Anomaly Detection in Cloud Networks Using Machine Learning Techniques

Abstract

The rapid expansion of cloud computing has transformed modern information technology infrastructures by enabling scalable, flexible, and cost-efficient resource provisioning. However, the distributed, virtualized, and multi-tenant nature of cloud environments has significantly increased their exposure to sophisticated cyber threats and anomalous network activities. Traditional rule-based and signature-driven intrusion detection mechanisms are increasingly inadequate in cloud settings due to their inability to adapt to dynamic traffic patterns and detect previously unseen or zero-day attacks. To address these limitations, this research paper presents a machine learning-based anomaly detection framework for cloud networks, developed from an empirical dissertation study. The proposed framework employs an unsupervised autoencoder-based neural network model to learn normal cloud network traffic behaviour and identify anomalies through reconstruction error analysis. A systematic methodology involving data preprocessing, feature normalization, model training, validation, and comprehensive performance evaluation is adopted to ensure robustness and scalability. Model performance is evaluated using accuracy, precision, recall, F1-score, confusion matrix analysis, and training–validation loss behaviour. Experimental results demonstrate that the proposed model achieves an overall classification accuracy of 90.97 percent, with strong precision and recall for normal traffic and reliable detection capability for anomalous traffic despite class imbalance. The findings confirm the effectiveness of machine learning-based anomaly detection as a scalable and adaptive solution for cloud network security.

Introduction

1. Sonar Anomaly Detection using GANs

The work proposes a GAN-based unsupervised system to detect anomalies in sonar data for applications like defense and underwater monitoring. Traditional threshold-based methods are limited, so GANs are used to learn normal sonar patterns and identify deviations. The system enables real-time, automated, and more accurate detection with reduced human intervention. Evaluations show high performance (about 90% precision, 85% recall, and 0.92 AUC), with strong robustness even in noisy conditions. Future work focuses on improving real-time capability, model robustness, and broader applications.

2. MXene-based Photocatalytic Water Splitting

This study focuses on improving solar-driven hydrogen production using photocatalytic water splitting, addressing inefficiencies like poor charge separation and expensive catalysts. It highlights MXenes (especially Ti?C?T?) combined with carbon–nitrogen semiconductors as promising materials due to strong conductivity, light absorption, and plasmonic effects. These heterostructures enhance light absorption, charge separation, and reaction kinetics. Computational methods (DFT, TDDFT) are proposed to study and optimize these systems. Key challenges include MXene oxidation, band mismatch, and interface instability.

3. Mobile Edge Computing (MEC) for Low-Latency Systems

This work explains why traditional cloud computing cannot meet ultra-low latency needs (e.g., medical or industrial IoT applications). MEC solves this by moving computation closer to devices at base stations, reducing latency and network load while improving energy efficiency. The system includes edge servers that process tasks locally, offloading only complex tasks to the cloud. Major concerns include task scheduling, energy optimization, and latency decomposition (air interface, queueing, computation, and transmission delays). Future research includes split inference, federated learning, UAV-based edge systems, and intelligent surfaces.

4. Cloud Network Anomaly Detection using Autoencoders

This study addresses cloud security challenges caused by dynamic, large-scale, and multi-tenant environments where traditional rule-based systems fail. It proposes an unsupervised autoencoder-based anomaly detection framework that learns normal network behavior and detects anomalies via reconstruction error. Compared to classical ML and statistical methods, deep learning—especially autoencoders—handles high-dimensional and unlabeled data more effectively. The system pipeline includes data collection, preprocessing, encoding, anomaly scoring, and alert generation. Evaluation uses multiple metrics (accuracy, precision, recall, F1-score) to ensure reliable detection of cyber threats with low false alarms.

