Applied Intelligence (2024) 54:6738–6759

https://doi.org/10.1007/s10489-024-05505-y

Deep learning method for efficient cloud IDS utilizing combined

behavior and flow-based features
Geetha T V1 · Deepa A J2 · Mary Linda M3

Accepted: 4 May 2024 / Published online: 24 May 2024

© The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature 2024

Abstract
The Intrusion Detection System (IDS) distinguishes the harmful entries from the normal ones in network traffic data and
aids in network security. Due to the emergence of new and unknown network-connected devices, a lot of modern systems
were penetrated. As a result, it is critical to improve information security and to detect new cyber-attacks exploiting vari-
ous application protocols such as Hyper Text Transfer Protocol (HTTP) and Domain Name System (DNS). Therefore, this
paper introduced an Optimized Bidirectional Convolutional Neural Network and Long-Short term Memory (OBCLSTM)
method to detect whether the protocol HTTP and DNS is attacked or not. Initially, the records are fed to data normalization
and data encoding. After pre-processing, the vectors are fed to the OBCLSTM model. The Bidirectional Channel Pooling
(BiCP) layer is used to learn behavior-based features (which show interactions among hosts based on ports, destinations and
behavior) and flow-based features (which identify basic flows, such as IP addresses of source-destination and ports), which
improves the accuracy of detecting malicious attacks. In the OBCLSTM model, the best hyper parameter configuration for
Convolutional Neural Network (CNN) to learn features is tuned using Enhanced Red Fox Optimization (ERFO). Then, bidi-
rectional long short-term memory (BiLSTM) is used to extract features in the time domain and has the ability to preserve
the long-term of the information from historical context, allowing attackers to be detected early before causing widespread
damage to networks. Finally, the fully connected layer utilizes these features to classify the network data as attacks (types
of attacks) or normal. Tests are conducted on the NSL-KDD99, TUIDS, UNSW-NB15 and BoT-IoT datasets. The proposed
OBCLSTM method attains better performance in terms of precision, accuracy, recall, and F-measure.

Keywords Intrusion detection system · Flow-based features · Behaviour-based features

1 Introduction host-based attacks (including malware, unauthorized, as well

as privilege scaling) and R2L, etc [3]. , are affecting services
Cloud computing is the most significant technology for data of cloud computing. An IDS is used to protect against these
storage. In cloud computing, both private and commercial-pur- intrusion attacks [4]. For this intrusion detection system, many
pose data are stored in the form of “pay as you use” [1]. Nowa- methods like fuzzy based clustering and the spider-monkey
days, many cloud computing services are available to users; optimization algorithm (FBC-SMO), deep neural network
at the same time, they are concerned about security issues [2]. (DNN), pre-training approach with a deep auto encoder
Many cyber-attacks, that are DoS (Denial of Service), U2R, (PTDAE), fuzzy c-means clustering (FCM), deep logarithmic
neural network (LOGNN), Support vector machine (SVM),
Hidden Markov Model, etc., are used [5–7]. The exploration
* Geetha T V
[email protected] of neural networks with random weights (NNRWs) [8], ran-
dom neural networks [9] and Random Vector Functional Link
1
Department of Artificial Intelligence and Data Science, St. (RVFL) networks [10] is gaining attention. These unconven-
Xavier’s Catholic College of Engineering, Chunkankadai, tional neural network architectures introduce randomization
Nagercoil, India
in their weights and connections, potentially offering unique
2
Department of CSE, Ponjesly College of Engineering, advantages in the context of intrusion detection.
Nagercoil, India
Anyhow, the existing methods have some issues in their pro-
3
Department of EEE, KIT-Kalaignarkarunanidhi Institute cessing, like difficult to extract the feature, exploding gradient,
of Technology, Coimbatore, India

Vol:.(1234567890)
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6739

less convergence speed and vanishing issues, inaccuracy and discussed in Section 4. Section 5 offers a conclusion in the
less data processing efficiency. From the above-mentioned end.
techniques, the CNN and the RNN are widely used in intru-
sion detection systems [11]. CNN is used to extract the feature
subset as well as for better classification [12]. The RNN is used 2 Related work
to process the data because it has short-time memory as inter-
nal memory [13]. It produces the output, copies that output, Some of the recent works designed in improving the IDS are
and loops it back into the network [14, 15]. Due to the hidden discussed in here as shown below.
layer derivatives multiplication, RNN is having the gradient The IDS was very useful in detecting several attacks that
exploding and vanishing problems [16, 17] and also neural net- affected the network. Here, for the network intrusion detec-
works with bandlimited random weights include challenges in tion, Zhendong et al. [25] introduced an integrated Deep
structured learning, potentially limited interpretability and the Learning (DL) model for the IDS. The data pre-processing
risk of suboptimal network configurations. The randomization and the classification were done by an integrated deep learn-
may hinder capturing intricate patterns and might necessitate ing method with SDAE-ELM. The stacked denoising auto
careful tuning to achieve desired performance [18]. encoder (SDAE) was used to reduce the noise in the data,
To overcome the gradient exploding and vanishing prob- as well as the extreme learning machine (ELM) was used to
lems, long-short term memory (LSTM) [19, 20] and its vari- make it as fast as the training speed of the data. The features
ant [21, 22] are used in RNN and it is called bidirectional are extracted by using the denoising auto encoder method.
RNN [23]. On account of its benefits, the CNN and bidirec- This method enhances the detection accuracy and it has the
tional RNN are combined for an effective intrusion detection poor detection in the small data sets.
system [24]. However, it is having problems of computa- IDS were used to secure and detect attacks in cloud
tion complexity, high complexity of the network structure, computing. Jitendra and Narander [26] present an intru-
and over fitting. To overcome these problems, OBCLSTM sion detection system in cloud computing using hybrid
method is proposed to detect whether the protocol HTTP and clustering-optimization. For a hybrid method of IDS, here
DNS is attacked or not. fuzzy based clustering is utilized for anomalies clustering.
Then the fitness value for fuzzy is obtained by using spider-
1.1 Contributions monkey optimization algorithm (FBC-SMO). This method
provides better accuracy and higher security in the cloud
The proposed OBCLSTM method contributions are pro- computing environment. But it consumes more time for
vided below, processing.
The implementation of Deep Learning and Enhanced
• An effective IDS model (OBCLSTM) is introduced for Transient Search Optimization for IoT IDS was demon-
detecting attacks on numerous application protocols such strated by Abdulaziz et al. [27]. Here, the features from
as DNS, and HTTP. the data were extracted using the convolution neural net-
• An attention pooling and max-pooling is introduced as works and the Enhanced Transient Search Optimization
BiCP layer to learn the flow based and behavior-based (CNNTSO) was used to select the new features with the
features from HTTP and DNS protocol, which enhances help of the differential evolution (DE) algorithm. TSO and
the accuracy to detect attacks. Besides, BiLSTM is used DE (TSODE) were combined and used to improve the train-
to extract features in the time domain, where attackers ing process. It consumes less time for processing. But it has
can be detected early before harming the entire networks. low accuracy in the small data sets.
• The best hyper parameter configuration for CNN to The detection of impersonation attack using the centric
learn features is tuned using ERFO by introducing the user profiling approach for a cloud environment is demon-
opposition-based learning strategy (OBLS) and chaotic strated in Hisham [28]. Three stages were used to evaluate
sequences, which enhance the exploration of the algo- the detection of masquerade and impersonation attacks. The
rithm and for faster convergence. first stage analyses the systems call sequence and the Net-
• The proposed OBCLSTM model performs better in terms Flow data subsystems to identify the attack. The next stage
of recall, precision, F1-score and accuracy, compared to analyses the audit data and the user behavior with both the
existing methods. network environment and the host. The third stage combine
two stages by utilizing a neural network. The cloud intrusion
This paper is structured as follows. The existing research detection datasets (CIDD) were used to simplify the three
based on intrusion detection is examined in Section 2. The testing approaches and the data audit. The CIDD is one of
architecture of the proposed network is described in Sec- the few datasets to evaluate and support the IDS in the cloud.
tion 3. The results of the experiment are then presented and The scoring systems and the sliding window size of DSSGA
6740 G. T V et al.

