Traditional machine learning methods like Support Vector Machines (SVMs), Decision Trees, Naïve Bayes, Random Forests, and Logistic Regression remain popular in intrusion detection due to their simplicity, interpretability, and low computational overhead. These models perform well on structured, preprocessed data, especially when attack patterns are linearly separable or rely on manual feature engineering. For example, Support Vector Machines (SVMs) excel in binary classification by optimizing decision boundaries but cannot capture temporal dependencies in cloud logs [13,14]. Logistic Regression is effective for lightweight detection in small-scale systems but struggles with complex attack patterns due to its linear nature [15]. Random Forests enhance generalization and noise resistance through ensemble learning [16]; however, they risk overfitting in high-dimensional data without regularization and lack the ability to model sequential patterns in API logs or network traffic.

Moreover, these models typically rely on independent and identically distributed (i.i.d.) data, which does not account for the dynamic, context-aware nature of modern cloud attacks. Although efficient, they struggle with adversarial inputs, multi-stage attacks, and shifting feature distributions across cloud tenants and services. They are often unable to process high-dimensional, sequential cloud logs effectively and tend to underfit in complex intrusion detection cases. Furthermore, they offer weak resistance to adversarial inputs and depend on static, manually defined features that perform poorly in evolving cloud environments. Ghazi et al. [17] applied a Support Vector Machine (SVM) for intrusion detection, achieving an accuracy of 82.3% with moderate scalability and low inference latency (2.8 ms). Despite its efficiency, the model’s lack of temporal sequence modeling limits its ability to capture evolving attack patterns in cloud environments.

While these models perform reasonably well under constrained settings, they remain limited in handling raw, high-dimensional and sequential cloud telemetry. They also lack mechanisms for adversarial robustness and temporal reasoning. Our proposed DL-HMM framework addresses these shortcomings by integrating LSTM-based deep feature learning with probabilistic state modeling, thereby enabling real-time, interpretable, and resilient cloud intrusion detection.

Deep learning has emerged as a powerful tool for analyzing high-dimensional cloud logs and network traffic due to its ability to automatically extract discriminative features without manual feature engineering. Recurrent neural networks (RNNs), particularly LSTMs, have demonstrated success in detecting sequential anomalies in system logs by Zhang et al. [18], achieving up to 87% F1-score on benchmark datasets like CIC-IDS2017. Transformers, with their self-attention mechanisms, have further improved detection accuracy by capturing long-range dependencies in cloud audit trails Liu et al. [19], reducing false positives by 15% compared to LSTMs.

However, these models exhibit critical weaknesses when deployed in adversarial settings. For instance, Chen et al. [20] demonstrated that even state-of-the-art LSTM-based detectors suffer a 40% drop in recall under carefully crafted evasion attacks, such as adversarial API call injections. This vulnerability stems from their reliance on gradient-based optimization, which attackers exploit via perturbation techniques like FGSM and Carlini-Wagner (CW) attacks [21]. Advanced attempts to mitigate these issues include attention-based anomaly scoring by Zhong et al. [22] and contrastive learning by Hu et al. [23].

Uzoma et al. [24] recently introduced a federated learning approach for cross-cloud threat detection, attaining an 89% F1-score on multi-platform logs while maintaining data privacy. However, Vasa et al.’s federated aggregation method [25] remains vulnerable to model poisoning attacks and struggles with computational inefficiency or cross-platform generalization (e.g., AWS vs. Azure log structures). These shortcomings highlight the necessity for solutions that harmonize detection accuracy with built-in robustness. Although deep learning models lead in performance benchmarks, Ahmad et al. [26] note their real-world deployment challenges in multi-tenant clouds due to latency. Our DL-HMM framework addresses this, delivering robust detection with only a 12% latency overhead.

Krishnan et al. [27] proposed a lightweight intrusion detection method by combining a Convolutional Neural Network (CNN) with an Autoencoder to identify anomalies in the BoT-IoT dataset. The CNN extracted spatial features, while the Autoencoder reduced dimensionality to enhance computational efficiency. Although this model showed strong performance for lightweight detection in IoT/cloud-like environments, it was highly vulnerable to strong adversarial perturbations, especially FGSM and PGD attacks. This weakness highlights the necessity for architectures that achieve both high detection accuracy and inherent adversarial robustness, as introduced in our DL-HMM framework. Poddar et al. [28] proposed a CNN-LSTM hybrid model that combines convolutional layers for local feature extraction with LSTM units for temporal sequence learning. The approach achieved an accuracy of 87.2% and an F1-score of 0.85, but suffered from weak interpretability, limiting its suitability for security-critical environments that require explainable decision-making.