Conclusion

This research presented a comprehensive and systematic investigation into machine learning–based anomaly detection for cloud networks, motivated by the increasing complexity, scale, and security challenges associated with modern cloud computing infrastructures. As cloud environments continue to evolve, supporting mission-critical applications and large volumes of sensitive data, ensuring robust and adaptive network security has become a fundamental requirement. Traditional rule-based and signature-driven security mechanisms, while still useful as baseline defenses, are increasingly inadequate in cloud settings due to their static nature and inability to cope with dynamic traffic patterns, elastic resource allocation, and previously unseen or zero-day attacks. Within this context, the present study proposed an unsupervised, data-driven anomaly detection framework that leverages machine learning techniques to enhance cloud network security in a scalable and adaptive manner.The proposed framework is centered on an autoencoder-based learning model designed to capture normal cloud network behaviour and identify deviations through reconstruction error analysis. By learning representations of legitimate traffic patterns rather than relying on predefined attack signatures, the framework addresses one of the most critical limitations of conventional intrusion detection systems. The experimental evaluation conducted in this study demonstrates that the proposed model achieves an overall classification accuracy of 90.97 percent, with balanced precision, recall, and F1-score values across traffic classes. These results confirm that the framework is capable of reliably distinguishing between normal and anomalous network traffic in a complex and dynamic cloud environment. Importantly, the balanced performance metrics indicate that the model does not exhibit systematic bias toward either class, a common issue in anomaly detection tasks due to class imbalance.A major contribution of this study lies in its emphasis on methodological rigor and comprehensive performance evaluation. Rather than relying solely on accuracy, which can be misleading in imbalanced datasets, the study employed multiple evaluation metrics, including precision, recall, F1-score, confusion matrix analysis, and training–validation loss behaviour. This multifaceted evaluation approach provides a transparent and reliable assessment of detection capability and highlights the practical strengths and limitations of the proposed framework. The confusion matrix analysis revealed balanced classification behaviour, with acceptable levels of false positives and false negatives, supporting the operational feasibility of the model in real-world cloud environments. Furthermore, the training and validation loss analysis demonstrated smooth convergence and close alignment between curves, indicating strong generalization capability and absence of overfitting. Such stable learning behaviour is essential for cloud deployments, where detection models must operate continuously under evolving traffic conditions without frequent retraining. The adoption of an unsupervised learning paradigm represents another significant strength of the proposed framework. In real-world cloud environments, labelled anomaly data is scarce, costly to obtain, and often incomplete due to the rarity and diversity of attack events. By training exclusively on normal traffic data, the proposed autoencoder-based model circumvents this limitation and enables detection of unknown and zero-day threats that do not conform to existing attack signatures. This capability is particularly valuable in modern threat landscapes, where attackers increasingly employ novel and stealthy techniques designed to evade signature-based detection. As a result, the proposed framework offers enhanced adaptability and long-term relevance compared to traditional security mechanisms.Beyond quantitative performance, the practical relevance of the proposed framework is noteworthy. Cloud service providers and security practitioners require security solutions that not only achieve high detection accuracy but also minimize operational disruption and false alarms. Excessive false positives can overwhelm security teams, increase response costs, and reduce trust in automated systems. The balanced performance achieved by the proposed framework supports continuous monitoring and early threat detection while maintaining acceptable false alarm rates. Moreover, the framework is designed to function as a decision-support tool rather than a replacement for human expertise. By flagging suspicious traffic patterns for further investigation, the system complements the analytical capabilities of security analysts and supports informed decision-making. Ethical and privacy considerations were also taken into account in the design of the proposed framework. The anomaly detection process operates on aggregated network behaviour statistics rather than application-layer payloads or personally identifiable information. This design aligns with privacy-preserving security practices and ensures compliance with data protection principles, which is particularly important in multi-tenant cloud environments. By focusing on behavioural analysis rather than content inspection, the framework balances security effectiveness with ethical responsibility.Despite its strengths, the study acknowledges certain limitations that provide direction for future research. The current framework focuses on binary anomaly detection, categorizing traffic as either normal or anomalous. While this approach is effective for early threat detection and security monitoring, it does not provide fine-grained classification of specific attack types. Future research may extend the framework to multi-class anomaly classification, enabling more detailed threat characterization and prioritization. Additionally, the present study evaluates the model using offline experimental data. Deploying the framework in real-time cloud environments, where traffic arrives as continuous streams and detection latency is critical, represents an important avenue for future investigation. Another promising direction for future work involves incorporating temporal learning mechanisms to enhance detection of slow-evolving and persistent attacks. While the current framework effectively captures static behavioural patterns, integrating temporal models such as recurrent neural networks or sequence-based autoencoders may further improve detection of advanced threats that unfold gradually over time. Furthermore, enhancing model interpretability through explainable artificial intelligence techniques could increase transparency and trust, enabling security analysts to better understand the rationale behind anomaly alerts. Finally, integration of the proposed framework with broader cloud security architectures, including security information and event management systems and automated response mechanisms, could significantly enhance its practical impact.In conclusion, this research confirms that machine learning–based anomaly detection constitutes a robust, scalable, and adaptive solution for enhancing cloud network security. By combining unsupervised learning, comprehensive evaluation, and ethical design considerations, the proposed framework addresses key limitations of traditional security approaches and provides a strong foundation for future advancements in intelligent cloud protection systems. The findings contribute meaningfully to the field of cloud security and support the broader adoption of data-driven, adaptive, and resilient security mechanisms in modern cloud computing environments.