were used for their high flexibility and better accuracy. But in extracting distinct features and capturing long and short-
it needs more user profiles to detect impersonation attacks. term relationships in network traffic data. This hybrid
Yesi et al. [29] present an IDSby using deep learning and approach demonstrates efficacy in real-time intrusion detec-
grid search optimization. Here, a deep learning network IDS tion, enhancing the landscape of deep learning models for
was used with a combination of pre-training approach with network security. However, its complexity extends training
a deep auto encoder (PTDAE) and a deep neural network periods, differing from conventional deep learning methods.
(DNN) for attack detection. A grid search combined with Further research is warranted to explore attack behavioural
random search is used to obtain hyperparameter of deep patterns and refine forecasting and prevention models.
learning network. This method improves the performance of Upon reviewing the survey, it becomes evident that poten-
detection. However, this method was not used for the imbal- tial attackers may exploit application protocols such as DNS
anced detection datasets. and HTTP, posing significant security and data leakage con-
Zhendong et al. [30] explained internet intrusion detec- cerns. Current challenges in intrusion detection methods
tion with a logarithmic neural network (LOGNN). The involve ineffective learning mechanisms for flow-based and
LOGNN is operated by logarithmic operation and it is used behavior-based features, limitations in extracting features
for processing features of data. Every LOGNN’s logarithmic from the time domain and the inability to promptly iden-
operation base number is obtained by neural network. This tify emerging cyber threats from newly connected devices.
method increases the accuracy. But its training process was In response to these issues, we introduce the OBCLSTM
more complicated. method, positioning it as an innovative intrusion detection
Several attacks impacted cloud computing during the data system that surpasses the constraints of existing approaches.
processing process. To solve that, Naser and Shafiq [31] rep- This solution aims to provide efficient learning for flow-
resent the IDS using fuzzy c-means clustering algorithm and based and behavior-based features, enhance feature extrac-
support vector machine (FCM-SVM) for cloud computing tion in the time domain and swiftly recognize new cyber
environments. In this, the IDS was united with the FCM threats from emerging network-connected devices. Table 1
algorithm and SVM for attack detection. Initially, the cluster depicts the existing IDS summary.
group is formed in terms of membership function. Based
on the cluster values, SVM are trained and finally the fuzzy
aggregation integrates the results. This method gives better 3 Proposed intrusion detection method
accuracy as well as a low false alarm rate. But it has high
computational time. In the proposed model, an OBCLSTM method is introduced
Kasongo [32] introduced a novel deep learning approach for efficient intrusion detection. Figure 1 illustrates the archi-
for Intrusion Detection Systems (IDSs), leveraging a frame- tecture of the OBCLSTM model. Initially, the records are
work based on Recurrent Neural Networks (RNNs). The fed to Z-score normalization and one hot encoder for data
framework incorporates various RNN types, including Sim- normalization and data encoding. Then, the vectors extracted
ple RNNs, Long-Short Term Memory (LSTM), and Gated by the encoder is given to the OBCLSTM model. Here, the
Recurrent Unit (GRU), evaluated using standard datasets. BiCP layer is used to learn behaviour-based features (which
Results indicate superior performance compared to exist- show interactions among hosts based on ports, destinations,
ing IDSs in terms of test accuracy. Nevertheless, challenges and behaviour) and flow-based features (which identify
include the requirement for extensive labelled training data, the basic flows, such as IP addresses of source-destination,
potential overfitting, and the intricate process of hyperpa- and ports), which enhance the detection accuracy. The best
rameter optimization for deep neural networks. hyper parameter configuration for CNN to learn features is
Samunnisa et al. [33] introduced anomaly-based IDS tuned using ERFO. The BiLSTM is then used to extract time
in distributed cloud environments, employing benchmark domain features and has the capability of storing informa-
datasets NSL-KDD and KDD Cup 99. The proposed model tion in the long term from historical context, which aids
exhibits enhanced accuracy and detection rates across vari- in detecting attacks early before they harm the entire net-
ous intrusion types through a combination of clustering, work. Finally, the fully connected layer uses these features
classification, log analysis, pattern matching and threshold to determine whether or not the HTTP and DNS protocols
evaluation. Despite its merits, challenges encompass intri- are being attacked.
cacies in model tuning, potential data quality impact, and
heightened computational resource demands. 3.1 Pre‑processing
Hnamte and Hussain [34] present a hybrid deep learn-
ing architecture, merging CNN and BiLSTM networks with In this stage, the records in the dataset consist of text and
attention mechanisms for intrusion detection. By combin- numerical values. Large numbers in a numerical value will
ing the strengths of CNN and BiLSTM, the model excels slow down training and make processing more difficult.
Table 1  Existing IDS summary
Author Methods used Dataset used Merits De-merits

Zhendong et al. [25] SDAE-ELM ADFA-LD, UNSW-NB15,KDD Enhances the detection accuracy. It has the poor detection in the small data
Cup99, and NSL-KDD datasets sets.
Jitendra and Narander [26] FBC-SMO NSL-KDD, KDD99 datasets Better accuracy and higher security in It takes more time to train the dataset.
the cloud computing environment.
Abdulaziz et al. [27] CNNTSO NSL-KDD, BoT-IoT, KDDCup-99, It consumes less time for processing. It has low accuracy in the small data sets.
and CICIDS-2017 dataset.
Hisham [28] centric user profiling approach CIDD dataset High flexibility and better accuracy.
It needs more user profiles to detect
impersonation attacks.
Yesi et al. [29] PTDAE CIDD dataset Improves the performance of detection. This method was not used for the imbal-
anced detection datasets.
Zhendong et al. [30] LOGNN NSL-KDD and UNSWNB-15 dataset Increases the accuracy. Its training process was more compli-
cated.
Naser and Shafiq [31] FCM-SVM NSL-KDD dataset Better accuracy as well as a low false It has high computational time
alarm rate.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based…

Kasongo [32] RNN Framework with Simple RNNs, NSL-KDD, UNSW-NB15 Superior test accuracy compared to Requires extensive labeled training data,
LSTM and GRU​ existing IDSs. optimization for deep potential overfitting and intricate hyper-
neural networks. parameter optimization for deep neural
networks.
Samunnisa et al. [33] Hybrid approach involving clustering, NSL-KDD, KDD Cup 99 Enhanced accuracy and detection rates Model tuning intricacies, potential data
classification, log analysis, pattern for various intrusion types. quality impact and heightened compu-
matching, and threshold evaluation tational resource demands.
Hnamte and Hussain [34] Hybrid architecture combining CNN, CICIDS2018, EdgeIIoT Extracts distinct features and captures Complexity extends training periods,
BiLSTM and attention mechanisms long and short-term relationships. requiring further research on attack
patterns
6741
6742 G. T V et al.

Fig. 1  Architecture of
OBCLSTM method Datasets

Pre-processing
Text
Data encoding
data

Numeri
Data normalization
cal data

Pre-processed records

OBCLSTM Classifier

Conv Pooling Fully

Pooling Conv
layers conne
layers
cted
layer

Max- ERFO
pooling Attention-
pooling

Extracted features
Input layer

Forward layer
Intrusion

Backward layer

Normal
Output layer

Additionally, the deep neural network algorithm’s opera- 3.2 OBCLSTM classifier

tions cannot process text values. Thus, pre-processing
of the dataset is required. Data normalisation and data The existing methods fail to learn the behaviour based and
encoding is applied to the dataset’s records [35]. Z-score flow-based features. So, it is difficult to show the interac-
normalisation ­(Zsr) is utilized to normalize the numerical tion among hosts based on ports and destinations and to
features in order to lower their values and to reduce the update the attack types on a regular basis. Moreover, it
process of training, which is given in Eq. (1). fails to preserve the long-term of the information in its
y−𝜇 historical context. As a result of this detection, irrelevant
Zsr = (1) attacks are launched and the attackers become more dan-
𝜎
gerous. Therefore, we introduce the BiCP layer and BiL-
where, y denotes the values, 𝜎 signifies the sample’s stand- STM in the OBCLSTM model to detect malicious behav-
ard deviation and 𝜇denotes the sample’s mean. One Hot iour in the cloud.
encoder is used to convert the text features into numerical
values.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6743

After pre-processing, the records are given to the convo- where Rkjsignifies k layer and j channel’s output activation
lution layer of the OBCLSTM classifier. Here, we use the map. Rkj can determined in Eq. (3).
BiCP layer to learn behavior-based features (which show
interactions among hosts based on ports, destinations and
∑
Rkj = rk−1 Pkij + vkj (3)
i∈Lj j
behaviour) and flow-based features (which identify the basic
flows, such as IP addresses of source-destination, protocols where rjk−1denoted as the preceding layer’s previous output
and ports) in CNN. This gives high detection accuracy. In activation map, vkj signifies the bias value and Pkij denotes the
the OBCLSTM model, the best hyper parameter configura-
convolution kernel weights. Dropout is used in the CNN
tion for CNN to learn features is tuned using ERFO. ERFO
block after the ReLU activation function to address the over
introduces OBLS and chaotic sequences to improve the algo-
fitting issue. After convolution, each feature is fed to the
rithm’s exploration and for faster convergence. The BiLSTM
BiCP layer for filtering and learning of features. BiCP layer
network is then used to extract time-domain features and
consist of max-pooling and attention pooling layers.
to preserve the long-term of the information from histori-
The max-pooling layer is regarded as one of the BiCP layer
cal context. Finally, the fully connected layer determines
and learns the behavior-based features. Here, filters with vary-
whether it is an attack or a normal layer.
ing area sizes are made to acquire various max pooling values.
Every feature-mapping vector’s most important characteristic
3.2.1 Extraction of behaviour‑based and flow‑based
is obtained, which is given below,
features
{ }
y = Max ui (4)
Behavior-Based and Flow-Based Features Extraction is 0≤i≤e−h

