Utilizing Adaptive Machine Learning Algorithms for Information Risk Warning and Network Security Scenario Awareness in Cloud Computing Environments

Summary

The paper proposes a novel Machine Learning (ML)-based solution of adaptive network security in a cloud-based system that integrates hierarchical multi-label classification and a dynamic trust evaluation system to advance the accuracy of threat detection and decrease the number of false positives.

Abstract

This study proposes a novel framework for network security situational awareness and risk warning in cloud computing environments, integrating adaptive Machine Learning (ML), Hierarchical Multi-Label Classification (HMC), and a dynamic trust evaluation mechanism based on the cloud model. The complexity, diversity, and real-time nature of emerging cyberattacks-such as zero-day exploits, distributed denial-of-service (DDoS), and botnets-pose significant challenges to traditional rule-based and static detection methods. To address these challenges, we developed an effective SDN-based cloud architecture utilizing the Ryu OpenFlow controller and OpenFlow switches. This architecture enables real-time link information collection, dynamic scheduling, and scalable, reliable data transmission. The hierarchical classification framework suggested can break multiclass problems into binary tasks, alleviating the effect of sample imbalance and enhancing the recognition of low-frequency attacks, including User to Root (U2R). Ensemble learning techniques, including AdaBoost and Bagging, further enhance detection accuracy for fine-grained attack types. Experiments conducted on DDoS datasets, cloud traffic data, and simulations in Mininet and EstiNet demonstrate that the combined ML-HMC-trust approach significantly improves detection precision, reduces false positives, and enables real-time response. These results confirm that integrating adaptive learning, hierarchical classification, and dynamic trust evaluation provides a robust and scalable solution for securing large-scale cloud platforms.

Introduction

With the widespread application of cloud computing technology in various industries, the scale and amount of data in information systems are increasing rapidly, and network threats are becoming more complex, hidden, and dynamic^1,2. Traditional security defense mechanisms based on rules and static models are no longer able to meet the requirements of real-time detection with accurate early warning when facing changing attack strategies, zero-day vulnerabilities, and large-scale distributed attacks³. Therefore, leveraging adaptive ML algorithms to fully integrate distributed data processing and intelligent analysis capabilities within cloud computing platforms to achieve a comprehensive perception of network security situation and effective early warning of information risks represents a critical challenge in the current information security landscape⁴. This research not only has important theoretical significance for improving the existing security protection system, but also offers strong support for ensuring the security of the national key information infrastructure and enterprise core data⁵.

There are multiple challenges in realizing network security situation awareness and information risk warning in a cloud computing environment: data types aggregated in the cloud platform are numerous and the sources are complex, making data preprocessing, feature extraction and fusion tasks increasingly arduous; in the face of the increasing network traffic and rapidly changing attack scenarios, the system is required to respond in a very short time, and real-time detection and warning have become technical bottlenecks; the amount of normal traffic is very different from that of attack traffic, and traditional algorithms have low accuracy when processing small sample categories (such as U2R, network attacks, etc.), and there is a large risk of misjudgment; in a complex network environment, trust relationships are affected by multiple factors and are random and uncertain^6,7. Traditional trust assessment methods based on fixed thresholds are difficult to reflect the real state and are easily interfered with by abnormal data. To address these multi-dimensional limitations, this research presents an integrated framework that synergizes adaptive machine learning, hierarchical multi-label classification, and a dynamic cloud-model-based trust evaluation mechanism. This fusion of techniques applied within an SDN-driven cloud environment goes beyond incremental refinement by enabling fine-grained recognition of low-frequency attacks, real-time trust adaptation, and scalable situational awareness, which existing methods have not simultaneously achieved.

Cloud computing environments generate massive, highly dynamic, and heterogeneous network traffic, making traditional intrusion detection systems (IDS) unable to accurately identify sophisticated and minority attack types such as U2R and R2L. Existing deep learning (DL)-based IDS solutions improve detection accuracy but still suffer from high computational overhead, slow real-time response, and poor handling of uncertain or evolving trust relationships between network entities. Moreover, most current models operate as flat classifiers and lack mechanisms for fine-grained, hierarchical decision-making or dynamic trust evaluation. These limitations create a critical gap in developing an IDS that can simultaneously deliver real-time detection, accurate minority-class recognition, and reliable trust-aware risk assessment in large-scale cloud environments.

