{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,14]],"date-time":"2026-04-14T16:04:00Z","timestamp":1776182640801,"version":"3.50.1"},"reference-count":40,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,1,2]],"date-time":"2024-01-02T00:00:00Z","timestamp":1704153600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,1,2]],"date-time":"2024-01-02T00:00:00Z","timestamp":1704153600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]},{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]},{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]},{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]},{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]},{"name":"Open Project Program of the Joint Laboratory on Cyberspace Security, China Southern Power Grid","award":["CSS2022KF01"],"award-info":[{"award-number":["CSS2022KF01"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>The distributed architecture of cloud computing necessitates robust defense mechanisms to secure network-accessible resources against a diverse and dynamic threat landscape. A Network Intrusion Detection System (NIDS) is pivotal in this context, with its efficacy in cloud environments hinging on its adaptability to evolving threat vectors while mitigating false positives. In this paper, we present a novel NIDS algorithm, anchored in the Transformer model and finely tailored for cloud environments. Our algorithm melds the fundamental aspects of network intrusion detection with the sophisticated attention mechanism inherent to the Transformer model, facilitating a more insightful examination of the relationships between input features and diverse intrusion types, thereby bolstering detection accuracy. We provide a detailed design of our approach and have conducted a thorough comparative evaluation. Our experimental results demonstrate that the accuracy of our model is over 93%, which is comparable to that of the CNN-LSTM model, underscoring the effectiveness and viability of our Transformer-based intrusion detection algorithm in bolstering cloud security.<\/jats:p>","DOI":"10.1186\/s13677-023-00574-9","type":"journal-article","created":{"date-parts":[[2024,1,2]],"date-time":"2024-01-02T14:02:47Z","timestamp":1704204167000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":88,"title":["A Transformer-based network intrusion detection approach for cloud security"],"prefix":"10.1186","volume":"13","author":[{"given":"Zhenyue","family":"Long","sequence":"first","affiliation":[]},{"given":"Huiru","family":"Yan","sequence":"additional","affiliation":[]},{"given":"Guiquan","family":"Shen","sequence":"additional","affiliation":[]},{"given":"Xiaolu","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Haoyang","family":"He","sequence":"additional","affiliation":[]},{"given":"Long","family":"Cheng","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,1,2]]},"reference":[{"key":"574_CR1","doi-asserted-by":"crossref","unstructured":"Cheng L, Wang Y, Cheng F, Liu C, Zhao Z, Wang Y (2023) A deep reinforcement learning-based preemptive approach for cost-aware cloud job scheduling. IEEE Trans Sustain Comput","DOI":"10.1109\/TSUSC.2023.3303898"},{"key":"574_CR2","doi-asserted-by":"publisher","first-page":"120972","DOI":"10.1016\/j.eswa.2023.120972","volume":"234","author":"J Zhang","year":"2023","unstructured":"Zhang J, Cheng L, Liu C, Zhao Z, Mao Y (2023) Cost-aware scheduling systems for real-time workflows in cloud: An approach based on genetic algorithm and deep reinforcement learning. Expert Syst Appl 234:120972","journal-title":"Expert Syst Appl"},{"key":"574_CR3","doi-asserted-by":"crossref","unstructured":"Liu F, Huang J, Wang X (2023) Joint task offloading and resource allocation for device-edge-cloud collaboration with subtask dependencies. IEEE Trans Cloud Comput\u00a011(3):3027\u20133039","DOI":"10.1109\/TCC.2023.3251561"},{"key":"574_CR4","doi-asserted-by":"publisher","first-page":"102642","DOI":"10.1016\/j.jnca.2020.102642","volume":"160","author":"P Sun","year":"2020","unstructured":"Sun P (2020) Security and privacy protection in cloud computing: Discussions and challenges. J Netw Comput Appl 160:102642","journal-title":"J Netw Comput Appl"},{"issue":"1","key":"574_CR5","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1186\/s13677-023-00474-y","volume":"12","author":"X