essential for robust network behavior detection. Behavior- where h signifies the convolutional kernel’s width, e denotes
based features capture patterns related to network activity, the input vectors matrix and ui signifies the convolutional
aiding in the identification of specific behaviors. Flow-based kernel matrix sub-matrix. The max-pooling layer, a facet
features, facilitated by attention mechanisms, address limi- of BiCP, focuses on behavior-based features, utilizing fil-
tations in capturing flow-related characteristics. Together, ters with varying area sizes to obtain diverse max pooling
these features provide a comprehensive understanding of values. Each feature-mapping vector’s crucial characteristic
network traffic dynamics. Behavior-based features highlight is identified. The Max-pooling Layer collaborates with an
abnormal patterns, while flow-based features enhance the Attention-pooling Layer (APL), amalgamating flow-based
model’s ability to discern nuances in data flow. This com- and behavior-based features. Figure 2 illustrates the BiCP
bined extraction process significantly improves the model’s layer’s architecture, emphasizing its vital role in feature
accuracy in detecting anomalies, ensuring a more thorough extraction and learning. The CNN’s inability to capture
and nuanced analysis of network behavior for effective intru- flow-based features and the importance of the features var-
sion detection and security. ies based on their location, which can be solved by an atten-
The process begins with the CNN block, which receives tion mechanism. It extracts the flow-based features and the
pre-processed records through a 1D convolution operation. significant features.
The convolution operation employs a ReLU activation func- Additionally, an Attention-pooling Layer (APL) is intro-
tion to capture intricate information. The resulting activation duced to amalgamate flow-based and behavior-based features.
maps undergo max-pooling, focusing on behavior-based fea- This layer utilizes a Multi-Head Attention Mechanism, consist-
tures. Filters with varying area sizes are employed to acquire ing of Query (QY), Value (V) and Key (KY) matrices. The
diverse max-pooling values, capturing crucial characteristics attention mechanism, based on the Scaled Dot-product Atten-
of each feature-mapping vector. A detailed explanation of tion (SDPA) approach, determines the similarity between dif-
the feature extraction method is provided below. ferent feature matrices, facilitating the extraction of flow-based
The CNN block receives pre-processed records using a features. The multi-head attention mechanism transforms
1D convolution operation that results in activation maps matrices QY, KY and V, and their outputs are combined to
when a fixed kernel of 1 × 3is used. To learn more com- form the output of SDA. The resulting vector is then trans-
plicated information, the convolution activation function formed into a fixed-dimension vector through a linear trans-
employs a Rectified Linear Unit (ReLU), which is given in formation, enabling the simultaneous learning of significant
Eq. (2). behavior and flow-based features. The QY, KY, and V matrix
( ) are similar to the convolutional layer output’s flow-based fea-
rjk = Re l u Rkj (2) ture matrix ‘U’, which is given below,
QY = KY = V = U (5)
6744 G. T V et al.

Fig. 2  Architecture of Bichan- Bi channel pooling layer (maxpooling,

Convolution Feature maps
nel pooling layer and attention pooling layer)

1-max

Concat

Linear

Linear SDA Concat

Linear

The self-attention method is based on the SDPA 3.2.2 Extraction of temporal features

approach. it determines the similarity by √
first resolving the
dot product of QY and KY, and splits by dKY , so that the The BiLSTM network plays a crucial role in extracting features
output of the dot product calculation won’t be excessively within the time domain and retaining long-term information
large ( dKY signifies the KY matrix dimension). To obtain from the historical context. Comprising two reverse LSTM
the expression of attention, we first normalise the result networks, the BiLSTM provides a comprehensive understand-
using the Softmax function before multiplying it by the V ing of sequential data. Each LSTM network consists of several
matrix. The SDPA is determined in Eq. (6). neuron nodes, each equipped with three decision-making com-
� � ponents: the input gate, the forget gate and the output gate [36].
QYKY U The BiLSTM conducts both forward and backward feature
SDPA(QY, KY, V) = softmax √ V (6)
dKY extractions through two LSTM networks. The forward LSTM
(LSTM forw) processes information from the past to the present
The purpose of the multi-head attention mechanism is (t-1 to t), while the backward LSTM ( LSTM backw ) analyses
to make linear transformations on the matrices QY, KY, information from the future to the present (t + 1 to t). This
and V. The output of each self-attention module’s is then bidirectional approach enables a more detailed exploration of
combined into a single output, which results in output of feature information and an understanding of each characteris-
SDA. Finally, the result is transformed into the vector with tic’s impact before and after it in the sequence data.
fixed dimension by the W matrix transformation, which is For a given time point t, the outputs of the forward and
given below, backward LSTMs are represented as where hit and hiback
forw
t
respectively. These outputs are then concatenated to form a
hi = SDPA(QYWiQY , KYWiKY , VWiV ) (7) comprehensive representation of the features at that specific
time point:
MH(QY, KY, V) = concat(h1 , … … … … ht )W (8)
(9)
forw
hit = LSTM forw (hit−1 , yt , Ct−1 )
where t denotes the various self-attention modules, WiQY ,
WiKY , and WiV are various weight matrices. The two feature
hiback = LSTM backw (hit−1 , yt , Ct−1 ) (10)
matrices of the Attention-pooling layer and the Max-pooling t

layer are merged into one. So, the method can learn signifi-
cant behavior and flow-based features in the vectors at the
[ ]
forw
Hit = hit , hiback
t (11)
same time.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6745

Here, hit and hiback

forw
t
denote the forward and backward Initialization The initialization phase is a critical starting
hidden layers, Ct−1 signifies the previous node state, and point for the ERFO algorithm. At the onset, a fixed number
Yt−1 represents the input. This concatenated representation of candidate solutions, symbolizing foxes in the algorithm
( Hi ) encapsulates the bidirectional influence of features at inspired by the red fox behavior, are randomly selected.
the given time point. Each candidate, representing a fox, is characterized by a set
The output from the BiLSTM is further processed through of coordinates in the solution space. These coordinates are
a fully connected layer and the resulting features are sent to essential parameters in the optimization process, analogous
a Softmax classifier. This final stage determines whether the to the spatial attributes that determine the position of a fox
protocols HTTP or DNS are under attack or remain unaf- in its environment.
fected, completing the network behavior detection process.
In more technical terms, let’s denote the solution space
dimensions by ‘t’. For every fox, its position in the solution
3.2.3 Enhanced Red Fox Optimization space is represented by coordinates of t he
form y = (y0 , y1 , … … .yt ). We introduce the representation
k n
During the intricate optimization journey, ERFO strategi- (yj ) , where j is the coordinate as indicated by the solution space
dimensions, in order to distinguish each fox Y in n iteration, and
k
cally deploys evaluation mechanisms to meticulously assess
the performance of diverse hyperparameter configurations. k denotes the fox numbers. The t variable’s criterion function is
Drawing inspiration from the adaptive hunting techniques considered as w ∈[Rtin terms of search space’s dimension. ] The
of the red fox, this approach guides the algorithm with a notation (Y)(k) = (Y 0 )(k) , (Y 1 )(k) … … … … (Y t−1 )(k) desig-
nuanced and deliberate strategy. The algorithm’s adaptabil- [ ]t
nates the points in the space p, q where p, q ∈ R. If the func-
ity and equilibrium between exploration and exploitation are tion value f ((Y)(k)is a global optimum on [p, q], then (Y)(k) will
paramount in navigating the vast hyperparameter space, akin be the best solution at that time.
to the red fox’s adept navigation of its environment. Then the subsequent stages of the algorithm will then
Inspired by the red fox’s ability to adapt to various hunt- iteratively explore, evaluate and refine these initial solutions
ing scenarios, ERFO dynamically manoeuvres through the to converge towards optimal hyperparameter values for the
hyperparameter landscape, aiming for regions that hold the given problem, such as learning rate, epochs and batch size
promise of enhanced accuracy, efficiency and adaptability in the context of CNN optimization for intrusion detection.
for the OBCLSTM model. This strategic deployment mir-
rors the fox’s ability to adapt its hunting techniques to dif- Objective function evaluation The initial phase encom-
ferent prey and environments, ensuring that ERFO tailors passes the segregation of the dataset into separate training
its approach based on the unique challenges posed by the and testing sets, establishing the fundamental basis for sub-
intrusion detection domain. sequent procedures. Here, the hyperparameters of the CNN,
The adaptability inherent in ERFO’s optimization mecha- including learning rate, epochs and batch size, emerge as
nism becomes a key asset in achieving a delicate balance pivotal elements in the optimization endeavour. The core
between exploration and exploitation. Much like the red fox objective centers around the minimization of an assigned
adjusts its hunting strategies based on the characteristics of objective function, typically representing the model’s loss.
the prey and the environment, ERFO fine-tunes its explora- This function becomes the focal point, steering the algo-
tion and exploitation tactics to efficiently navigate the com- rithm’s efforts toward fine-tuning specified hyperparam-
plexity of intrusion detection scenarios. This adaptability eters for optimal configuration. The overarching aspiration
serves as a cornerstone, allowing ERFO to respond dynami- is to elevate the CNN model’s performance, emphasizing
cally to the evolving demands of the optimization landscape. improvements in learning efficiency and accuracy as it navi-
In the intricate landscape of intrusion detection within gates the intricacies of training and testing datasets.
complex network environments, ERFO’s optimization
mechanism solidifies its role as a pivotal component. The ERFO’s optimization prowess extends seamlessly across
algorithm’s adeptness in mimicking the red fox’s adap- learning rate, batch size and epochs through an adaptive and
tive hunting behaviors ensures that it not only explores the iterative search process. In the realm of learning rate optimi-
hyperparameter space thoroughly but also exploits valuable zation, ERFO dynamically adjusts the learning rate, guided
insights gained during the process. This intricate interplay by the foraging behavior of red foxes, traversing a spectrum
between exploration and exploitation establishes ERFO as of values to pinpoint the optimal rate within the OBCLSTM
a resilient and efficient instrument for refining hyperparam- architecture. This dynamic tuning enhances adaptability,
eters, thereby significantly enhancing the performance and ensuring alignment with the network’s training dynamics.
adaptability of the OBCLSTM model within the demanding The introduction of chaotic sequences acts as a safeguard
domain of intrusion detection.
6746 G. T V et al.

