{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,20]],"date-time":"2026-01-20T00:27:26Z","timestamp":1768868846214,"version":"3.49.0"},"reference-count":41,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T00:00:00Z","timestamp":1768780800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Cloud computing environments generate high-dimensional, large-scale, and highly dynamic network traffic, making intrusion diagnosis challenging due to evolving attack patterns, severe traffic imbalance, and limited availability of labeled data. To address these challenges, this study presents an unsupervised, cloud-centric intrusion diagnosis framework that integrates autoencoder-based representation learning with density-based attack categorization. A dual-stage autoencoder is trained exclusively on benign traffic to learn compact latent representations and to identify anomalous flows using reconstruction-error analysis, enabling effective anomaly detection without prior attack labels. The detected anomalies are subsequently grouped using density-based learning to uncover latent attack structures and support fine-grained multiclass intrusion diagnosis under varying attack densities. Experiments conducted on the large-scale CSE-CIC-IDS2018 dataset demonstrate that the proposed framework achieves an anomaly detection accuracy of 99.46%, with high recall and low false-negative rates in the optimal latent-space configuration. The density-based classification stage achieves an overall multiclass attack classification accuracy of 98.79%, effectively handling both majority and minority attack categories. Clustering quality evaluation reports a Silhouette Score of 0.9857 and a Davies\u2013Bouldin Index of 0.0091, indicating strong cluster compactness and separability. Comparative analysis against representative supervised and unsupervised baselines confirms the framework\u2019s scalability and robustness under highly imbalanced cloud traffic, highlighting its suitability for future Internet cloud security ecosystems.<\/jats:p>","DOI":"10.3390\/fi18010054","type":"journal-article","created":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T11:35:27Z","timestamp":1768822527000},"page":"54","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["An Unsupervised Cloud-Centric Intrusion Diagnosis Framework Using Autoencoder and Density-Based Learning"],"prefix":"10.3390","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6088-7414","authenticated-orcid":false,"given":"Suresh","family":"K. S","sequence":"first","affiliation":[{"name":"School of Computing, SASTRA Deemed to Be University, Tamilnadu 613401, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2531-5506","authenticated-orcid":false,"given":"Thenmozhi","family":"Elumalai","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Panimalar Engineering College, Chennai 600123, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0641-910X","authenticated-orcid":false,"given":"Radhakrishnan","family":"Rajamani","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Galgotias University, Delhi 203201, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5873-9236","authenticated-orcid":false,"given":"Anubhav","family":"Kumar","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Galgotias University, Delhi 203201, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2805-4951","authenticated-orcid":false,"given":"Balamurugan","family":"Balusamy","sequence":"additional","affiliation":[{"name":"School of Engineering and IT, Manipal Academy of Higher Education, Dubai Campus, Dubai 345050, United Arab Emirates"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sumendra","family":"Yogarayan","sequence":"additional","affiliation":[{"name":"Faculty of Information Science and Technology, Multimedia University, Melaka 75450, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3256-5984","authenticated-orcid":false,"given":"Kaliyaperumal","family":"Prabu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, IILM University, Delhi 201306, India"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"311","DOI":"10.26599\/BDMA.2022.9020038","article-title":"Cloud-Based Intrusion Detection Approach Using Machine Learning Techniques","volume":"6","author":"Attou","year":"2023","journal-title":"Big Data Min. Anal."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"100644","DOI":"10.1016\/j.eij.2025.100644","article-title":"Advanced AI-driven intrusion detection for securing cloud-based industrial IoT","volume":"30","author":"Qureshi","year":"2025","journal-title":"Egypt. Inform. J."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1186\/s13677-023-00491-x","article-title":"Intrusion detection in cloud computing based on time series anomalies utilizing machine learning","volume":"12","author":"Sharrab","year":"2023","journal-title":"J. Cloud Comput."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Balajee, R.M., and Jayanthi Kannan, M.K. (2023). Intrusion Detection on AWS Cloud through Hybrid Deep Learning Algorithm. Electronics, 12.","DOI":"10.3390\/electronics12061423"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"100612","DOI":"10.1016\/j.measen.2022.100612","article-title":"Intrusion detection system in distributed cloud computing: Hybrid clustering and classification methods","volume":"25","author":"Samunnisa","year":"2023","journal-title":"Meas. Sens."