While deep learning models such as CNNs and LSTMs have shown promising results in handling high-dimensional inputs, they often suffer from poor interpretability and are vulnerable to adversarial perturbations. CNNs, in particular, fail to capture long-range temporal dependencies, while standalone LSTMs, despite modeling sequences well, can overfit to benign patterns and struggle under adversarial attacks without additional defenses. These approaches show improved detection performance but suffer from poor interpretability and high vulnerability to adversarial attacks. Our approach builds on LSTM architectures but introduces ensemble learning and HMM-based reasoning for robustness and explainability.

Due to their probabilistic interpretability and capacity to simulate state transitions, HMMs have long been employed in anomaly detection. This makes them an ideal match for attack progression analysis. Early work by Vinayakumar et al. [29] demonstrated HMMs’ effectiveness for low-dimensional tasks (e.g., system call sequences), achieving 76.5% accuracy and a 0.73 F1-score, though they struggle with raw, high-dim data. More recently, Wang et al. [30] adapted HMMs for cloud workload anomaly detection, achieving 85% accuracy on preprocessed feature sets.

However, their evaluation clearly points out that these methods have trouble with raw, high-dimensional cloud logs. The fundamental mismatch between HMMs’ Gaussian emission assumptions and the complex, non-linear distributions of modern cloud data (e.g., Kubernetes pod logs or serverless function traces) remains an open challenge. Hybrid attempts, such as HMMs with autoencoder-based feature reduction by Faber et al. [31], partially address dimensionality but sacrifice real-time performance.

Contemporary research by Ganesan et al. [32] introduces neural emission HMMs for cloud logs, replacing Gaussian assumptions with normalizing flows. Their method enhances accuracy (83.1%) and F1-score (0.81) over conventional HMMs, but this comes at the expense of interpretability. Notably, their approach also requires three times more training data to achieve stable convergence compared to conventional HMMs. Our work overcomes this by integrating HMMs with LSTM-derived features, preserving interpretability while scaling to cloud-native data. Soni et al. [33] developed a Graph Neural HMM (GHMM) that incorporates cloud service dependency graphs as constraints on state transitions. While achieving 31% ASR and high interpretability, their method requires preconstructed service meshes, limiting adaptability to dynamic cloud environments, a gap our LSTM-enhanced approach address.

Hybrid models that combine statistical or symbolic reasoning (like HMMs or rule-based systems) offer better interpretability but are generally constrained by assumptions of linearity or Gaussian distributions. Their inability to learn hierarchical feature representations limits their effectiveness on raw, unstructured cloud telemetry, especially without deep feature preprocessing. Although hybrid HMM versions make things easier to understand, they frequently don’t scale or can’t handle raw cloud logs. Our DL-HMM model leverages deep LSTM features while retaining the interpretability of HMM state transitions, delivering a scalable and practical hybrid solution.

The arms race between attackers and defenders has spurred innovations in adversarial training and robust feature learning. Madry et al. [34] demonstrated that PGD-based adversarial training (applied to CNNs) achieves 86.5% accuracy on MNIST with a 22% attack success rate, though the resulting models are not interpretable. However, subsequent studies revealed its computational overhead for cloud-scale systems by Pan et al. [35], where training times increase three times compared to standard models. Gadicha et al. [8] explored adversarial AI trends in cloud security, underscoring the growing sophistication of evasion tactics targeting deep learning models, particularly in multi-tenant cloud services.

Alternative approaches have emerged to address these challenges: Pang et al.’s [36] diverse ensemble method achieves 89.7% accuracy with efficient 8.2 ms inference latency, though at the cost of higher prediction variance. Meanwhile, certified defenses like those developed by Cohen et al. [37] demonstrate theoretical robustness but suffer from practical limitations, notably slower 500 ms inference speeds and dependence on constrained threat models requiring bounded L₂-norm perturbations. Our work directly fills this gap by merging adversarially trained LSTMs with HMM-based explainability, which is a systematic integration of adversarial resilience with interpretable sequential models notably lacking from prior literature.

