ML-Based Intrusion Detection for Cloud Information Systems: An Evidence-Grounded Architecture and Evaluation Framework

Abstract

Cloud information systems expose rapidly changing application, identity, network, and infrastructure surfaces to attacks that are difficult to identify through signatures alone. Machine learning offers a means to recognize suspicious patterns, yet published detection scores often reflect controlled datasets rather than dependable operation in multitenant cloud services. This paper critically synthesizes fifty journal articles published through December 2023 and develops an evaluation-ready architecture for machine-learning-based intrusion detection in cloud information systems. The review compares classical classifiers, neural architectures, hybrid detectors, and cloud-aware deployment strategies, with particular attention to dataset realism, concept drift, class imbalance, explainability, privacy, and operational cost. The proposed framework joins flow-level telemetry, host events, identity activity, and cloud control-plane records through time-aligned, tenant-aware feature construction. It evaluates random forests and gradient-boosted trees against recurrent and autoencoder-based models under temporal, cross-dataset, and unseen-attack tests. Data preparation, threshold calibration, model selection, and interpretability are isolated within training partitions to reduce leakage. A risk-sensitive decision layer links calibrated scores to analyst review and proportionate responses instead of automatic blocking by default. Published research supports the feasibility of learned intrusion detection, but heterogeneous datasets and incompatible validation designs prevent a defensible universal ranking of model families. Consequently, no novel accuracy, area-under-the-curve, or latency results are claimed here. Three original figures and comparative tables distinguish established findings from proposed evaluation procedures and analytically derived relationships. The principal contribution is a falsifiable research design that treats detection quality, workload, resilience, and governance as connected outcomes. It enables future experiments to determine when added model complexity produces measurable protection rather than merely better benchmark scores. The framework is intended for reproducible assessment before deployment, not as proof that a particular detector is already suitable for production environments. All conclusions remain bounded by historical source coverage and should be tested on independently labeled cloud incidents.