Zhang","year":"2023","unstructured":"Zhang X, Cui L, Shen W, Zeng J, Du L, He H, Cheng L (2023) File processing security detection in multi-cloud environments: a process mining approach. J Cloud Comput 12(1):100","journal-title":"J Cloud Comput"},{"issue":"6","key":"574_CR6","doi-asserted-by":"publisher","first-page":"3587","DOI":"10.1007\/s11831-022-09708-9","volume":"29","author":"M Jangjou","year":"2022","unstructured":"Jangjou M, Sohrabi MK (2022) A comprehensive survey on security challenges in different network layers in cloud computing. Arch Comput Methods Eng 29(6):3587\u20133608","journal-title":"Arch Comput Methods Eng"},{"key":"574_CR7","doi-asserted-by":"crossref","unstructured":"Li J, Tong X, Liu J, Cheng L (2023) An efficient federated learning system for network intrusion detection. IEEE Syst J\u00a017(2):2455\u20132464","DOI":"10.1109\/JSYST.2023.3236995"},{"key":"574_CR8","doi-asserted-by":"publisher","first-page":"105124","DOI":"10.1016\/j.knosys.2019.105124","volume":"189","author":"A Aldweesh","year":"2020","unstructured":"Aldweesh A, Derhab A, Emam AZ (2020) Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowl-Based Syst 189:105124","journal-title":"Knowl-Based Syst"},{"key":"574_CR9","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser \u0141, Polosukhin I (2017) Attention is all you need. Adv Neural Inf Process Syst 30:1\u201311"},{"key":"574_CR10","unstructured":"Dosovitskiy A, Beyer L, Kolesnikov A, Weissenborn D, Zhai X, Unterthiner T, Dehghani M, Minderer M, Heigold G, Gelly S, et\u00a0al (2020) An image is worth 16x16 words: Transformers for image recognition at scale. arXiv\u00a0preprint\u00a0arXiv:201011929"},{"key":"574_CR11","doi-asserted-by":"crossref","unstructured":"Garg A, Maheshwari P (2016) A hybrid intrusion detection system: A review. In: 2016 10th International Conference on Intelligent Systems and Control (ISCO). IEEE,\u00a0Coimbatore pp 1\u20135","DOI":"10.1109\/ISCO.2016.7726909"},{"issue":"2007","key":"574_CR12","first-page":"94","volume":"800","author":"K Scarfone","year":"2007","unstructured":"Scarfone K, Mell P et al (2007) Guide to intrusion detection and prevention systems (idps). NIST Spec Publ 800(2007):94","journal-title":"NIST Spec Publ"},{"key":"574_CR13","doi-asserted-by":"crossref","unstructured":"Mantur B, Desai A, Nagegowda K (2015) Centralized control signature-based firewall and statistical-based network intrusion detection system (nids) in software defined networks (sdn). In: Emerging Research in Computing, Information, Communication and Applications: ERCICA 2015, vol 1. Springer,\u00a0Bangalore\u00a0pp 497\u2013506","DOI":"10.1007\/978-81-322-2550-8_48"},{"key":"574_CR14","doi-asserted-by":"publisher","first-page":"107788","DOI":"10.1016\/j.comnet.2020.107788","volume":"187","author":"Q Liu","year":"2021","unstructured":"Liu Q, Cheng L, Alves R, Ozcelebi T, Kuipers F, Xu G, Lukkien J, Chen S (2021) Cluster-based flow control in hybrid software-defined wireless sensor networks. Comput Netw 187:107788","journal-title":"Comput Netw"},{"issue":"1","key":"574_CR15","doi-asserted-by":"publisher","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","volume":"36","author":"HJ Liao","year":"2013","unstructured":"Liao HJ, Lin CHR, Lin YC, Tung KY (2013) Intrusion detection system: A comprehensive review. J Netw Comput Appl 36(1):16\u201324","journal-title":"J Netw Comput Appl"},{"key":"574_CR16","volume-title":"Network Intrusion Detection: An Analyst\u2019s Handbook","author":"S Northcutt","year":"2002","unstructured":"Northcutt S, Novak J (2002) Network Intrusion Detection: An Analyst\u2019s Handbook, 3rd edn. New Riders Publishing, USA","edition":"3"},{"issue":"1","key":"574_CR17","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","volume":"28","author":"P Garc\u00eda-Teodoro","year":"2009","unstructured":"Garc\u00eda-Teodoro P, D\u00edaz-Verdejo J, Maci\u00e1-Fern\u00e1ndez G, V\u00e1zquez E (2009) Anomaly-based network intrusion detection: Techniques, systems and challenges. Comput Secur 28(1):18\u201328","journal-title":"Comput Secur"},{"key":"574_CR18","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1007\/978-3-540-30143-1_11","volume-title":"Recent Advances in Intrusion Detection (RAID 2004)","author":"K Wang","year":"2004","unstructured":"Wang K, Stolfo