Very recent work by Kea et al. [38] demonstrates that quantum noise injection enhances LSTM robustness (ASR = 19%), but relies on specialized hardware and incurs a 15% latency penalty on quantum simulators. Concurrently Holla et al. [39] analyzed adversarial evasion in cloud intrusion detection systems (IDS), proposing a hybrid defense combining adversarial training with feature selection. While their method reduces attack success rates by 35% (achieving ASR = 22% in AWS), its reliance on manual feature engineering limits adaptability to new threats, a gap our LSTM-HMM framework addresses through end-to-end learned feature representations.

Although adversarial training and ensemble learning have emerged as effective defenses, many existing methods either incur high computational cost, reduce accuracy on clean data, or lack generalizability across attack types. Moreover, few existing defenses offer interpretability or resilience in real-time cloud environments. Even though adversarial and ensemble training methods have been studied separately, interpretable sequential models hardly ever incorporate them. Our work is the first to unify adversarial training, HMM-based reasoning, and ensemble stability into one intrusion detection framework.

Recent studies have introduced optimized techniques for cloud intrusion detection, including transformer-based architectures, federated learning, and hybrid deep models. While these methods advance performance on certain metrics, they often suffer from critical limitations such as high inference latency, lack of interpretability, or reduced robustness against adversarial threats. Table 1 summarizes these recent efforts and contrasts them with our proposed DL-HMM approach, which uniquely balances detection accuracy, adversarial resilience, temporal modeling, and real-time feasibility.

To critically assess the landscape of cloud intrusion detection methods, we present a structured comparison of twelve representative studies in Table 2, focusing on key dimensions essential for real-world deployment: detection accuracy, adversarial robustness (measured via Adversarial Success Rate, ASR), F1-score, interpretability, scalability, and inference latency. The selected works span classical, deep learning, and hybrid methodologies and were chosen based on their publication in peer-reviewed venues, empirical validation on standard security datasets (e.g., NSL-KDD, CIC-IDS2018, or equivalents), and relevance to cloud-based intrusion detection. This comparative lens allows us to identify persisting limitations in prior work, including vulnerability to adversarial inputs, lack of interpretability, or poor latency performance. Our proposed DL-HMM Ensemble seeks to address through a balanced trade-off between robustness, transparency, and real-time efficiency.

The comparative analysis clearly reveals a critical gap in existing cloud intrusion detection frameworks. Notwithstanding the great accuracy of some models (such as CNN, Transformer, and LSTM), their interpretability is weak and they are susceptible to adversarial attacks, which makes them dangerous for real-world deployment. Others, such as standard HMMs or hybrid variants like Graph-HMMs, offer better explainability but cannot effectively process raw, high-dimensional cloud logs without extensive preprocessing. Moreover, very few works simultaneously address real-time operational efficiency and adversarial robustness. None of the reviewed approaches integrate adversarial training, probabilistic modeling, and ensemble learning in a unified framework.

Our proposed Deep Learning-Enhanced Ensemble Hidden Markov Model (DL-HMM) bridges these gaps by combining LSTM-based feature extraction with HMM-based state modeling, hardened through adversarial training and stabilized via ensemble voting. This design yields a rare combination of high accuracy (92.4%), low adversarial success rate (18%), and interpretability, while keeping inference latency within real-time operational thresholds (8.7 ms). Therefore, the DL-HMM framework contributes a novel, scalable, and practical solution to cloud security that current literature lacks. These shortcomings in deep, hybrid, and classical models highlight the necessity for an intrusion detection system that integrates probabilistic reasoning, adversarial resistance, robust feature learning, and real-time application. This is what inspired the development of our DL-HMM framework.

The proposed DL-HMM framework’s analytical foundation combines temporal pattern recognition with probabilistic reasoning to address the unique challenges of cloud intrusion detection. This section formally presents the key mathematical components and their integration into a cohesive detection system. At its core, the architecture implements a sophisticated information processing pipeline: raw cloud logs undergo temporal feature extraction through deep learning, followed by probabilistic state estimation that provides both detection capability and operational interpretability.