In the existing research on network security situation awareness and information risk warning, many studies use methods such as K-nearest neighbor (KNN) and support vector machine (SVM) to classify and detect network traffic. These algorithms have the advantages of high computational efficiency and easy implementation, especially when performing preliminary screening of large amounts of data^8,9. However, their main shortcomings are reflected in several aspects: when faced with most normal traffic and a small number of attack samples in a cloud environment, these traditional ML methods often ignore information from a few categories, resulting in low recognition rates for fine-grained attacks (such as U2R, network vulnerability attacks, etc.); single models are usually sensitive to noise and data outliers, lack the capability to adapt to dynamically changing attack scenarios, and are prone to overfitting or insufficient generalization^10,11.

In recent years, DL methods such as Multi-Layer Perceptron (MLP), CNN, Recurrent Neural Network (RNN), Long Short-Term Memory Network (LSTM), and Gated Recurrent Unit (GRU) have been increasingly applied in the field of network security. With the powerful feature-learning and nonlinear-mapping capabilities of deep neural networks, these methods have significantly improved detection accuracy and enhanced the ability to capture complex attack behaviors compared to traditional ML¹². However, they have high requirements for computing resources and training data. Especially in the big data traffic context in cloud computing environments, there is still room for improvement in training overhead and real-time inference speed. When identifying classes with few samples, due to data imbalance, DL models have low detection rates for some fine-grained attacks (such as U2R, botnets) due to class bias¹³. To make up for the limitations of a single model in dealing with data imbalance and multiclass attack identification, some studies have proposed ensemble learning-based solutions, such as Bagging and Boosting, which expand the overall prediction accuracy by combining decisions of multiple classifiers¹⁴. At the same time, the Hierarchical Multiclass Classification (HMC) architecture decomposes the multiclass classification problem into multiple binary classification sub-problems, thereby achieving more refined recognition for classes with fewer samples. However, integrated models often face problems such as high computing resource usage and increased response time during deployment, especially in cloud computing real-time monitoring systems, where real-time requirements increase the pressure on system resources¹⁵.

In response to the problem of dynamic trust relationship evaluation in the network, some studies have introduced cloud model theory, which constructs a trust affiliation cloud by describing the fuzziness and randomness of the trust attributes of each entity, and then uses cloud droplets, entropy, super entropy, and other indicators for quantitative evaluation¹⁶. When facing real-time updated network trust data, the update rate and computational efficiency of existing cloud model methods may find it difficult to meet the requirements of high-frequency dynamic warning; the model is highly sensitive to evaluation data, and abnormal data or noise information may have a significant interference with the overall trust evaluation, affecting subsequent risk warning decisions.

In view of the many shortcomings of current research in detection accuracy, real-time performance, data balance processing, and trust evaluation, this paper proposes a new defense system that comprehensively utilizes adaptive ML algorithms, hierarchical multiclass classification strategies, and cloud model trust evaluation for network security situation awareness and information risk warning in cloud computing environments¹⁷.

The research addresses real-time cybersecurity for intelligent ship networks by leveraging cloud computing technology¹⁸. It suggests a multi-sensor node framework to examine data for malicious attacks and uses self-executing protection strategy nodes to intercept threats. Results demonstrate a virus intrusion detection and defense rate of 85-95%, and a False Positive Rate of 2.56%, significantly outperforming other algorithms. However, the approach requires high computational resources and cloud infrastructure restrictions in practical deployment. Aslan et al.¹⁹ provide an intelligent behavior-based malware detection system in a cloud computing environment. It produced a malware dataset across virtual machines and used selected features with learning-based and rule-based detection agents to classify malware and benign samples. Assessment on 10,000 program samples showed a high performance with improved detection rate and FPR. Nonetheless, the method had scalability issues with constantly changing malware variants and cloud deployments on scale and in real-time.

Despite the significant contributions made by these studies, a more detailed comparison reveals that the majority of existing solutions fail to address the assumptions and requirements of real-time situation awareness or the dynamic trust model in cloud-based environments. Conventional ML techniques assume feature boundaries that are fixed in space and fail in class imbalance and highly dynamic traffic dynamics^8,9,10. DL models are associated with excellent feature extraction abilities but consume high computational power, which makes the process of inference slow and impractical in real-time monitoring^12,13. Ensemble and HMC-based approaches are more accurate, but need even more latency and resources, and are currently not deployed in large-scale clouds^14,15. Meanwhile, cloud-model trust evaluation techniques capture uncertainty well but remain highly sensitive to noisy data and cannot update trust values efficiently under high-frequency attack streams^16,17,18,19. Even recent cloud-based IDS frameworks lack robust, integrated support for both real-time detection and trust-aware decision-making^20,21. These restrictions collectively highlight the necessity for an efficient, unified, and trust-enabled intrusion detection framework. This research overcomes these limitations by integrating adaptive ML, HMC, and cloud-model-based dynamic trust evaluation within an SDN-enabled cloud architecture, enabling real-time detection, improved minority-class accuracy, and uncertainty-aware risk assessment.