against stagnation in local optima, fostering effective explo- to the prey. For each candidate in the iteration, a random
ration of the hyperparameter space and preventing premature value is set as 𝛿 ∈ [0,1].
convergence. {
Transitioning to batch size optimization, ERFO show- move closer if 𝛿 > 3∕4
remain hidden if 𝛿 ≤ 3∕4 (15)
cases versatility in exploring diverse batch size configura-
tions. The algorithm’s inherent adaptability dynamically
The radius is defined in below Eq. (16).
adjusts its search strategy based on varying batch sizes,
facilitating effective training of the OBCLSTM model. The
{
p × sin(𝜑0 )∕𝜑0 if 𝜑0 ≠ o
exploration-exploitation balance, inspired by the red fox’s R=
𝜇 if 𝜑0 = 0 (16)
hunting strategies, guides ERFO in efficiently navigating the
complex landscape of batch size selection. where 𝜇 denotes the random value [0,1].
In epochs optimization, ERFO exhibits finesse in fine-
tuning the number of training epochs. Striking a delicate Opposition based learning strategy This strategy defines
balance between underfitting and overfitting, the algorithm that there is an opposing location for each possible posi-
adjusts epoch values under the guidance of OBLS and tion in the solution space, which enhances the algorithm
chaotic sequences. This meticulous process ensures CNN exploration. A comparison with each solution’s opposite
convergence to an optimal solution without compromising is made after producing its opposite location to choose
generalization performance. The incorporation of chaotic the best one as a new solution. Consider, when a candi-
sequences injects controlled randomness, preventing entrap- date solution is generated, OBLS immediately produces
ment in suboptimal solutions and promoting more effective its opposite location in the solution space. This opposi-
exploration of the solution space. This holistic approach, tion is not a mere inversion but is crafted to represent
inspired by the red fox’s adaptive hunting techniques, posi- a contrasting viewpoint. Following this, a crucial step
tions ERFO as a robust and effective tool for fine-tuning involves comparing the original solution with its opposite
hyperparameters, ultimately contributing to the enhanced counterpart. The comparison considers various aspects,
performance and adaptability of the OBCLSTM model in such as fitness or objective function values, to evaluate
the challenging( realm their relative performance. The best-performing solution
) of intrusion detection.
The dataset Dtset is splitted as training Dt(Tr)set as well as between the original and its opposite is then selected as
testing Dt(Te)set . The CNN model considers the learning the new solution.
( rate,
number of epochs and batch size as hyper parameters Hrpr .
)

The objective function is determined in Eq. (12). This strategy plays a pivotal role in infusing diversity
( ) ( ) into the optimization process. By constantly introducing
OHrpr Dt(Tr)set = arg s min X OP, Dt(Tr)set + 𝜌(OP) (12) opposing viewpoints, OBLS ensures that the search algo-
OP∈M
rithm explores different regions of the solution space. This
where OP signifies the optimized hyper parameters, is particularly valuable in preventing premature conver-
OHrpr denotes the required hyper parameter configuration gence to local optima, as the algorithm is less likely to get
optimization. The objective function minimizes the loss at a stuck in a specific solution region. The contrasting per-
rate of ‘X’. spectives provided by the original solution and its oppo-
We first arrange the population by objective condition and site contribute to a more robust and thorough exploration,
calculate the Euclidean(distance ) square for each individual allowing the optimization algorithm to discover a wider
best
within a population for Y as given below, range of potential solutions.
√ By[ taking] into⌢ account Yi as a solution among
i best i
d((Y )k , (Y )k = ∥ (Y )k − (Y )k ∥,
best
(13) Yi ∈ Yi , Y i and its Y ij opposite value, the equation is given
below,
and we lead population individual towards the optimal one
i i i i
i k i k best k i k (Y )kop = (Y )kl + (Y )ku − (Y )kop (17)
(Y ) = (Y ) + 𝛼sign(Y ) − (Y ) (14)
i i
where (Y )kop , (Y )k ∈ Ri. By taking into account the declared
Where 𝛼 def ines the random integer, i i
best best explanation, the best position between (Y )kop and (Y )khas
𝛼 ∈ (0, d((Y )k , (Y )k ).
been chosen, and the stored solution and the remainder have
The movement and observation to cheat the prey while
been discarded.
hunting into a local search stage are part of the RFO algo-
Chaotic learning is the foundation of the second modi-
rithm. In order to imitate a fox potentially getting closer
fication. This mechanism was developed to improve the
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6747

quality of the ideal solution through iterations, which 𝛿k+1 = 4𝛿k (1 − 𝛿k ) (18)
enhances the convergences. We make use of the logistic
map here based on chaos mechanism. The updating equa-
tion for 𝛿 and 𝜇 are given below,
𝜇k+1 = 4𝜇k (1 − 𝜇k ) (19)
where k denotes the iteration number, 𝛿k and 𝜇k are the ini-
tial amounts chosen at random [0,1].

Algorithm: ERFO
Start
Define the following algorithmic parameters: maximum population size, search space
solution size, iteration number (k).
Create a population of foxes within the search area at random.

t:=0
while t ≤ Kdo
Set up the iteration's parameters as follows: scaling parameter and fox approaching
change
For every fox in present populationdo
Arrange individuals based on the fitness
calculate individual reallocation
If the outcome is superior to the previous position, then
relocate the fox,
else
Set the fox back in its original place.
End if
If the hunting fox is not observed, then
calculate the observation radius of the fox
Determine reallocation
else
Fox stays in place to hide himself
End if
End for
Organize the population based on fitness,
The worst foxes abandon the herd or hunted,
New foxes are introduced into the population
Determine the opposite location using Eqn. (17)
t++
End while
Return the best fox
Stop
6748 G. T V et al.

Table 2  ERFO Parameter Parameters Values 100GB. Nine different attack types are found during
settings analysis, of which DoS attacks make up 5% of the total.
Population 100 The dataset has 49 data columns and a total of 2,540,044
Iteration 200 instances. In this case, training was done with 80% of the
𝛿 [0,1] data, and testing with 20%.
𝜇m [0,1] Dataset-3: Among the 72,000,000 entries in the BoT-IoT
dataset are DoS and DDoS attacks, service scans and OS,
data exfiltration and keylogging. The protocol being used
Table 3  Configuration Settings of proposed OBCLSTM affects both DoS and DDoS attacks.
Block Values
Dataset-4: Indian university Tezhpur created the TUIDS
dataset. DoS, DDoS, and scanning and probing attacks
CNN block 1 Kernel size 3 are present in this dataset.
Stride 1
Drop out 0.4
filters 64 4.2 Performance measure
Max-pooling Pooling size 2
CNN block 1 Kernel size 3 The performance of proposed OBCC-BiLSTM method is
Stride 1 determined based on metrics such as precision, accuracy,
Drop out 0.4 F-measure, and Recall.
filters 64
Attention pooling Pooling size 2 (a) Accuracy
Hidden units 256   This metric is defined as the rate of successfully
Fully connected 128 identifying the intrusion, which is given below,
Tneg + Tpos
Aacc = (20)
4 Experimental results Tneg + Tpos + Fneg + Fpos

(b) Precision
The simulation was run on the Python platform, with
  This metric is defined as the proportion of actually
an Intel(R) Core (TM) i7-1165G7 CPU running at
positive samples among all samples with positive pre-
2.80 GHz and 8.00 GB of memory from a Dell Inspiron
dictions, which is given below,
15 3511. We set the initial learning rate at 0.028, batch
size at 171, dropout at 0.4, activation at RELU, and Tpos
epoch at 50. Table 2 shows the ERFO parameter set- Ppcn = (21)
Fpos + Tpos
tings and Table 3 shows the configuration settings of
proposed OBCLSTM. (c) Recall
  It is defined as the percentage of predicted positive
4.1 Dataset description intrusion, which is given below,

In our work, we utilized four datasets, they are NSL-KDD99, Tpos

Rrecll = (22)
TUIDS, UNSW-NB15 and BoT-IoT dataset. Tpos + Fneg

Dataset-1: The NSL-KDD99 dataset includes 3,925,650 (d) F-measure

attacks and 972, 781 instances of regular traffic. Every   This metric is used for accurately classifying net-
record in the datasets has attributes of 41 that character- work data based on recall and precision, which is given
ise whether it’s a malicious attack or a regular flow. The below,
datasets as a whole have 41 features. The datasets have (
Ppcn
)
41 features total. Fmeasr = 2 × (23)
Ppcn + Rrecll
Dataset-2: Slay and Moustafa’s latest intrusion detection  
dataset is UNSW-NB15. It is made up of a dataset that where Tnegdenotes the true negative, Tpos signifies the
was gathered between January and February of 2015 and true positive, Fpos denotes the false positive values
contains real-world traffic networks totalling more than and Fneg denotes the false negative values.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6749

