Quantum-Inspired Deep Learning Detects Cloud Intrusions with High Accuracy

Published in Discover Internet of Things in August 2026, the study presents a three-layer architecture that combines adaptive feature normalization, evolutionary feature selection, and a quantum-inspired deep learning network. The framework was evaluated on three widely used benchmark datasets, demonstrating high accuracy in detecting both frequent and rare attack types, including Denial of Service, probing, remote-to-local, and user-to-root intrusions.

The primary motivation for the study stems from the expanding attack surface of modern cloud infrastructures. Cloud computing supports virtualization, multi-tenancy, and large-scale data processing, which enables applications such as IoT ecosystems and healthcare systems. However, these characteristics also introduce dynamic resource sharing and heterogeneous traffic flows that broaden the scope for cyber threats. Traditional perimeter-based solutions, such as firewalls and static access controls, are often insufficient to monitor the continuous stream of network traffic and system events required to identify anomalous behavior in these complex environments.

Existing intrusion detection systems face significant challenges due to the massive volume and velocity of cloud traffic, high-dimensional feature spaces, and the complex behavioral patterns of advanced attacks. Many current machine learning approaches rely on manually engineered or static feature sets, which can lead to redundancy and reduced generalization capability. Furthermore, conventional normalization techniques often apply uniform scaling regardless of the intrinsic informativeness of individual features, potentially suppressing critical attributes or amplifying noisy ones. This uniform treatment can undermine downstream feature selection and degrade the overall detection accuracy of the classification models.

To address these limitations, the AQSE-QDST framework integrates three mutually reinforcing components. The first is the Entropy-Guided Adaptive Flow Normalization (EAFN) mechanism, which stabilizes heterogeneous feature distributions by dynamically adjusting scaling weights based on feature entropy. This process preserves salient information and mitigates statistical skewness, providing a more balanced feature representation for subsequent processing stages. By emphasizing attributes with higher discriminative information, EAFN enhances the learning stability of the downstream models.

The second component is the Adaptive Quantum Swarm Evolution (AQSE) algorithm, which serves as a metaheuristic strategy for high-dimensional feature selection. AQSE uses probabilistic state vectors to mimic quantum superposition, allowing each particle to encode multiple potential feature selection states simultaneously. This approach improves exploration capability and reduces the likelihood of premature convergence. The algorithm dynamically balances global exploration and local refinement through a dual adaptive update mechanism, enabling more efficient convergence toward discriminative feature subsets than conventional heuristic methods.

The third component is the Quantum-Inspired Dual Spatial-Temporal Network (QDST-Net), a deep learning architecture designed to model the complex dynamics of cloud traffic. QDST-Net jointly captures spatial correlations among traffic attributes and temporal dependencies across evolving network flows. It employs a dual-branch structure for spatial feature extraction and a recurrent transformation for temporal dependency modeling. Additionally, an attention-based refinement mechanism emphasizes the most informative temporal segments correlated with malicious network behaviors, such as burst patterns or stealthy drifts.

The experimental evaluation was conducted on three benchmark cybersecurity datasets: NSL-KDD, CIC-IDS2017, and UNSW-NB15. These datasets were selected to assess the framework’s robustness across diverse traffic characteristics and attack scenarios. The NSL-KDD dataset, a legacy benchmark, was included for historical comparison, while CIC-IDS2017 and UNSW-NB15 provide more recent and realistic representations of modern network traffic. The study utilized official dataset splits where available and applied a stratified hold-out design for others to ensure a leakage-free evaluation.

Results indicated that the AQSE-QDST framework achieved accuracy rates of 99.69% on NSL-KDD, 98.86% on CIC-IDS2017, and 98.65% on UNSW-NB15. These figures surpassed those of several baseline methods, including SVM with Harris Hawk Optimization and Particle Swarm Optimization, as well as deep learning models such as LSTM-based approaches. The framework also demonstrated high recall and F-measure values, indicating a balanced trade-off between precision and detection sensitivity. Statistical validation using independent two-sample Z-tests confirmed that the performance improvements were significant compared to competing approaches.

Ablation studies further analyzed the individual contributions of the EAFN, AQSE, and QDST-Net components. Removing any single module resulted in a measurable decline in accuracy across all three datasets. For instance, on the CIC-IDS2017 dataset, excluding QDST-Net reduced accuracy from 98.86% to 98.35%, highlighting the importance of spatial-temporal modeling in capturing complex intrusion patterns. Similarly, the removal of AQSE led to consistent performance degradation, demonstrating the effectiveness of the adaptive feature selection mechanism in reducing redundancy and retaining discriminative features.

Computational efficiency analysis revealed that the framework maintains a favorable balance between detection performance and resource usage. The average inference latency was measured at 0.51 milliseconds per sample, which satisfies the requirements for real-time intrusion detection in high-throughput cloud environments. Although the AQSE optimization stage introduces additional training-time overhead, this cost is incurred only during the offline model development phase. Once the optimal feature subset is identified, the inference-time complexity remains unchanged, allowing for efficient deployment in operational settings.