The innovations of this paper are mostly reflected in the following aspects: An efficient distributed network architecture based on the Ryu OpenFlow controller and OpenFlow switch is constructed to enable real-time collection and dynamic scheduling of link information, thereby greatly improving data transmission efficiency and processing.

In view of the difficulties posed by data imbalance and few-sample attack identification, a top-down HMC framework is designed, and integrated learning methods such as AdaBoost and Bagging are introduced to significantly improve the detection accuracy of fine-grained attack categories.

The cloud model theory is used to build a trust affiliation cloud. Through the reverse generator and similarity calculation, the dynamic evaluation of the trust status of each entity in the network is realized, providing a quantitative basis for risk warning and effectively suppressing the credit speculation caused by abnormal transactions at low or high prices.

Protocol

NOTE: This protocol describes how to construct a cloud-based network security situational awareness system and implement hierarchical classification with dynamic trust evaluation. Follow the steps below to design the cloud network topology, collect and annotate data flows, and deploy the hierarchical multiclass classification and trust assessment modules. Figure 1 illustrates the proposed SDN-cloud framework integrating adaptive ML, hierarchical classification, and trust evaluation for real-time attack detection .

1. Cloud network topology design

NOTE: Ensure administrative access to OpenStack, Ryu, and Mininet before proceeding.

1. Deploy the system on an OpenStack-built cloud platform. Use virtualization technology to create multiple virtual hosts and configure a software-defined network (SDN) environment for unified resource management and isolated scheduling.
2. Deploy and configure Ryu and Open vSwitch (OVS) to work with SDN control and traffic management.
3. Construct a three-layer topology where the Ryu controller is the core and the OVS switches are the forwarding nodes, consisting of a control layer, a network forwarding layer, and a data service layer.
   1. Control layer configuration: Implement a centralized SDN controller with Ryu. Enable real-time network status monitoring by using the REST API of Ryu and connect it to the security detection module to respond quickly to abnormal traffic.
   2. Network forwarding layer configuration: Set up a number of OVS virtual switching nodes with virtual hosts and external gateways. Set flow table policies on OVS to enable dynamic path changes, traffic separation, and flow redirection when attack traffic is detected.
   3. Data service layer configuration: Configure several virtual hosts on the OpenStack platform. Create virtual machines acting as web, database, and file servers to generate realistic data traffic and support injected attack flows.
4. Add several hop values and different paths. Simulate heterogeneous network bandwidth and latency conditions by using the Mininet command.
5. Install Mininet to deploy and simulate the topology. Isolate tenants, subnet segmentation, and access control lists (ACLs) using the Mininet CLI.
6. Verify the setup to ensure the topology facilitates real-time traffic capture and has direct integration with the detection module.
7. Record the completed system architecture (Figure 2) and topology (Figure 3) with all the interconnections among the layers and the flow of information.

2. Data flow collection and annotation strategy

CAUTION: Make sure to comply with data privacy regulations (e.g., GDPR, local cybersecurity policies). Pre-anonymize user identifiers and IP addresses.

1. Install small data collection agents on every virtual host and network node. Set up every agent to constantly examine network traffic, system logs, and user behavioral information.
2. Install Kafka (v3.5) as a data queue and Apache Spark streaming (v3.4) to process stream data in real-time. Configure Kafka throughput to be 10,000 events/s or higher and Spark micro-batch interval to be 500 ms or less.
3. Process the collected data sequentially as follows:
   1. Clean the data to eliminate duplicate records, incomplete records, and noise. Filter out invalid packets by checking protocol headers.
   2. Normalize numerical attributes to a standard range [0,1] using min-max normalization for consistent feature scaling.
   3. Extract important characteristics, including source/destination IPs, ports, protocol type, number of packets, number of bytes, forwarding delay, and measures of traffic variation.
4. Feed the processed dataset into the AI-assisted detection module to train and validate.
5. Establish a dual annotation system for accurate data labeling:
   1. Create an attack template library. Identify common attack patterns (e.g., port scanning, SYN flood, DoS, U2R) with rule-based pattern matching.
   2. Manually check ambiguous samples to maintain consistency in the labeling.
6. Use established benchmark datasets such as CIC-IDS2017 and NSL-KDD for cross-validation. Align labels to maintain ≥90% inter-annotator consistency.
7. Perform feature engineering to construct structured input vectors. Encode attack hierarchies based on multi-level category definitions.
8. Split datasets into 80% training and 20% testing.

