Scholarlink

<p>Multi-tenant cloud environments generate heterogeneous, privacy-sensitive traffic that cannot be centralised for intrusion analysis. Conventional intrusion detection systems require raw data aggregation, while standard federated learning degrades under non-IID (non-independent and identically distributed) conditions and produces opaque numeric attributions that hinder analyst response. This paper introduces CloudTenantShield, a three-tier framework combining FedProx-based federated learning, a bidirectional LSTM detection engine, and a locally deployed TinyLLaMA large language model (LLM) narrative explainability moule. Five tenant partitions with deliberately heterogeneous attack distributions simulate realistic multi-tenant conditions. The FedProx proximal term stabilises convergence under non-IID skew, while the LLM converts numerical alert features into actionable natural-language explanations for security operations centre (SOC) analysts, reducing cognitive load and enabling faster alert triage. Evaluated on CICIDS2017 (15 classes, multi-seed) and CICIoT2023 (34 IoT-specific classes), CloudTenantShield achieves 97.87% ± 0.06% accuracy and weighted F1 of 0.9780 ± 0.0007 on CICIDS2017, and 96.43% ± 0.04% accuracy on CICIoT2023 (five seeds). Across both datasets the framework incurs less than 1 percentage-point gap relative to the centralised upper bound and outperforms standard FedAvg by over 2 percentage points. Two-sample paired <i>t</i>-tests (<InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(p&lt;0.0001\)</EquationSource> </InlineEquation>) confirm all CICIDS2017 improvements. A rubric-based evaluation of 50 LLM narratives confirms content faithfulness; a controlled SOC user study is identified as essential future validation. These results align with UN&#xa0;SDG&#xa0;9 on resilient and inclusive digital infrastructure.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

An adaptive federated learning framework with tenant-aware non-IID partitioning and LLM-narrated explainability for multi-tenant cloud intrusion detection

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月20日

查看全文
  • Sree Lakshmi Done,
  • Siva Rama Krishna Tummalapalli

摘要

Multi-tenant cloud environments generate heterogeneous, privacy-sensitive traffic that cannot be centralised for intrusion analysis. Conventional intrusion detection systems require raw data aggregation, while standard federated learning degrades under non-IID (non-independent and identically distributed) conditions and produces opaque numeric attributions that hinder analyst response. This paper introduces CloudTenantShield, a three-tier framework combining FedProx-based federated learning, a bidirectional LSTM detection engine, and a locally deployed TinyLLaMA large language model (LLM) narrative explainability moule. Five tenant partitions with deliberately heterogeneous attack distributions simulate realistic multi-tenant conditions. The FedProx proximal term stabilises convergence under non-IID skew, while the LLM converts numerical alert features into actionable natural-language explanations for security operations centre (SOC) analysts, reducing cognitive load and enabling faster alert triage. Evaluated on CICIDS2017 (15 classes, multi-seed) and CICIoT2023 (34 IoT-specific classes), CloudTenantShield achieves 97.87% ± 0.06% accuracy and weighted F1 of 0.9780 ± 0.0007 on CICIDS2017, and 96.43% ± 0.04% accuracy on CICIoT2023 (five seeds). Across both datasets the framework incurs less than 1 percentage-point gap relative to the centralised upper bound and outperforms standard FedAvg by over 2 percentage points. Two-sample paired t-tests ( \(p<0.0001\) ) confirm all CICIDS2017 improvements. A rubric-based evaluation of 50 LLM narratives confirms content faithfulness; a controlled SOC user study is identified as essential future validation. These results align with UN SDG 9 on resilient and inclusive digital infrastructure.