4.3 Comparative analysis Table 5  Performance analysis of proposed and recent techniques for
dataset-2
Based on accuracy, F-measure, recall and precision the com- Models Precision Accuracy F-measure Recall
parison of the OBCLSTM method is done with recent meth-
SDAE-ELM 84.9028 90.6035 97.0134 96.8865
ods like SDAE-ELM [25], CNN-TSO [26], PTDAE [27],
CNN-TSO 83.9876 91.5534 96.2509 96.8903
LOGNN [29] and FCM-SVM [30].
PTDAE 85.8015 92.7809 92.6429 96.2805
LOGNN 84.4590 91.7654 96.8903 95.2412
4.3.1 Evaluation on NSL‑KDD99 dataset
FCM-SVM 81.5421 94.5420 96.8865 94.4261
Proposed 86.1956 96.5679 98.3093 97.3796
Table 4 illustrates the examination results of pro-
posed OBCLSTM method and recent techniques. The
OBCLSTM method has obtained better performance
in terms of precision, recall, F-measure, and accuracy 4.3.2 Evaluation on UNSW‑NB15 dataset
when compared with recent techniques such as SDAE-
ELM, CNN-TSO, PTDAE, LOGNN and FCM-SVM. The outcomes derived from the OBCLSTM method in
The recent techniques fail to learn the behaviour-based comparison to established techniques for attack detection
features and flow-based features. So, it is difficult to are shown in Table 5. The results shows that the proposed
capture the interaction among hosts based on ports and method has precision (86.1956), recall (97.3796), F-meas-
destinations and to update the attack types on a regu- ure (98.3093), and accuracy (96.5679) when compared with
lar basis. Therefore, our proposed OBCLSTM method recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
introduces the BiCP, one channel is max-pooling layer LOGNN and FCM-SVM. The former methods fail to pre-
to learn behavior-based features and other channel is serve the long-term of the information from historical con-
attention pooling layer to learn flow-based features. This text. This detection results causes irrelevant, and the attack-
enhances the detection accuracy of precision. The pro- ers become more harmful. To overcome these issues, our
posed OBCLSTM method has high precision (84.6508), proposed OBCLSTM method introduces BiLSTM to extract
recall (99.9086), accuracy (91.2992), and F-meas- features in the time domain and has the ability to preserve
ure (99.619) when compared with recent techniques. the long-term of the information from historical context.
The recent techniques such as SDAE-ELM, CNN- This enhances the efficiency of intrusion detection. The
TSO, PTDAE, LOGNN and FCM-SVM has precision recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
of76.0785, 77.8034, 74.9807, 84.2014, and 83.9990. LOGNN, and FCM-SVM has precision of84.9028, 83.9876,
The recent techniques such as SDAE-ELM, CNN- 85.8015, 84.4590, and 81.5421. The recent techniques such
TSO, PTDAE, LOGNN and FCM-SVM has accuracy as SDAE-ELM, CNN-TSO, PTDAE, LOGNN, and FCM-
of83.8604, 84.4579, 89.6790, 90.1472, and 90.2950. SVM has accuracy of90.6035, 91.5534, 92.7809, 91.7654,
The recent techniques such as SDAE-ELM, CNN-TSO, and 94.5420. The recent techniques such as SDAE-ELM,
PTDAE, LOGNN and FCM-SVM has recall of 99.2479, CNN-TSO, PTDAE, LOGNN, and FCM-SVM has recall
99.5799, 99.3689, 96.2509, 95.2453 and 99.9086. The of 96.8865, 96.8903, 96.2805, 95.2412, and 94.4261. The
recent techniques such as SDAE-ELM, CNN-TSO, recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
PTDAE, LOGNN and FCM-SVM has F-measure of LOGNN, and FCM-SVM has F-measure of97.0134,
97.2456, 95.2484, 94.9349, 99.5609 and 99.57. 96.2509, 92.6429, 96.8903, and 96.8865.

Table 4  Performance analysis of proposed and recent techniques for Table 6  Performance analysis of proposed and recent techniques for
dataset-1 dataset-3
Models Precision Accuracy F-measure Recall Models Precision Accuracy F-measure Recall

SDAE-ELM 76.0785 83.8604 97.2456 99.2479 SDAE-ELM 83.3673 83.8823 95.2394 96.2355
CNN-TSO 77.8034 84.4579 95.2484 99.5799 CNN-TSO 82.9076 81.0957 91.7862 96.4376
PTDAE 74.9807 89.6790 94.9349 99.3689 PTDAE 83.9934 82.6094 92.3258 96.8903
LOGNN 84.2014 90.1472 99.5609 96.2509 LOGNN 84.2014 84.2014 90.1097 96.2805
FCM-SVM 83.9990 90.2950 99.57 95.2453 FCM-SVM 83.2160 84.4590 91.9180 96.9098
Proposed 84.6508 91.2992 99.619 99.9086 Proposed 85.3217 84.9386 97.9747 98.3093
6750 G. T V et al.

4.3.3 Evaluation on BoT‑IoT dataset precision, accuracy, F-measure, and recall due to the intro-
duction of ERFO, the best hyper parameter configuration
Table 6 shows the results obtained for proposed OBCLSTM for CNN to learn flow based and behaviour-based features.
method and recent techniques. The former methods can This leads to an accurate detection of intrusion. The pro-
able to detect only known attacks, whereas unable to detect posed OBCLSTM method has high precision (85.6312),
new types of cyber threats. So, the proposed OBCLSTM recall (98.5123), accuracy (90.9352), and F-measure
method introduces BiCP and BiLSTM to learn the behav- (98.8015) when compared with recent techniques. The
iour based and flow-based features, and can extract time recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
domain features. This helps to detect the unknown attacks LOGNN, and FCM-SVM has precision of82.0245, 80.9912,
from the unknown network-connected devices. The pro- 81.5918, 83.3937, and 81.8673. The recent techniques such
posed OBCLSTM method has high precision (85.3217), as SDAE-ELM, CNN-TSO, PTDAE, LOGNN, and FCM-
recall (98.3093), accuracy (84.9386), and F-measure SVM has accuracy of86.1154, 85.7023, 88.3564, 88.7247,
(97.9747) when compared with recent techniques. The and 88.1192. The recent techniques such as SDAE-ELM,
recent techniques such as SDAE-ELM, CNN-TSO, PTDAE, CNN-TSO, PTDAE, LOGNN, and FCM-SVM has recall
LOGNN, and FCM-SVM has precision of83.3673, 82.9076, of 96.4376, 96.2355, 97.7349, 92.0965, and 90.1097. The
83.9934, 84.2014, and 83.2160. The recent techniques such recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
as SDAE-ELM, CNN-TSO, PTDAE, LOGNN, and FCM- LOGNN, and FCM-SVM has F-measure of97.4509,
SVM has accuracy of83.8823, 81.0957, 82.6094, 84.2014, 94.4285, 96.4994, 96.1683, and 96.4037.
and 84.4590. The recent techniques such as SDAE-ELM,
CNN-TSO, PTDAE, LOGNN, and FCM-SVM has recall 4.4 Statistical analysis
of 96.2355, 96.4376, 96.8903, 96.2805, and 96.9098. The
recent techniques such as SDAE-ELM, CNN-TSO, PTDAE, A nonparametric test called the Friedman test is used to
LOGNN, and FCM-SVM has F-measure of95.2394, evaluate how well classifiers perform across various data-
91.7862, 92.3258, 90.1097, and 91.9180. sets. After the null hypothesis is rejected, a post-hoc test
is carried out to establish the pairwise comparisons. The
4.3.4 Evaluation on TUIDS dataset null hypothesis (H0) states that there are no variations in
the performance of each classifier, whereas the alternative
Table 7 shows the performance analysis of proposed and hypothesis (H1) suggests that there are differences in how
recent methods. The proposed OBCLSTM method has high well at least one classifier works. The Friedman test statistic
can be determined in Eq. (24).