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"108006","DOI":"10.1016\/j.comcom.2024.108006","article-title":"A dual-tier adaptive one-class classification IDS for emerging cyberthreats","volume":"229","author":"Uddin","year":"2025","journal-title":"Comput. Commun."},{"key":"ref_7","first-page":"352","article-title":"A survey of network intrusion detection systems based on deep learning approaches","volume":"23","year":"2023","journal-title":"Sci. Tech. J. Inf. Technol. Mech. Opt."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Aldhaheri, S., and Alhuzali, A. (2023). SGAN-IDS: Self-Attention-Based Generative Adversarial Network against Intrusion Detection Systems. Sensors, 23.","DOI":"10.3390\/s23187796"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"e3025","DOI":"10.7717\/peerj-cs.3025","article-title":"Comprehensive review of dimensionality reduction algorithms: Challenges, limitations, and innovative solutions","volume":"11","author":"Wani","year":"2025","journal-title":"PeerJ Comput. Sci."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"4016073","DOI":"10.1155\/2022\/4016073","article-title":"Deep Learning for Intrusion Detection and Security of Internet of Things (IoT): Current Analysis, Challenges, and Possible Solutions","volume":"2022","author":"Khan","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Timofte, E.M., Balan, A.L., and Iftime, T. (2024, January 23\u201325). AI Driven Adaptive Security Mesh: Cloud Container Protection for Dynamic Threat Landscapes. Proceedings of the 2024 International Conference on Development and Application Systems (DAS), Suceava, Romania.","DOI":"10.1109\/DAS61944.2024.10541148"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"81736","DOI":"10.1109\/ACCESS.2024.3410046","article-title":"Edge-Federated Learning-Based Intelligent Intrusion Detection System for Heterogeneous Internet of Things","volume":"12","author":"Mahadik","year":"2024","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"110949","DOI":"10.1016\/j.compeleceng.2026.110949","article-title":"A multi-stage framework for scalable and context-aware intrusion detection in IoT-cloud systems using deep latent modeling and graph-based attack classification","volume":"131","author":"Ponnumani","year":"2026","journal-title":"Comput. Electr. Eng."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Rehman, T., Tariq, N., Khan, F.A., and Rehman, S.U. (2025). FFL-IDS: A Fog-Enabled Federated Learning-Based Intrusion Detection System to Counter Jamming and Spoofing Attacks for the Industrial Internet of Things. Sensors, 25.","DOI":"10.3390\/s25010010"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Hindy, H., Atkinson, R., Tachtatzis, C., Colin, J.N., Bayne, E., and Bellekens, X. (2020). Utilising deep learning techniques for effective zero-day attack detection. Electronics, 9.","DOI":"10.3390\/electronics9101684"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"104119","DOI":"10.1016\/j.csi.2025.104119","article-title":"SiamIDS: A Novel Cloud-Centric Siamese Bi-LSTM Framework for Interpretable Intrusion Detection in Large-Scale IoT Networks","volume":"97","author":"Kaliyaperumal","year":"2025","journal-title":"Comput. Stand Interfaces"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Prabu, K., Sudhakar, P., Thirumalaisamy, M., Balusamy, B., and Benedetto, F. (2024). A Novel Hybrid Unsupervised Learning Approach for Enhanced Cybersecurity in the IoT. Future Internet, 16.","DOI":"10.3390\/fi16070253"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"4617","DOI":"10.1038\/s41598-025-87028-1","article-title":"A hybrid machine learning model for intrusion detection in wireless sensor networks leveraging data balancing and dimensionality reduction","volume":"15","author":"Talukder","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Aljuaid, W.H., and Alshamrani, S.S. (2024). A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments. Appl. Sci., 14.","DOI":"10.3390\/app14135381"},{"key":"ref_20","first-page":"1499","article-title":"Intrusion detection system for cloud environment based on convolutional neural networks and PSO algorithm","volume":"35","author":"Rosline","year":"2024","journal-title":"Indones. J. Electr. Eng. Comput. Sci."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1186\/s13677-024-00685-x","article-title":"Enhancing intrusion detection: A hybrid machine and deep learning approach","volume":"13","author":"Sajid","year":"2024","journal-title":"J. Cloud Comput."},{"key":"ref_22","first-page":"6036","article-title":"An Efficient DDoS TCP Flood Attack Detection and Prevention System in a Cloud Environment","volume":"5","author":"Sahi","year":"2017","journal-title":"IEEE Access"},{"key":"ref_23","first-page":"1809","article-title":"Machine Learning for Cloud Data Classification and Anomaly Intrusion Detection","volume":"29","author":"Megouache","year":"2024","journal-title":"Ing. Des. Syst. D\u2019information"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1209","DOI":"10.11591\/ijece.v15i1.pp1209-1217","article-title":"Cloud computing environment based hierarchical anomaly intrusion detection system using artificial neural network","volume":"15","author":"Vamsikrishna","year":"2025","journal-title":"Int. J. Electr. Comput. Eng."