The mathematical models are carefully designed to maintain computational efficiency [40] while addressing three critical requirements: handling high-dimensional, noisy cloud telemetry data, modeling complex multi-stage attack sequences, and maintaining robustness against adversarial manipulation. We begin by detailing the LSTM-HMM hybrid architecture, then proceed to explain its adversarial training regimen and ensemble optimization strategy, concluding with an analysis of computational complexity that demonstrates practical deployability in real-world cloud environments.

The proposed framework was implemented in Python 3.9 using PyTorch for the LSTM components and hmmlearn for the HMM implementations following the flow in Algorithm 1. Adversarial samples were generated using the CleverHans library with ε = 0.1 for FGSM and 10 iterations for PGD attacks. The ensemble consisted of 5 LSTM-HMM models, each with the following architecture:

LSTM: 2 layers, 128 hidden units, dropout = 0.3

The complete training algorithm is presented below:

To evaluate the effectiveness of our proposed DL-HMM ensemble, we compared it against four widely used baseline models: SVM, CNN, traditional HMM, and LSTM. As shown in Table 3, the comparison is based on standard metrics including accuracy (mean ± standard deviation), precision, recall, F1-score, Receiver Operating Characteristic-Area Under the Curve (ROC-AUC), and adversarial robustness (ASR). All results represent the mean of 10 independent runs, with accuracy values additionally reporting standard deviation to reflect result stability.

To ensure the generalizability and robustness of our proposed DL-HMM framework, we evaluated it on two widely adopted intrusion detection datasets: CIC-IDS2018 and NSL-KDD. CIC-IDS2018 provides realistic, modern-day network traffic with up-to-date attack vectors (e.g., DoS, Botnet, Brute Force), making it ideal for evaluating real-world adversarial resilience. In contrast, NSL-KDD, while older, remains a standardized benchmark for comparative studies due to its class balance and annotation quality. Testing across these two datasets allows us to validate the adaptability of DL-HMM to both structured (NSL-KDD) and raw sequential logs (CIC-IDS2018), covering a broad spectrum of cloud threat scenarios.

Beyond its superior accuracy, the DL-HMM ensemble exceeds baseline models across all performance metrics. It achieves the highest F1-score (0.91), demonstrating optimal precision-recall balance-crucial for intrusion detection where both false positives and negatives must be minimized. The model shows exceptional precision (0.91) in identifying true attacks and strong recall (0.90) in detecting actual threats, while its ROC-AUC (0.94) confirms excellent benign/malicious classification across thresholds. This consistent multi-metric performance proves the model’s robustness isn’t accuracy-dependent. As shown in Table 3, it maintains a remarkably low 18% Adversarial Success Rate, a 40%–50% reduction vs. baselines (SVM/LSTM: 32%, HMM: 38%; Fig. 2), demonstrating unique resilience against evasion attacks. These results statistically validate (p < 0.001) the synergistic benefits of combining LSTM feature extraction with HMM state modeling and ensemble voting.

ROC curves for SVM, CNN, HMM, LSTM, and the suggested DL-HMM ensemble are shown in Fig. 3 after being assessed using the CIC-IDS2018 dataset. The DL-HMM achieves the highest AUC (0.94), reflecting superior ability to distinguish between benign and malicious activity across thresholds. The DL-HMM model’s confusion matrix, shown in Fig. 4, exhibits good predictive performance with low false positive (FP: 70) and false negative (FN: 80) rates and high true positive (TP: 920) and true negative (TN: 930) rates, indicating a balanced trade-off between recall and precision in adversarial cloud environments. The balanced distribution across all quadrants highlights the model’s stability under adversarial conditions, maintaining reliable detection across diverse attack types while minimizing misclassifications.

The observed differences in model performance can be attributed to both architectural strengths and their alignment with the data characteristics. The superior results of the DL-HMM ensemble stem from its ability to capture temporal dependencies through LSTM layers while leveraging HMMs for probabilistic state modeling, which enhances interpretability and guards against overfitting. Traditional HMMs underperform due to their assumption of Gaussian emissions and limited capacity to handle high-dimensional input features present in raw cloud logs.

Models like SVM and Logistic Regression struggle because they lack sequential awareness and are prone to underfitting complex patterns. The CNN performs better due to local feature learning but lacks the temporal context necessary for modeling attack progression. The LSTM-only model performs competitively but lacks the ensemble diversity and transition-based reasoning offered by the DL-HMM architecture, making it more sensitive to adversarial perturbations. Overall, the DL-HMM ensemble’s integration of deep feature extraction, structured transition modeling, and adversarial training results in a balanced model that generalizes well without overfitting.