Table 7  Performance analysis of proposed and recent techniques for (n − 1)X

FS = (24)
dataset-4 n(l − 1)X
Models Precision Accuracy F-measure Recall X can be determined in Eq. (25).
SDAE-ELM 82.0245 86.1154 97.4509 96.4376 ( )2
CNN-TSO 80.9912 85.7023 94.4285 96.2355 12 ∑l n(l + 1)
X= Fj − (25)
PTDAE 81.5918 88.3564 96.4994 97.7349 nl(l + 1) j=1 2
LOGNN 83.3937 88.7247 96.1683 92.0965
X is distributed with respect to degrees of freedom.
FCM-SVM 81.8673 88.1192 96.4037 90.1097
The classifiers from j = 1, 2, 3…. l is ranked as Fj . Fjcan
Proposed 85.6312 90.9352 98.8015 98.5123
be determined in Eq. (26)

Table 8  Friedman average rank Techniques Dataset-1 Dataset-2 Dataset-3 (BoT-IoT) Dataset-4 (TUIDS) Friedman P-value
based on F-measure (NSL- (UNSW- avg.Rank
KDD99) NB15)

SDAE-ELM 97.2456 97.0134 95.2394 97.4509 2.25

CNN-TSO 95.2484 96.2509 91.7862 94.4285 3.5 0.1354
PTDAE 94.9349 92.6429 92.3258 96.4994 2.75
LOGNN 99.5609 96.8903 90.1097 96.1683 2.35
FCM-SVM 99.57 96.8865 91.9180 96.4037 2.65
Proposed 99.619 98.3093 97.9747 98.8015 1.5
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6751

other techniques across all datasets. This suggests that the

∑n
(26)
( )
Fj = F Yij
i=1 Proposed OBCLSTM method is highly effective in achieving
where n and l signify the dataset’s number and classifier’s a balance between precision and recall, making it a promis-
number. ing solution for intrusion detection across diverse scenarios.
Table 8 presents the results of the Friedman average Table 9 presents the results of the Friedman average
rank test based on F-measure for various intrusion detec- rank test based on Recall for various intrusion detection
tion techniques across four different datasets: Dataset-1 techniques across four datasets: Dataset-1 (NSL-KDD99),
(NSL-KDD99), Dataset-2 (UNSW-NB15), Dataset-3 Dataset-2 (UNSW-NB15), Dataset-3 (BoT-IoT) and Data-
(BoT-IoT) and Dataset-4 (TUIDS). The F-measure is a cru- set-4 (TUIDS). Recall is a critical metric in intrusion
cial metric that balances precision and recall in evaluating detection systems as it measures the ability of the system
the performance of intrusion detection systems. The tech- to correctly identify all relevant instances of attacks. The
niques evaluated include SDAE-ELM, CNN-TSO, PTDAE, techniques evaluated in Table 9 include SDAE-ELM, CNN-
LOGNN, FCM-SVM and the Proposed OBCLSTM method. TSO, PTDAE, LOGNN, FCM-SVM, and the Proposed
The numerical values in each cell of the table represent the OBCLSTM method. Each cell in the table represents the
F-measure scores achieved by each technique on the respec- recall scores achieved by the respective technique on the
tive datasets. The Friedman average rank is calculated to corresponding dataset.
assess the overall performance of each technique across all The Friedman average rank is calculated, the Pro-
datasets. posed OBCLSTM method consistently achieves the
The Friedman average rank is indicative of the ranking lowest Friedman average rank (1.5), indicating superior
of each technique based on its F-measure across the data- recall performance compared to other techniques across
sets. A lower Friedman average rank signifies better perfor- all datasets. This implies that the Proposed OBCLSTM
mance. The P-value, which determines the significance of method excels in correctly identifying instances of attacks
the observed differences in ranks, is also provided. A P-value while minimizing false negatives. The high recall scores
greater than 0.05 implies that the observed differences are obtained by the Proposed OBCLSTM method underscore
not statistically significant, leading to the acceptance of the its effectiveness in detecting a wide range of attacks
null hypothesis. In this context, the Proposed OBCLSTM across diverse datasets, making it a promising solution
method consistently attains the lowest Friedman average for intrusion detection tasks.
rank (1.5), indicating superior performance compared to Table 10 presents the results of the Friedman average
rank test based on precision for various intrusion detection

Table 9  Friedman average rank Techniques Dataset-1 Dataset-2 Dataset-3 (BoT-IoT) Dataset-4 (TUIDS) Friedman P-value
based on Recall (NSL- (UNSW- avg.Rank
KDD99) NB15)

SDAE-ELM 99.2479 96.8865 96.2355 96.4376 2.65

CNN-TSO 99.5799 96.8903 96.4376 96.2355 2.5
PTDAE 99.3689 96.2805 96.8903 97.7349 2.65 0.9256
LOGNN 96.2509 95.2412 96.2805 92.0965 2.35
FCM-SVM 95.2453 94.4261 96.9098 90.1097 3.5
Proposed 99.9086 97.3796 98.3093 98.5123 1.5

Table 10  Friedman average Techniques Dataset-1 Dataset-2 Dataset-3 (BoT-IoT) Dataset-4 (TUIDS) Friedman P-value
rank based on precision (NSL- (UNSW- avg.Rank
KDD99) NB15)

SDAE-ELM 76.0785 84.9028 83.3673 82.0245 1.975

CNN-TSO 77.8034 83.9876 82.9076 80.9912 3.75
PTDAE 74.9807 85.8015 83.9934 81.5918 2.650 0.3806
LOGNN 84.2014 84.4590 84.2014 83.3937 2.5
FCM-SVM 83.9990 81.5421 83.2160 81.8673 1.8
Proposed 84.6508 86.1956 85.3217 85.6312 1.625
6752 G. T V et al.

techniques across four datasets: Dataset-1 (NSL-KDD99), normal and attack instances, contributing to an overall
Dataset-2 (UNSW-NB15), Dataset-3 (BoT-IoT) and Data- robust intrusion detection capability. The high accuracy
set-4 (TUIDS). Precision is a crucial metric in intrusion scores obtained by the Proposed OBCLSTM method under-
detection systems as it measures the accuracy of the sys- score its effectiveness and reliability in real-world intrusion
tem in correctly identifying instances flagged as attacks. detection scenarios.
The techniques evaluated in Table 10 include SDAE-ELM, Tables 8, 9, 10 and 11 shows the Friedman average rank
CNN-TSO, PTDAE, LOGNN, FCM-SVM and the Proposed test. If p < 0.05, then the null hypothesis is accepted. Here
OBCLSTM method. Each cell in the table represents the the p-value for all datasets is greater than 0.05, so the null
precision scores achieved by the respective technique on the hypothesis is accepted.
corresponding dataset.
The Friedman average rank is calculated, the Proposed 4.5 ROC curve
OBCLSTM method consistently achieves the lowest Fried-
man average rank (1.625), indicating superior precision Figure 3 illustrates the ROC curve, which shows that our
performance compared to other techniques across all data- proposed OBCLSTM method attain a better detection rate
sets. This implies that the Proposed OBCLSTM method than the other methods. It is evident from figure that the pro-
excels in accurately identifying instances of attacks while posed OBCLSTM method has detection rate of 99.1% while
minimizing false positives. The high precision scores the FPR produces 1.37%, which performs better than other
obtained by the Proposed OBCLSTM method underscore recent techniques such as SDAE-ELM, CNN-TSO, PTDAE,
its effectiveness in distinguishing attacks from normal LOGNN, and FCM-SVM. The existing SDAE-ELM method
behavior, making it a robust solution for intrusion detec- produces 98% detection rate while 1.5% FPR, CNN-TSO has
tion tasks. detection rate of 78% while 3% FPR, PTDAE has detection
Table 11 presents the outcomes of the Friedman average rate of 82% while 2.8% FPR, LOGNN has detection rate of
rank test based on accuracy for multiple intrusion detection 75% while 5% FPR, and FCM-SVM has detection rate of
techniques, evaluated across four distinct datasets: Dataset-1 65% while 8% FPR. Therefore, our proposed OBCLSTM
(NSL-KDD99), Dataset-2 (UNSW-NB15), Dataset-3 (BoT- method has ability to identify the protocol HTTP and DNS
IoT) and Dataset-4 (TUIDS). Accuracy is a critical metric are attacked or not.
in evaluating the overall performance of intrusion detec-
tion systems, as it reflects the system’s ability to correctly 4.6 Analysis of convergence
classify both normal and attack instances. The techniques
considered in Table 11 include SDAE-ELM, CNN-TSO, Figure 4 shows the analysis of convergence with ERFO
PTDAE, LOGNN, FCM-SVM and the Proposed OBCLSTM and other algorithms. It shows that the ERFO converges
method. Each cell in the table represents the accuracy scores faster than another optimization such as. By comparing the
achieved by the respective technique on the corresponding convergence curves of Salp Swarm Algorithm (SSA) [37],
dataset. RFO [38] and Moth-Flame Optimization (MFO) [39], the
The Friedman average rank is computed, the Proposed proposed method has a small chance of reaching a local
OBCLSTM method consistently achieves the lowest Fried- optimum. The convergence graph shows that ERFO has
man average rank (1.75), indicating superior accuracy per- effectively balanced local and global search capabilities.
formance compared to other techniques across all datasets. This enhances the tuning the best configuration of hyper
This implies that the Proposed OBCLSTM method excels parameters, which improves the performance of intrusion
in achieving a balance between correctly identifying both detection among various protocols.

Table 11  Friedman average Techniques Dataset-1 Dataset-2 Dataset-3 (BoT-IoT) Dataset-4 (TUIDS) Friedman P-value
rank based on accuracy (NSL- (UNSW- avg.Rank
KDD99) NB15)

SDAE-ELM 83.8604 90.6035 83.8823 86.1154 2.75

CNN-TSO 84.4579 91.5534 81.0957 85.7023 3.25
PTDAE 89.6790 92.7809 82.6094 88.3564 2.25 0.2506
LOGNN 90.1472 91.7654 84.2014 88.7247 2.5
FCM-SVM 90.2950 94.5420 84.4590 88.1192 2.4
Proposed 91.2992 96.5679 84.9386 90.9352 1.75
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6753

Fig. 3  ROC curve (a) Dataset-1 (b) Dataset-2 (c) Dataset-3 (d) Dataset-4

Fig. 4  Convergence curve

4.7 Time complexity individuals and creating new ones be O((D × n))2 . Then the
time complexity is O(T × D2 × n2 × 3).
The ERFO algorithm time complexity is analysed utiliz- Figure 5 displays the validation accuracy, training
ing the procedure. Assume n for population size, D for loss, validation loss, and training accuracy in the training
the dimension, and T for iterations. All individuals are process. In each training cycle, the proposed OBCLSTM
arranged in each ERFO iteration, which yields, in the worst method has minimum training loss and high accuracy
case, O((D × n))2operations. In the worst scenario, each fox on training set when compared with recent techniques
will be changed, increasing the time complexity of calcula- such as SDAE-ELM, CNN-TSO, PTDAE, LOGNN and
tions to O(D × n). In the worst situation, deleting the worst
6754 G. T V et al.