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"1152","DOI":"10.23919\/transcom.2024EBP3204","article-title":"Network Intrusion Detection Method Based on Semi-Supervised Learning and Random Forest","volume":"E108-B","author":"Li","year":"2025","journal-title":"IEICE Trans. Commun."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Alharbi, E., Marcolino, L.S., Gouglidis, A., and Ni, Q. (2023). Robust Federated Learning Method gainst Data and Model Poisoning Attacks with Heterogeneous Data Distribution. Frontiers in Artificial Intelligence and Applications, IOS Press.","DOI":"10.3233\/FAIA230257"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"2379","DOI":"10.32604\/csse.2023.027910","article-title":"Progressive Transfer Learning-based Deep Q Network for DDOS Defence in WSN","volume":"44","author":"Rameshkumar","year":"2023","journal-title":"Comput. Syst. Sci. Eng."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"30906","DOI":"10.1038\/s41598-024-81442-7","article-title":"Secure cloud computing: Leveraging GNN and leader K-means for intrusion detection optimization","volume":"14","author":"Dugyala","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"65356","DOI":"10.1109\/ACCESS.2025.3559325","article-title":"Intrusion Detection in IoT Networks Using Dynamic Graph Modeling and Graph-Based Neural Networks","volume":"13","author":"Govea","year":"2025","journal-title":"IEEE Access"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"970","DOI":"10.1109\/TIFS.2023.3329426","article-title":"Universal Detection of Backdoor Attacks via Density-Based Clustering and Centroids Analysis","volume":"19","author":"Guo","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Artioli, P., Maci, A., and Magr\u00ec, A. (2024). A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics. Front. Big Data, 7.","DOI":"10.3389\/fdata.2024.1375818"},{"key":"ref_32","first-page":"5504218","article-title":"Enhanced Deep Image Prior for Unsupervised Hyperspectral Image Super-Resolution","volume":"Volume 63","author":"Li","year":"2025","journal-title":"IEEE Transactions on Geoscience and Remote Sensing"},{"key":"ref_33","first-page":"5518317","article-title":"X-Shaped Interactive Autoencoders with Cross-Modality Mutual Learning for Unsupervised Hyperspectral Image Super-Resolution","volume":"Volume 61","author":"Li","year":"2023","journal-title":"IEEE Transactions on Geoscience and Remote Sensing"},{"key":"ref_34","unstructured":"(2025, January 13). Canadian Institute for Cybersecurity IPS\/IDS Dataset on AWS (CSE-CIC-IDS2018). Available online: https:\/\/registry.opendata.aws\/cse-cic-ids2018\/."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP, Funchal, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"706","DOI":"10.1016\/j.ins.2021.05.016","article-title":"Autoencoder-based deep metric learning for network intrusion detection","volume":"569","author":"Andresini","year":"2021","journal-title":"Inf. Sci."},{"key":"ref_37","first-page":"345","article-title":"Deep Autoencoder-Based Integrated Model for Anomaly Detection and Efficient Feature Extraction in IoT Networks","volume":"4","author":"Alaghbari","year":"2023","journal-title":"Internet Things"},{"key":"ref_38","first-page":"409","article-title":"Adaptive DBSCAN with Grey Wolf Optimizer for Botnet Detection","volume":"16","author":"Mustafa","year":"2023","journal-title":"Int. J. Intell. Eng. Syst."},{"key":"ref_39","first-page":"23","article-title":"A Modified DBSCAN Algorithm for Anomaly Detection in Time-series Data with Seasonality","volume":"19","author":"Jain","year":"2022","journal-title":"Int. Arab. J. Inf. Technol."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Alrowais, F., Marzouk, R., Nour, M.K., Mohsen, H., Hilal, A.M., Yaseen, I., Alsaid, M.I., and Mohammed, G.P. (2022). Intelligent Intrusion Detection Using Arithmetic Optimization Enabled Density Based Clustering with Deep Learning. Electronics, 11.","DOI":"10.3390\/electronics11213541"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"103513","DOI":"10.1016\/j.jnca.2022.103513","article-title":"A deep density based and self-determining clustering approach to label unknown traffic","volume":"207","author":"Monshizadeh","year":"2022","journal-title":"J. Netw. Comput. Appl."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/1\/54\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T11:43:03Z","timestamp":1768822983000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/1\/54"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,19]]},"references-count":41,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,1]]}},"alternative-id":["fi18010054"],"URL":"https:\/\/doi.org\/10.3390\/fi18010054","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,19]]}}}