3. Hierarchical classification and trust assessment integrated architecture

1. Construct an intelligent perception architecture integrating Hierarchical Multiclass Classification (HMC) and a dynamic trust assessment mechanism (Figure 4).
2. Implement the HMC module following a "coarse-to-fine" strategy:
   1. Use lightweight connection features (e.g., frequency, port distribution, protocol type) to classify traffic into "normal" and "abnormal" categories.
   2. For "abnormal" traffic, perform second-level classification into attack categories such as DDoS, U2R, R2L, and Probe using mid-level statistical features such as packet interval and payload size.
   3. Identify fine-grained subtypes (e.g., TCP SYN Flood, SQL Injection, Brute Force Attack) by analyzing attack signatures and target attributes.
3. Optimize the classification module.
   1. Apply AdaBoost and Bagging ensemble learning methods, building 5-8 weak classifiers at each hierarchy level (e.g., decision tree, logistic regression).
   2. Combine classifier outputs using weighted majority voting based on accuracy scores.
4. Implement the dynamic trust evaluation module using cloud model theory:
   1. Keep a constant check on host behavioral indicators, e.g., past stability, frequency of communication, and variation in access targets.
   2. Include model output credibility in the computation of trust. Estimate the actual trust score (0 to 1) with the help of expectation (Ex), entropy (En), and hyper-entropy (He) parameters.
5. Configure the linkage feedback mechanism between HMC and trust modules.
   1. Auto-schedule systems based on trust values: isolate hosts with trust ≤ 0.3 and reduce privileges of hosts with trust 0.3-0.6.
   2. Re-train the classifier with host data with trust ≥ 0.8 to increase detection and flexibility to unknown attacks.
6. Test zero-day response capability. Inject unlabeled malicious traffic and confirm that alerting and isolation are triggered within 10 min.

4. Calculation and implementation of the trust cloud model (Figure 5)

1. Standard trust cloud generation:
   1. Divide trust values into n distinct levels (e.g., "Low," "Medium," "High," "Very Low," and "Very High").
   2. Calculate the expectation (Ex_k) for level k based on the average of the trust evaluations for entities in that level using Equation 1:
      
      where T_ik represents the individual trust values of entities classified under trust level L_k.
   3. Calculate the entropy (En_k) to quantify the fuzziness of the trust values within level L_k using Equation 2:
      
      where α is a constant that controls the level of fuzziness.
   4. Compute the Hyper-entropy (He_k) using Equation 3 to quantify the instability of the entropy over time:
      
      where β is a parameter that adjusts the level of uncertainty.
   5. Output the set of standard trust clouds C₁,C₂,...,C_n corresponding to the n trust levels.
2. Trust attribute cloud inverse generation:
   1. Normalize input trust attributes A_i to the range [0,1] using Equation 4:
      
      Apply statistical analysis to estimate the corresponding cloud model parameters (Ex, En, He) for each normalized attribute A_i'.
      Generate the trust attribute cloud C_i for each attribute.
3. Comprehensive trust evaluation:
   1. Calculate the digital properties of the composite trust cloud (Ex_com,En_com,He_com) using weighted synthesis (Equations 5-7):
      
      
      
      where
   2. Compute the similarity between the current trust cloud C_i and a standard cloud C_k using Equation 8:
      
      Determine the final trust level L^* by finding the maximum similarity using Equation 9:
      
4. Dynamic trust update
   1. Update the trust value to reflect evolution over time using the time decay model in Equation 10:
      
      where λ∈[0,1] controls the weighting of recent versus historical trust.
   2. Apply the trust penalty mechanism if specific deviations occur. Calculate the deviation (ΔA) and penalty factor (P_penalty) using Equations 11 and 12:
      