The study also evaluated the framework’s performance under severe class imbalance, a common characteristic of intrusion detection benchmarks. The AQSE-QDST model maintained high recall for minority attack classes, such as U2R, even in skewed scenarios. The use of Geometric Mean metrics confirmed that the framework preserves high discriminative capacity regardless of class frequency. This robustness is attributed to the AQSE component’s ability to prevent the loss of minority-class decision boundaries and the QDST-Net’s capacity to capture subtle temporal dependencies.

Despite the strong benchmark performance, the authors acknowledge limitations regarding real-world generalization. High accuracy on controlled datasets does not necessarily guarantee equivalent effectiveness in operational environments where network behavior and attack strategies evolve continuously. The study notes that legacy datasets may not fully reflect the scale and diversity of modern production networks. Consequently, the findings should be interpreted as evidence of strong effectiveness within benchmark-controlled settings rather than a definitive guarantee of unrestricted real-world generalization.

Cross-dataset generalization experiments provided additional insights into the framework’s transferability. When trained on one dataset and tested on another, the model achieved accuracy values above 84%, indicating that it learns discriminative and transferable feature representations rather than merely memorizing dataset-specific patterns. However, the performance reduction compared to intra-dataset results reflects the statistical and structural differences between the datasets. Future work will focus on evaluating the framework under cross-dataset settings, investigating robustness against adversarial traffic, and assessing performance in real-time distributed network environments.

The AQSE-QDST framework represents a significant step toward scalable and adaptive intrusion detection in cloud environments. By integrating entropy-guided normalization, evolutionary feature optimization, and spatial-temporal deep learning, the system addresses key challenges in feature redundancy, class imbalance, and computational efficiency. The study provides a comprehensive evaluation of the framework’s capabilities, offering a robust foundation for future advancements in intelligent cybersecurity systems.

To evaluate practical feasibility, the researchers examined computational overhead and memory usage during both training and inference. All simulations were conducted on an Ubuntu 22.04 LTS workstation utilizing Python 3.10 and PyTorch with standard single-precision floating-point arithmetic. Training the deep network required 29.3 seconds per epoch, while peak graphics processing unit memory usage reached 702 megabytes, proving lower than the 768 megabytes consumed by conventional recurrent models. Although the population search of the feature selection module added an offline runtime cost of 18.9 minutes per training cycle compared to 12.4 minutes for gradient-based alternatives, this optimization occurs strictly before deployment. Scalability tests showed that processing time grew linearly with traffic volume, increasing from 2.6 seconds across 20,000 network flows to 12.8 seconds when handling 100,000 flows without computational bottlenecks.

The multi-objective optimization guiding feature subset selection relied on empirical weight parameters balancing attack detection rates, false alarm frequencies, and feature reduction ratios. Sensitivity analysis determined that assigning sixty percent of the objective weight to attack detection, thirty percent to suppressing false alarms, and ten percent to minimizing feature count provided optimal convergence stability across benchmarks. Tracking fitness values over 100 iterations showed steady progression without premature stagnation, reaching final values near 0.95 for NSL-KDD and CIC-IDS2017, and approximately 0.93 for the noisier UNSW-NB15 dataset under a termination improvement threshold of 10⁻⁶. Furthermore, monitoring loss trajectories revealed tight alignment between training and validation curves, signifying minimal generalization error. Model training terminated automatically at epoch 48 following an early stopping protocol with a ten-epoch patience threshold, preventing unnecessary computational expenditure once the validation loss stabilized.

To verify that performance improvements were statistically reliable, the researchers conducted ten independent experimental trials. Both parametric paired Student’s t-tests and non-parametric Wilcoxon signed-rank tests yielded p-values below 0.05, establishing statistical significance alongside elevated Matthews Correlation Coefficients and Cohen’s Kappa metrics. Methodological controls also prevented data contamination. In UNSW-NB15, exact duplicate records were eliminated prior to partitioning, isolating a designated subset of 257,673 samples comprising 175,341 training and 82,332 testing records across 48 features. Similarly, the 2,491,689 flow records in CIC-IDS2017 were processed across 78 attributes under official splits, preserving authentic class distributions while demonstrating consistent detection capability.

Subject of Research: Integrated intrusion detection framework for cloud environments

Article Title: Metaheuristic optimized deep learning for intelligent intrusion detection in cloud environments

Article References: Farahi, R., Derakhshanfard, N., Sarnaghi, R. A., & Ghaffari, A. (2026). Metaheuristic optimized deep learning for intelligent intrusion detection in cloud environments. Discover Internet of Things, 6(1), Article 139. https://doi.org/10.1007/s43926-026-00485-6

Image Credits: AI Generated

DOI: 10.1007/s43926-026-00485-6

Keywords: intrusion detection, cloud security, deep learning, metaheuristic optimization, quantum-inspired algorithms, feature selection, cybersecurity, NSL-KDD, CIC-IDS2017, UNSW-NB15, spatial-temporal modeling, class imbalance, network traffic analysis, adaptive normalization, swarm evolution, real-time detection, benchmark evaluation, cross-dataset generalization, ablation study, computational efficiency