Fig. 5  Training loss, validation loss, training accuracy and validation accuracy for dataset-1, dataset-2, dataset-3 and dataset-4

FCM-SVM. This shows that the proposed OBCLSTM Figure 6 shows the confusion matrix of four datasets.
method has a better training result, showing its effective- It shows that the majority of the record types classifica-
ness in training models. Also, the loss value and accuracy tion was accurate. The true label is represented by the
on the validation set shows that the proposed OBCLSTM vertical axis, and the predicted label is represented by
method is capable of obtaining lower loss values and the horizontal axis. From figure, it is evident that the
higher accuracy in each training cycle. As a result, the proposed OBCLSTM method gives better performance
proposed algorithm’s model’s prediction effect is verified. in classification of all record types.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6755

Fig. 5  (continued)

4.8 Discussion of the Bidirectional Convolutional LSTM (BiCP layer and

BiLSTM). Notably, leveraging ERFO for hyperparameter
The proposed OBCLSTM method represents a significant tuning contributes to enhanced CNN learning, showcasing
leap forward in enhancing intrusion detection systems tai- superior accuracy, efficiency and adaptability.
lored for cloud computing environments. This model stands SDAE-ELM [25], CNN-TSO [26], PTDAE [27], LOGNN
out by excelling in capturing both behavior-based and flow- [29] and FCM-SVM [30], the comparative models in, exhibit
based features, achieved through the innovative integration varying degrees of performance across the NSL-KDD99,
6756 G. T V et al.

Fig. 6  Confusion matrix for (a) NSL-KDD99 dataset (b) BoT-IoT dataset (c) UNSW-NB15 dataset (d) TUIDS dataset

UNSW-NB15, BoT-IoT and TUIDS datasets in contrast to nuanced and technically superior approach to network
our proposed OBCLSTM. SDAE-ELM, though achieving security.
competitive results, faces challenges in effectively learning The Hybrid Clustering and Classification Model primar-
both behavior-based and flow-based features, limiting its ily relies on K-means and Gaussian Mixture Model (GMM)
ability to adapt to diverse cyber threats. CNN-TSO, while clustering, combined with the Random Forest (RF) clas-
demonstrating notable accuracy, grapples with a higher sifier. While effective, its focus on log and event analysis,
false-positive rate, potentially compromising intrusion pattern matching and threshold evaluation is predominant. In
detection efficacy. PTDAE struggles to preserve long-term contrast, OBCLSTM integrates Bidirectional Convolutional
information, impacting its efficiency in detecting attacks LSTM layers (BiCP and BiLSTM) for comprehensive fea-
accurately. LOGNN, despite showcasing robust perfor- ture extraction. The BiCP layer adeptly captures behavior-
mance, encounters challenges in capturing comprehensive based and flow-based features, providing a more nuanced
features critical for intrusion detection. FCM-SVM, while understanding of network patterns.
effective, demonstrates limitations in detecting unknown The RNN Framework concentrates on different RNN
attacks. In contrast, OBCLSTM surpasses these models by variations, such as LSTM, GRU and Simple RNN. Despite
integrating Bidirectional Convolutional LSTM layers, effec- achievements in improved test accuracy, it grapples with
tively capturing behavior-based, flow-based, and temporal challenges related to computational cost, overfitting, inter-
features. The use of ERFO further refines hyperparameter pretability and susceptibility to adversarial attacks. In con-
configurations, enhancing CNN learning and positioning trast, OBCLSTM introduces a hybrid architecture that avoids
OBCLSTM as a versatile and advanced intrusion detection the singular focus on recurrent architectures. By incorporat-
methodology across diverse datasets. ing Bidirectional Convolutional LSTM layers, it provides a
In direct comparison to existing intrusion detection meth- more balanced and robust solution to these challenges.
odologies, including the Hybrid Clustering and Classifica- The Efficient Deep CNN-BiLSTM Model successfully
tion Model [33], the Recurrent Neural Networks (RNNs) combines CNN and BiLSTM networks for intrusion detec-
Framework [32] and the Efficient Deep CNN-BiLSTM tion. While showcasing superior performance, it acknowl-
Model [34], the OBCLSTM methodology introduces a edges longer training periods and the need for further
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6757

research into attack behavioral patterns. OBCLSTM diverges to optimize the hyperparameter configuration for effective
by incorporating Bidirectional Convolutional LSTM layers feature learning in CNN. Finally, the fully connected layer
for feature extraction, offering a unique synergy of capabili- makes use of these features to determine whether or not the
ties in capturing behavior-based, flow-based and temporal HTTP and DNS protocols are being attacked. The perfor-
features. Bidirectional Convolutional LSTM layers empower mance result shows that the proposed OBCLSTM model
OBCLSTM to capture a richer set of features, making it attains better results in terms of precision, recall, ROC
a robust and advanced solution for intrusion detection in curve, accuracy and F-measure. While OBCLSTM excels
network security. in its objective of enhancing intrusion detection, potential
The implications of the OBCLSTM model are significant challenges include the need for computational resources
for advancing intrusion detection in cloud environments. Its due to its advanced features and the complexity associated
ability to comprehensively capture behavior-based, flow- with fine-tuning the ERFO parameters. The future scope of
based and temporal features suggests practical applications the proposed OBCLSTM lies in refining its adaptability to
in enhancing cybersecurity. The model’s potential impact evolving cyber threats through continuous optimization and
lies in improving the accuracy and efficiency of detecting integration of advanced deep learning techniques.
malicious activities, addressing existing limitations in cur-
rent IDS systems. Furthermore, the OBCLSTM framework
Authors’ contributions All the authors have participated in writing the
paves the way for future research directions, such as refining manuscript and have revised the final version. All authors read and
feature extraction techniques, exploring diverse protocols approved the final manuscript.
and optimizing hyperparameter configurations. All authors contributed to the study conception and design. Material
Revisiting the objectives outlined in the introduction, the preparation, data collection and analysis were performed by Geetha T
V, Deepa A J, and Mary Linda M. The first draft of the manuscript was
OBCLSTM model has successfully achieved its goals. The written by Geetha T V and all authors commented on previous versions
integration of Bidirectional Convolutional LSTM layers has of the manuscript. All authors read and approved the final manuscript.
proven effective in capturing behavior-based, flow-based and Conceptualization: Geetha T V; Methodology: Geetha T V; Formal
temporal features, aligning with the initial expectations. The analysis and investigation: Geetha T V, Deepa A J, and Mary Linda
M., Writing - original draft preparation: Geetha T V, Deepa A J, and
results affirm the model’s capability to address the limita- Mary Linda M., Writing - review and editing: Deepa A J, Mary Linda
tions of existing methods, contributing significantly to the M; Supervision: Mary Linda M.
field of intrusion detection in cloud environments. In con-
clusion, the OBCLSTM model stands as an innovative and Funding There is no funding for this study.
successful approach, offering valuable insights for advancing Data Availability Data will not be available as authors are not interested
cybersecurity measures in cloud environments and contrib- to disclose the data.
uting to the broader scientific community’s understanding
of intrusion detection methodologies. Declarations
Ethical approval This article does not contain any studies with human
participants and/or animals performed by any of the authors.

5 Conclusion Informed consent There is no informed consent for this study.

The previous IDS systems cannot determine or recognize Conflict of interest Authors declares that they have no conflict of
new types of cyber threats due to the emergence of new interest.
and unknown network-connected devices. Also, the existing
methods suffer from a lack of learning flow-based features
and behaviour-based features, which leads to inaccuracies
in the detection of attacks. Moreover, there is an inability References
to extract the features in the time domain. To overcome this
1. Singh P, Ranga V (2021) Attack and intrusion detection in cloud
issue, an OBCLSTM method is introduced to detect whether computing using an ensemble learning approach. Int J Inform
the protocol HTTP or DNS is attacked or not. In the pre- Technol 13(2):565–571
processing, normal features are converted into numerical 2. Rabbani M, Wang YL, Khoshkangini R, Jelodar H, Zhao R,
features by one hot encoder and numerical features are nor- Hu P (2020) A hybrid machine learning approach for malicious
behaviour detection and recognition in cloud computing. J Netw
malized using Z-score normalization. Then the vectors are Comput Appl 151
given to the OBCLSTM model, and here the BiCP layer is 3. Lu KD, Zeng GQ, Luo X, Weng J, Luo W, Wu Y (2021) Evolu-
used to learn the behavior based and flow-based features in tionary deep belief network for cyber-attack detection in indus-
the HTTP and DNS protocols. The BiLSTM method is used trial automation and control system. IEEE Trans Industr Inf
17(11):7618–7627
to extract the time domain features. The ERFO is employed
6758 G. T V et al.