      
   3. Compute the updated trust value using Equation 13:
      

5. Experimental validation of attack detection performance

1. Configure the experimental environment and prepare the dataset.
   1. Use a Windows 11 workstation equipped with Visual C++ tools for algorithm compilation and testing.
   2. Obtain the KDDCUP_10% dataset from verified sources and preprocess it following institutional data protection guidelines.
   3. Set algorithm parameters: time interval T = 10s, sampling rounds h = 20, and data samples n = 1000.
   4. Split data into training (80%) and testing (20%) sets by means of stratified sampling.
2. Validate binary classification performance.
   1. Conduct 5-fold cross-validation for reliability.
   2. Train and test eight classifiers: Decision Tree (DT), Naive Bayes (NB), Random Forest (RF), K-Nearest Neighbor (KNN), Adaptive Boosting (AdaBoost), Support Vector Machine (SVM), Bagging, and Gradient Boosting.
   3. Run 100 epochs per model and record precision, accuracy, recall, and F1-score.
3. Validate multiclass classification performance.
   1. Train classifiers to detect DDoS, U2R, R2L, Probe, and normal traffic.
   2. Implement five DL architectures (MLP, CNN, GRU, RNN, and LSTM) using parameters specified in Table 1.
   3. Compare performance using precision-recall curves and confusion matrices for each class.
4. Validate the HMC algorithm.
   1. Implement HMC with AdaBoost and Bagging as ensemble strategies.
   2. Decompose multiclass problems into binary sub-classifications through hierarchical logic.
   3. Compare results with baseline models for minority attack types (U2R, R2L).
5. Implement attack simulation.
   1. Deploy the trained trust-detection model on the cloud testbed.
   2. Create UDP Flood and SYN Flood attacks using multi-virtual hosts to target assigned servers.
   3. Keep attack traffic around 30% of network throughput.
   4. Keep track of network statistics (transmission rate, session length, frequency of port access, abnormal connections).
   5. Measure detection error, false positives, and mean system response time.

Results

Experimental validation and performance analysis

Cloud-based validation

To test the efficiency and feasibility of the proposed algorithm, simulation tests were performed in a controlled network laboratory setting. The verification was conducted on the Windows operating system, and the core algorithm is coded in VC (Visual C++) programming tools.

In case of experimental data, we chose the publicly availabl...

Discussion

An effective deployment of this protocol relies on critical steps within the cloud-based architecture. Proper configuration of the Ryu OpenFlow controller, correct setup of Open vSwitch rules, and robust formation of a multi-layer topology are essential to ensure full traffic capture. The selection of Ryu as the controller and Open vSwitch as the switching platform significantly strengthens the system's practical value; their lightweight, modular, and fully programmable characteristics make them ideal for real-time netwo...

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
AdaBoost (Ensemble Learning Library)	Scikit-learn, Python	https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.AdaBoostClassifier.html	Software
Bagging Classifier	Scikit-learn, Python	https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.BaggingClassifier.html	Software
Cloud Model Trust Evaluation Code	Custom implementation	N/A	Algorithm/Software
Convolutional Neural Network (CNN)	TensorFlow / PyTorch	https://www.tensorflow.org/tutorials/images/cnn	Software
Deep Learning Frameworks (MLP, RNN, LSTM, GRU)	TensorFlow / PyTorch		Software
EstiNet Network Simulator	EstiNet Technologies	https://sites.google.com/view/estinet-network-simulator	Software
Kafka (Data Streaming Platform)	Apache Foundation	https://kafka.apache.org/	Software
KDD CUP 10% Dataset	UCI Machine Learning Repository	http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html	Dataset
Mininet Emulator	Mininet Project	Mininet 2.3.1	Network emulation for SDN topology, bandwidth, and mixed attack simulation.
Open vSwitch (OVS)	Open vSwitch Org	OVS 3.2.2	Virtual switch implementing flow-table control and attack traffic redirection.
OpenStack Cloud Platform	Open Infrastructure Foundation	https://www.openstack.org/	Cloud Software
Python 3.x	Python Software Foundation	https://www.python.org/downloads/	Programming Language
Ryu SDN Controller	NTT R&D	Ryu 4.34	SDN controller for real-time network traffic capture and situation awareness.
Spark Streaming Framework	Apache Foundation	https://spark.apache.org/docs/latest/streaming-programming-guide.html	Software
Visual C++ (VC++) Compiler	Microsoft	https://visualstudio.microsoft.com/	Software
Windows 11 Workstation	Microsoft	Windows 11 Pro 23H2	OS used for model compilation, training, and testing.