Each model’s performance can be interpreted in light of its architectural suitability for handling sequential, high-dimensional cloud telemetry. Support Vector Machines (SVMs), while effective in separating linear and non-linear classes, lack temporal modeling and struggle with dynamic, evolving input like API call sequences, leading to lower recall and sensitivity to attack phases. Hidden Markov Models (HMMs) offer interpretability through state transitions but are limited by their Gaussian emission assumptions, making them poorly suited for raw log data without prior feature engineering. Convolutional Neural Networks (CNNs) can learn local patterns but fail to capture longer temporal dependencies present in multistep intrusions, leading to moderate F1-scores.

LSTM networks are well-suited to sequential data and outperform simpler models due to their memory gates, but without ensemble diversity or probabilistic reasoning, they are more susceptible to adversarial attacks. Models like Random Forests and Logistic Regression, although not included in our final benchmark, typically perform poorly on high-dimensional temporal data without handcrafted features. Random Forests may suffer from overfitting to noise, while Logistic Regression lacks capacity for modeling complex or nonlinear feature interactions. This further justifies our decision to focus on deep and hybrid models tailored for temporal anomaly detection in cloud environments.

To evaluate resistance against evasion attacks, we subjected all models to FGSM and PGD attacks with varying perturbation magnitudes (ε ∈ [0.05, 0.2]). Fig. 5 shows the degradation in F1-score as attack strength increases.

The DL-HMM ensemble maintains an F1-score of 0.82 at ε = 0.2, compared to 0.62 for LSTM and 0.60 for HMM, a 32.3% relative improvement at the highest attack strength. This resilience stems from two factors: the ensemble’s inherent diversity makes it harder to craft universally effective adversarial examples, and the HMM’s transition constraints prevent unrealistic state jumps that often accompany perturbed inputs.

While the ensemble approach introduces additional computation compared to standalone models, our optimization strategies ensure the overhead remains practical for real-world cloud deployments. The DL-HMM framework achieves this balance through three key design choices: parallelized training of ensemble members, dimensionality reduction via PCA to streamline LSTM processing, and efficient batch processing of log sequences. As demonstrated in Table 4, these optimizations yield latency figures compatible with production cloud environments, where monitoring systems typically operate at 100 ms^–1 s intervals.

Fig. 6 illustrates the computational efficiency of the proposed DL-HMM ensemble. Subplot (a) compares the training time, showing that although the DL-HMM takes longer (4.8 h) due to ensemble and adversarial training, it remains within practical limits. Subplot (b) presents the inference latency, highlighting that the DL-HMM maintains a low per-sample delay of 8.7 ms, only slightly higher than LSTM (3.2 ms), and well below the 100 ms threshold for real-time cloud monitoring. Subplot (c) shows GPU memory usage, where the DL-HMM uses 6.2 GB, a modest increase that remains acceptable for deployment on standard cloud infrastructure. Together, these results confirm that the added robustness and accuracy of the ensemble come with minimal performance trade-offs.

To further contextualize the performance of our DL-HMM framework, we reviewed recent deep learning models such as Gated Recurrent Units (GRUs), Transformer-based IDS, and Autoencoder-CNN hybrids. Transformer-based models have shown strong results on structured data but often require substantial computational resources and exhibit higher inference latency, making them less suitable for real-time cloud intrusion detection. GRUs offer comparable sequence modeling capabilities to LSTMs with fewer parameters, but they generally perform marginally lower on long sequences. Additionally, deep autoencoders are effective at anomaly detection but lack interpretability and robustness under adversarial conditions. In contrast, our DL-HMM model not only achieves higher adversarial resilience (F1 = 0.85 at ε = 0.2) and interpretability but also maintains a low inference latency (8.7 ms), making it more suitable for real-time deployment.

The radar plot shown in Fig. 7 compares our DL-HMM against Transformer-IDS, GRU, and Autoencoder-CNN across four key metrics: F1-Score, adversarial robustness, latency, and interpretability. The visualization demonstrates DL-HMM’s superior balance, particularly in robustness (0.85 vs. 0.55–0.65) and interpretability (0.9), while maintaining efficient 8.7 ms inference. These results validate our hybrid approach’s advantages for real-time cloud security.