4. Al S, Dener M (2021) STL-HDL: a new hybrid network intru- 24. Basiri ME, Nemati S, Abdar M, Cambria E, Acharya UR
sion detection system for imbalanced dataset on big data envi- (2021) ABCDM: an attention-based bidirectional CNN-RNN
ronment. Comput Secur 110 deep model for sentiment analysis. Future Gener Comput Syst
5. Meryem A, Ouahidi BE (2020) Hybrid intrusion detection sys- 115:279–294
tem using machine learning. Netw Secur 5:8–19 25. Wang Z, Liu Y, He D, Chan S (2021) Intrusion detection methods
6. Almiani M, AbuGhazleh A, Al-Rahayfeh A, Atiewi S, Razaque based on integrated deep learning model. Comput Secur 103
A (2020) Deep recurrent neural network for IoT intrusion detec- 26. Samriya JK, Kumar N (2020) A novel intrusion detection system
tion system. Simul Model Pract Theory 101 using hybrid clustering-optimization approach in cloud comput-
7. Popoola SI, Adebisi B, Hammoudeh M, Gui G, Gacanin ing. Mater Today Proc 2(1):23–54
H (2020) Hybrid deep learning for botnet attack detection 27. Fatani A, Abd Elaziz M, Dahou A, Al-Qaness MA, Lu S
in the internet-of-things networks. IEEE Internet Things J (2021) IoT intrusion detection system using deep learning
8(6):4944–4956 and enhanced transient search optimization. IEEE Access
8. Li M, Wang D (2017) Insights into randomized algorithms for 9:123448–123464
neural networks: practical issues and common pitfalls. Inf Sci 28. Kholidy HA (2021) Detecting impersonation attacks in cloud
382:170–178 computing environments using a centric user profiling approach.
9. Wang D, Li M (2017) Stochastic configuration networks: Future Gener Comput Syst 117:299–320
fundamentals and algorithms. IEEE Trans Cybernetics 29. Kunang YN, Nurmaini S, Stiawan D, Suprapto BY (2021) Attack
47(10):3466–3479 classification of an intrusion detection system using deep learning
10. Li M, Wang D (2021) 2-D stochastic configuration networks for and hyperparameter optimization. J Inform Secur Appl 58:102804
image data analytics. IEEE Trans Cybernetics 51(1):359–372 30. Wang Z, Xu Z, He D, Chan S (2021) Deep logarithmic neu-
11. Wang W, Du X, Shan D, Qin R, Wang N (2020) Cloud intru- ral network for internet intrusion detection. Soft Comput
sion detection method based on stacked contractive auto- 25(15):10129–10152
encoder and support vector machine. IEEE Trans Cloud 31. Jaber AN, Rehman SU (2020) FCM–SVM based intrusion detec-
Comput 10(3):1634–1646 tion system for cloud computing environment. Cluster Comput
12. Nguyen MT, Kim K (2020) Genetic convolutional neural network 23(4):3221–3231
for intrusion detection systems. Future Generation Comput Syst 32. Kasongo SM (2023) A deep learning technique for intrusion
113:418–427 detection system using a recurrent neural networks based frame-
13. Pooja TS, Shrinivasacharya P (2021) Evaluating neural networks work. Comput Commun 199:113–125
using bi-directional LSTM for network IDS (intrusion detection 33. Samunnisa K, Kumar GS, Madhavi K (2023) Intrusion detection
systems) in cyber security. Global Transitions Proc 2(2):448–454 system in distributed cloud computing: hybrid clustering and clas-
14. Sai Sindhu Theja R, Shyam GK (2021) An efficient metaheuristic sification methods. Meas: Sens 25:100612
algorithm based feature selection and recurrent neural network for 34. Hnamte V, Hussain J (2023) DCNNBiLSTM: an efficient hybrid
DoS attack detection in cloud computing environment. Appl Soft deep learning-based intrusion detection system. Telematics Inf
Comput 100 Rep 10
15. Imrana Y, Xiang Y, Ali L, Abdul-Rauf Z (2021) A bidirectional LSTM 35. Larriva-Novo X, Villagrá VA, Vega-Barbas M, Rivera D, Sanz
deep learning approach for intrusion detection. Expert Syst Appl 185 Rodrigo M (2021) An IoT-focused intrusion detection system
16. Rehmer A, Kroll A (2020) On the vanishing and exploding gra- approach based on preprocessing characterization for cybersecu-
dient problem in gated recurrent units. IFAC-Papers OnLine rity datasets. Sensors 21(2)
53(2):1243–1248 36. Peng T, Zhang C, Zhou J, Nazir MS (2021) An integrated frame-
17. Landi F, Baraldi L, Cornia M, Cucchiara R (2021) Working mem- work of bi-directional long-short term memory (BiLSTM) based
ory connections for LSTM. Neural Netw 144:334–341 on sine cosine algorithm for hourly solar radiation forecasting.
18. Li M, Sonoda S, Cao F, Wang YG, Liang J (2023) How powerful are Energy 221
shallow neural networks with bandlimited random weights? In Inter- 37. Faris H, Mirjalili S, Aljarah I, Mafarja M, Heidari AA (2020)
national Conference on Machine Learning. PMLR. pp 19960–19981 Salp swarm algorithm: theory, literature review, and application in
19. Hossain MD, Inoue H, Ochiai H, Fall D, Kadobayashi Y (2020) extreme learning machines. Nature-inspired optimizers: theories,
LSTM-based intrusion detection system for in-vehicle can bus literature reviews and applications, pp 185–199
communications. IEEE Access 8:185489–185502 38. Połap D, Woźniak M (2021) Red fox optimization algorithm.
20. Ren Z, Shen Q, Diao X, Xu H (2021) A sentiment-aware deep Expert Syst Appl 166
learning approach for personality detection from text. Inf Process 39. Shehab M, Abualigah L, Al Hamad H, Alabool H, Alshinwan
Manag 58(3) M, Khasawneh AM (2020) Moth–flame optimization algorithm:
21. Kasongo SM, Sun Y (2021) A deep gated recurrent unit based variants and applications. Neural Comput Appl 32(14):9859–9884
model for wireless intrusion detection system. ICT Express
7(1):81–87 Publisher’s Note Springer Nature remains neutral with regard to
22. Sumaiya Thaseen I, Saira Banu J, Lavanya K, Rukunuddin Ghalib jurisdictional claims in published maps and institutional affiliations.
M, Abhishek K (2021) An integrated intrusion detection system
using correlation-based attribute selection and artificial neural Springer Nature or its licensor (e.g. a society or other partner) holds
network. Trans Emerg Telecommun Technol 32(2):e4014 exclusive rights to this article under a publishing agreement with the
23. Liu J, Gao Y, Hu F (2021) A fast network intrusion detection author(s) or other rightsholder(s); author self-archiving of the accepted
system using adaptive synthetic oversampling and light GBM. manuscript version of this article is solely governed by the terms of
Computers Secur 106 such publishing agreement and applicable law.
Deep learning method for efficient cloud IDS utilizing combined behavior and flow-based… 6759

Geetha T V obtained her B.E Dr. Mary Linda M received the

degree in Computer Science B.E Degree in Electrical and
and Engineering in 2008 from Electronics Engineering from MS
Anna University, Chennai, M.E University in 2002, M.E degree
degree in Computer Science and in power systems from Kalasal-
Engineering in 2013 from Anna ingam College of Engineering in
University, Chennai and Ph. D 2005 and Ph. D degree in power
degree in Information and Com- system stability from Anna Uni-
munication Engineering from versity Chennai in 2012. She
Anna University Chennai in is working as Professor in the
2024. In 2009 she joined as Lec- department of Electrical and
turer and now working as Assis- Electronics Engineering in KIT-
tant Professor in the Department Kalaignarkarunanidhi Institute
of Artificial Intelligence and Data of Technology, Coimbatore. She
Science at St. Xavier’s Catholic is a life time member of ISTE.
College of Engineering, Nager- She published 37 International
coil. Her research interests include Cloud Computing and Security, Journals and three books. Her areas of interest are power systems,
Machine Learning and Data Analytics. She has published many papers control systems, optimization techniques.
in national and international journal in areas such as network security
and Cloud computing. She is a life time member of Indian Society for
Technical Education (ISTE).

Deepa A J obtained her B.E

degree in Computer Science
and Engineering in 2001 from
MS University and M.E degree
in Computer Science and Engi-
neering in 2008 from Anna Uni-
versity, Chennai. She is the Uni-
versity Rank Holder in PG. She
received Ph.D degree in Com-
puter Science and Engineering
from Anna University Chennai
in 2015. Right from 2001 she
is in the Department of Computer
Science and Engineering under
various designations. Currently
under her guidance 2 Research
Scholars are pursuing Ph.D. Under her guidance three research stu-
dent had completed their research. Her research interests include ad
hoc network security, computational intelligence, Data mining and
Cloud Computing. She has published many papers in national and
international journal in areas such as network security, Data mining
and Cloud computing. She is a member of Computer Society of India
and a life time member of ISTE.