Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks

TL;DR

This paper introduces a robust semi-supervised temporal learning framework for cloud intrusion detection that effectively handles adversarial contamination and traffic drift, improving detection accuracy and resilience.

Contribution

It presents a novel framework combining consistency regularization, confidence-aware pseudo-labeling, and temporal invariance to enhance semi-supervised intrusion detection in adversarial cloud environments.

Findings

Outperforms existing methods in detection accuracy and robustness.

Demonstrates effectiveness on multiple public datasets under limited labels.

Shows resilience to adversarial and non-stationary traffic conditions.

Abstract

Cloud networks increasingly rely on machine learning based Network Intrusion Detection Systems to defend against evolving cyber threats. However, real-world deployments are challenged by limited labeled data, non-stationary traffic, and adaptive adversaries. While semi-supervised learning can alleviate label scarcity, most existing approaches implicitly assume benign and stationary unlabeled traffic, leading to degraded performance in adversarial cloud environments. This paper proposes a robust semi-supervised temporal learning framework for cloud intrusion detection that explicitly addresses adversarial contamination and temporal drift in unlabeled network traffic. Operating on flow-level data, this framework combines supervised learning with consistency regularization, confidence-aware pseudo-labeling, and selective temporal invariance to conservatively exploit unlabeled traffic while suppressing unreliable samples. By leveraging the temporal structure of network flows, the proposed method improves robustness and generalization across heterogeneous cloud environments. Extensive evaluations on publicly available datasets (CIC-IDS2017, CSE-CIC-IDS2018, and UNSW-NB15) under limited-label conditions demonstrate that the proposed framework consistently outperforms state-of-the-art supervised and semi-supervised network intrusion detection systems in detection performance, label efficiency, and resilience to adversarial and non-stationary traffic.