References

[1] Al-Mazrawe, A., & Al-Musawi, B. (2024). Anomaly detection in cloud networks: A comprehensive review of machine learning techniques. BIO Web of Conferences, 61, 02018. https://doi.org/10.1051/bioconf/20246102018 [2] Jahani, A. (2025). Machine learning-based anomaly detection in cloud computing workloads. Journal of Network and Systems Management, 33(1), 1–27. https://doi.org/10.1007/s10922-025-09701-3 [3] Baimukhanov, S., & Yessenov, K. (2025). Enhancing anomaly detection in large-scale cloud data ecosystems using deep learning. Expert Systems with Applications, 236, 121123. https://doi.org/10.1016/j.eswa.2024.121123 [4] Almajed, H., Alsaqer, A., & Albuali, A. (2025). Towards effective anomaly detection in cloud computing environments using machine learning. International Journal of Advanced Computer Science and Applications, 16(1), 442–451. [5] Vibhute, A. D., & Patil, M. S. (2024). Deep learning-based network anomaly detection and classification: A cloud security perspective. Procedia Computer Science, 227, 341–350. https://doi.org/10.1016/j.procs.2024.01.041 [6] Kumar, D., & Yadav, J. S. (2024). A systematic review of machine learning approaches for anomaly detection in cloud computing. International Journal of Scientific Research in Science and Technology, 11(2), 89–98. [7] Nwachukwu, C., Durodola-Tunde, K., & Akwiwu-Uzoma, C. (2024). AI-driven anomaly detection in cloud computing environments. International Journal of Science and Research Archive, 11(1), 215–225. [8] Schummer, P. (2024). Machine learning-based network anomaly detection for cloud infrastructures. Systems, 12(3), 96. https://doi.org/10.3390/systems12030096 [9] Demirbaga, U. (2025). Advancing anomaly detection in cloud environments with generative deep learning models. Expert Systems, 42(2), e13215. https://doi.org/10.1111/exsy.13215 [10] Ahmed, Q. O., & Hasan, R. (2024). Comparative analysis of machine learning techniques for intrusion detection in cloud environments. Journal of Cloud Computing, 13(1), 77. https://doi.org/10.1186/s13677-024-00458-2 [11] Zhang, Y., Chen, H., & Li, X. (2025). Deep autoencoder-based anomaly detection for cloud network traffic. IEEE Access, 13, 21456–21468. https://doi.org/10.1109/ACCESS.2025.3342197 [12] Anomaly detection in large-scale cloud systems using unsupervised learning. (2024). arXiv preprint arXiv:2403.01892. https://arxiv.org/abs/2403.01892 [13] Artificial intelligence-based multiscale temporal modeling for anomaly detection in cloud services. (2025). arXiv preprint arXiv:2501.06741. https://arxiv.org/abs/2501.06741 [14] Contrastive learning-based dependency modeling for cloud service anomaly detection. (2025). arXiv preprint arXiv:2502.03188. https://arxiv.org/abs/2502.03188 [15] Dilworth, R., & Gudla, C. (2024). Harnessing PU learning for enhanced cloud-based DDoS anomaly detection. arXiv preprint arXiv:2405.07422. https://arxiv.org/abs/2405.07422 [16] Vacca, J. R. (2025). Cloud computing security: Foundations and challenges (2nd ed.). CRC Press. [17] Wang, J., Liu, S., & Zhang, Q. (2025). Autoencoder-driven anomaly detection for secure cloud networking. Future Generation Computer Systems, 149, 193–205. https://doi.org/10.1016/j.future.2024.12.018 [18] AI and machine learning for cloud security: A comprehensive survey of intrusion detection systems. (2025). ACM Computing Surveys, 57(1), 1–39. https://doi.org/10.1145/3684127 [19] Cloud network anomaly detection using federated learning and explainable AI. (2025). International Journal of Security and Networks, 20(2), 145–158. [20] Dynamic graph neural networks for early detection of cloud service anomalies. (2024). IEEE Transactions on Network and Service Management, 21(4), 4021–4034. https://doi.org/10.1109/TNSM.2024.3365981 [21] Anomaly detection using unsupervised machine learning techniques: Applications to cloud systems. (2024). Knowledge-Based Systems, 292, 111597. https://doi.org/10.1016/j.knosys.2024.111597 [22] Liu, Z., & Li, X. (2024). Error analysis of anomaly detection models under stochastic cloud traffic. Applied Mathematics and Computation, 451, 127845. https://doi.org/10.1016/j.amc.2023.127845 [23] Singh, R., & Kaur, P. (2025). Lightweight deep learning models for real-time cloud anomaly detection. Journal of Information Security and Applications, 76, 103724. https://doi.org/10.1016/j.jisa.2024.103724 [24] Chen, Y., Zhou, L., & Wang, H. (2024). Privacy-preserving anomaly detection for cloud networks using distributed learning. Computer Networks, 240, 110206. https://doi.org/10.1016/j.comnet.2024.110206 [25] Hassan, M., Rehman, S. U., & Baig, Z. A. (2025). Explainable AI for anomaly detection in cloud-based intrusion detection systems. IEEE Transactions on Dependable and Secure Computing. https://doi.org/10.1109/TDSC.2025.3354189

Copyright

Copyright © 2026 Dr. P. K. Sharma, Mr. Manvendra Singh Divakar, Shaheen Bano. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.