance ranking and classification, while LSTM captured temporal dependencies. Their outputs were integrated via a weighted fusion mechanism with an adaptive strategy that dynamically adjusts model contributions based on prediction performance. Experimental results showed RF achieved 99.99% precision; 99.98% across accuracy, recall, F1-score, and ROC-AUC. LSTM achieved 99.84% accuracy, 99.90% precision, 99.73% recall, 99.82% F1-score, and 99.83% ROC-AUC. The hybrid framework further improved performance to 99.96% across accuracy, precision, and ROC-AUC, 99.94% recall, and 99.95% F1-score. ROC analysis showed near-perfect class discrimination, and the adaptive weighting responded well to changing traffic. Statistical validation (Shapiro–Wilk and Wilcoxon signed-rank tests) confirmed that improvements were significant. The results show that the suggested Adaptive Hybrid Framework successfully integrates temporal sequence modeling, adaptive decision fusion, and feature-based learning to produce extremely reliable and accurate anomaly detection in dynamic cloud environments. By increasing detection reliability while preserving flexibility in response to changing cyberthreats, the framework provides a viable way to improve cloud security.