To rigorously demonstrate that our performance improvements are not due to random chance, we conducted a comprehensive series of ANOVA (Analysis of Variance) tests across all key evaluation metrics. The tests were designed with α = 0.01 significance level and included Bonferroni correction for multiple comparisons, ensuring conservative statistical validation. Our analysis yielded the following results.

Fig. 8 presents a comparative analysis of the DL-HMM ensemble’s statistical performance across key dimensions. Subplot (a) shows detection accuracy, where the ensemble achieves an F1-score of 0.92, significantly higher than the baseline LSTM (0.84), with p < 0.001 indicating strong statistical significance. Subplot (b) demonstrates adversarial robustness, with the ensemble maintaining an F1-score of 0.85 at ε = 0.2, outperforming defenses like PGD-trained CNNs (0.81). Subplot (c) displays inference latency, confirming the ensemble’s 8.7 ms delay remains well under the 10 ms operational threshold (marked by a dashed line), representing an acceptable tradeoff for substantial robustness and interpretability gains.

The accompanying ANOVA table (Table 5) mathematically validates these visual improvements are not random variations but statistically robust enhancements. The complete results, including post-hoc pairwise comparisons, consistently show that the DL-HMM ensemble’s advantages are both practically meaningful (effect size η² > 0.6 for all critical metrics) and statistically robust across all evaluation dimensions. This rigorous validation ensures our conclusions hold across different cloud environments and attack scenarios.

The superior performance of the DL-HMM ensemble, particularly under adversarial conditions, can be attributed to three fundamental design choices. First, the LSTM-HMM hybrid architecture successfully bridges the gap between high-dimensional feature extraction and interpretable state-based reasoning. While pure deep learning models like CNNs and LSTMs excel at processing raw cloud logs, they lack the structured probabilistic framework that HMMs provide. Our results show that this combination leads to a 9.7% improvement in F1-score over standalone LSTMs on the CIC-IDS dataset, confirming that temporal state modeling enhances detection accuracy.

Second, the adversarial training regimen plays a critical role in hardening the model against evasion attacks. Unlike traditional defenses that rely solely on input sanitization or outlier detection, our approach explicitly incorporates adversarial samples (generated via FGSM and PGD) into the training process. While traditional detectors deteriorate quickly under attack, this model retains an F1-score of 0.82 even at high perturbation magnitudes (ε = 0.2). This strategy’s effectiveness indicates that adversarial robustness in cloud security must be ingrained in the learning process itself and cannot be attained solely through detection techniques.

Third, the ensemble voting mechanism mitigates the inherent instability of individual models when faced with adversarial inputs. In particular, the 40% reduction in adversarial success rate (ASR) compared to single-model baselines shows that the framework reduces variance and prevents overconfidence in incorrect classifications by aggregating predictions from multiple LSTM-HMMs trained on bootstrapped data subsets. The diversity of the ensemble makes it impossible for an attacker to consistently fool all constituent models with a single perturbation strategy, which makes evasion much more difficult.

While the results are promising, several practical factors must be addressed before widespread adoption in production cloud environments.

Our findings challenge two prevailing assumptions in the literature:

The current framework has two primary limitations that warrant discussion and suggest future directions. First, the joint training of LSTM and HMM components require careful hyperparameter tuning, particularly in balancing the learning rates between the neural network and probabilistic model, which could be alleviated in future iterations through automated techniques like Bayesian optimization. Second, while the model performs well on known attack patterns (for instance, DDoS, credential stuffing), its performance on zero-day exploits remains untested, suggesting potential enhancements through incorporating anomaly detection modules such as Gaussian Mixture Models (GMMs) for outlier scoring to improve adaptability to unseen threats.

Beyond technical contributions, this work has important implications for cloud security practices by shifting the paradigm from reactive signature matching to proactive adversarial-resistant detection, aligning with the “assume breach” mindset of modern cybersecurity. The framework’s interpretable state sequences, provided through the DL-HMM hybrid, facilitate root cause analysis during incident response, a critical feature often lacking in black-box deep learning systems, thereby bridging the gap between detection performance and operational usability in security operations centers.