SJ (2004) Anomalous payload-based network intrusion detection. Recent Advances in Intrusion Detection (RAID 2004). Sophia Antipolis, France, pp 203\u2013222"},{"issue":"1","key":"574_CR19","doi-asserted-by":"publisher","first-page":"e4150","DOI":"10.1002\/ett.4150","volume":"32","author":"Z Ahmad","year":"2021","unstructured":"Ahmad Z, Shahid Khan A, Wai Shiang C, Abdullah J, Ahmad F (2021) Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Trans Emerg Telecommun Technol 32(1):e4150","journal-title":"Trans Emerg Telecommun Technol"},{"issue":"1","key":"574_CR20","doi-asserted-by":"publisher","first-page":"495","DOI":"10.1109\/TDSC.2020.2973992","volume":"19","author":"F Erlacher","year":"2020","unstructured":"Erlacher F, Dressler F (2020) On high-speed flow-based intrusion detection using snort-compatible signatures. IEEE Trans Dependable Secure Comput 19(1):495\u2013506","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"574_CR21","doi-asserted-by":"publisher","first-page":"3735","DOI":"10.1007\/s12652-019-01569-8","volume":"11","author":"TA Alamiedy","year":"2020","unstructured":"Alamiedy TA, Anbar M, Alqattan ZN, Alzubi QM (2020) Anomaly-based intrusion detection system using multi-objective grey wolf optimisation algorithm. J Ambient Intell Humanized Comput 11:3735\u20133756","journal-title":"J Ambient Intell Humanized Comput"},{"key":"574_CR22","doi-asserted-by":"publisher","first-page":"110030","DOI":"10.1016\/j.knosys.2022.110030","volume":"258","author":"E Caville","year":"2022","unstructured":"Caville E, Lo WW, Layeghy S, Portmann M (2022) Anomal-e: A self-supervised network intrusion detection system based on graph neural networks. Knowl-Based Syst 258:110030","journal-title":"Knowl-Based Syst"},{"issue":"7","key":"574_CR23","doi-asserted-by":"publisher","first-page":"1461","DOI":"10.3390\/sym14071461","volume":"14","author":"DN Mhawi","year":"2022","unstructured":"Mhawi DN, Aldallal A, Hassan S (2022) Advanced feature-selection-based hybrid ensemble learning algorithms for network intrusion detection systems. Symmetry 14(7):1461","journal-title":"Symmetry"},{"key":"574_CR24","doi-asserted-by":"crossref","unstructured":"Teng L, Teng S, Tang F, Zhu H, Zhang W, Liu D, Liang L (2014) A collaborative and adaptive intrusion detection based on svms and decision trees. In: 2014 IEEE International Conference on Data Mining Workshop. IEEE,\u00a0Shenzhen pp 898\u2013905","DOI":"10.1109\/ICDMW.2014.147"},{"issue":"7","key":"574_CR25","first-page":"122","volume":"52","author":"X Ren","year":"2016","unstructured":"Ren X, Jiao W, Zhou D (2016) Intrusion detection model of weighted navie bayes based on particle swarm optimization algorithm. Comput Eng Appl 52(7):122\u2013126","journal-title":"Comput Eng Appl"},{"issue":"4","key":"574_CR26","doi-asserted-by":"publisher","first-page":"387","DOI":"10.24846\/v26i4y201702","volume":"26","author":"R Velea","year":"2017","unstructured":"Velea R, Ciobanip C, Margarit L, Bica I (2017) Network traffic anomaly detection using shallow packet inspection and parallel k-means data clustering. Stud Inform Control 26(4):387\u2013396","journal-title":"Stud Inform Control"},{"issue":"11","key":"574_CR27","first-page":"2184","volume":"49","author":"S Ji","year":"2021","unstructured":"Ji S, Huang S (2021) Intrusion detection algorithm based on improved k-means. Comput Digit Eng 49(11):2184\u20132188","journal-title":"Comput Digit Eng"},{"key":"574_CR28","doi-asserted-by":"crossref","unstructured":"Wu, Fei, Ting Li, Zhen Wu, ShuLin Wu, and ChuanQi Xiao (2021) Research on network intrusion detection technology based on machine learning. Int J Wireless Inf Netw 28(no. 3):262\u2013275","DOI":"10.1007\/s10776-021-00520-z"},{"issue":"1","key":"574_CR29","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","volume":"2","author":"N Shone","year":"2018","unstructured":"Shone N, Ngoc TN, Phai VD, Shi Q (2018) A deep learning approach to network intrusion detection. IEEE Trans Emerg Top Comput Intell 2(1):41\u201350","journal-title":"IEEE Trans Emerg Top Comput Intell"},{"key":"574_CR30","doi-asserted-by":"crossref","unstructured":"Javaid A, Niyaz Q, Sun W, Alam M (2016) A deep learning approach for network intrusion detection system. In: Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS).\u00a0New York City, pp 21\u201326","DOI":"10.4108\/eai.3-12-2015.2262516"},{"issue":"11","key":"574_CR31","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y, Haffner P (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324","journal-title":"Proc IEEE"},{"key":"574_CR32","doi-asserted-by":"crossref","unstructured":"Zhou H, Wang Y, Lei X, Liu Y (2017) A method of improved cnn traffic classification. In: 2017 13th International Conference on Computational Intelligence and Security (CIS).\u00a0Hong Kong, pp 177\u2013181","DOI":"10.1109\/CIS.2017.00046"},{"key":"574_CR33","doi-asserted-by":"crossref","unstructured":"Kim J, Kim J, Thi\u00a0Thu HL, Kim H (2016) Long short term memory recurrent neural network classifier for intrusion detection. In: 2016 International Conference on Platform Technology and Service (PlatCon).\u00a0Jeju, pp 1\u20135","DOI":"10.1109\/PlatCon.2016.7456805"},{"issue":"3","key":"574_CR34","doi-asserted-by":"publisher","first-page":"1761","DOI":"10.1007\/s10586-020-03222-y","volume":"24","author":"S Krishnaveni","year":"2021","unstructured":"Krishnaveni S, Sivamohan S, Sridhar S, Prabakaran S (2021) Efficient feature selection and classification through ensemble method for network intrusion detection on cloud computing. Clust Comput 24(3):1761\u20131779","journal-title":"Clust Comput"},{"key":"574_CR35","doi-asserted-by":"crossref","unstructured":"Patil R, Dudeja H, Gawade S, Modi C (2018) Protocol specific multi-threaded network intrusion detection system (pm-nids) for dos\/ddos attack detection in cloud. In: 2018 9th International Conference on Computing, Communication and Networking Technologies (ICCCNT). IEEE,\u00a0Bengaluru pp 1\u20137","DOI":"10.1109\/ICCCNT.2018.8494130"},{"key":"574_CR36","doi-asserted-by":"publisher","first-page":"103171","DOI":"10.1016\/j.cose.2023.103171","volume":"128","author":"X Han","year":"2023","unstructured":"Han X, Cui S, Liu S, Zhang C, Jiang B, Lu Z (2023) Network intrusion detection based on n-gram frequency and time-aware transformer. Comput Secur 128:103171","journal-title":"Comput Secur"},{"issue":"2","key":"574_CR37","doi-asserted-by":"crossref","first-page":"142","DOI":"10.37934\/araset.31.2.142156","volume":"31","author":"D Ingle","year":"2023","unstructured":"Ingle D, Ingle D (2023) An enhanced blockchain based security and attack detection using transformer in iot-cloud network. J Adv Res Appl Sci Eng Technol 31(2):142\u2013156","journal-title":"J Adv Res Appl Sci Eng Technol"},{"key":"574_CR38","doi-asserted-by":"crossref","unstructured":"Wu L, Cui P, Pei J, Zhao L, Guo X (2022) Graph neural networks: foundation, frontiers and applications. In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining.\u00a0Washington DC, pp 4840\u20134841","DOI":"10.1145\/3534678.3542609"},{"issue":"6","key":"574_CR39","doi-asserted-by":"publisher","first-page":"1494","DOI":"10.1109\/TPDS.2021.3053241","volume":"32","author":"L Cheng","year":"2021","unstructured":"Cheng L, Wang Y, Liu Q, Epema DH, Liu C, Mao Y, Murphy J (2021) Network-aware locality scheduling for distributed data operators in data centers. IEEE Trans Parallel Distrib Syst 32(6):1494\u20131510","journal-title":"IEEE Trans Parallel Distrib Syst"},{"key":"574_CR40","doi-asserted-by":"crossref","unstructured":"Chen Y, Zhao J, Hu J, Wan S, Huang J (2023) Distributed task offloading and resource purchasing in noma-enabled mobile edge computing: Hierarchical game theoretical approaches. ACM Trans Embed Comput Syst","DOI":"10.1145\/3597023"}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00574-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-023-00574-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00574-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,7]],"date-time":"2024-11-07T07:12:18Z","timestamp":1730963538000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-023-00574-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,2]]},"references-count":40,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["574"],"URL":"https:\/\/doi.org\/10.1186\/s13677-023-00574-9","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,2]]},"assertion":[{"value":"17 October 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 December 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 January 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"5"}}