# A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments
## 3 Materials and Methods  
### Proposed Model  
The proposed model introduces an efficient application of the convolutional neural network (CNN) paradigm for intrusion detection, utilizing the CSE-CICIDS2018 dataset. The proposed approach for intrusion detection consists of seven major stages, as shown in the following Figure 1.  
The dataset collection is the first stage in which we acquired the dataset based on which we trained and tested the performance of deep learning models for intrusion detection in the cloud environment. In the second stage, we preprocessed the collected dataset to remove missing or null values and performed label encoding and data standardization. In the third stage, we applied a feature selection technique based on a Pearson correlation coefficient matrix heatmap to efficiently select useful features to train the deep learning models.  
In the fourth stage, we balanced the dataset with SMOTE oversampling and undersampling and then split the dataset into training and testing sets. In the fifth and sixth stages, we trained and tested deep learning models for the detection and classification of cyberat  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Year** & **Dataset** & **Learning Algorithm** & **Accuracy** \\ \hline
[20] & 2023 & NSL-KDD & Hybrid method based on CNN and LSTM & 99.20\% \\
[21] & 2017 & NSL-KDD & Recurrent neural network (RNN) & 97\% \\
[22] & 2020 & CICID2017 & Convolutional neural network (CNN) & 96.55\% \\
[23] & 2020 & CICID2017 & Long short-term memory (LSTM) & 97\% \\
[24] & 2018 & KDD-CUP’99 & Deep autoencoder (DAE) & 94.71\% \\
[25] & 2020 & NSL-KDD & Naive bayes, support vector & 98\% \\  & & machine, and decision Tree. & \\
[26] & 2018 & NSL-KDD & Deep neural network models & 85\% \\  & & including DCNN, LSTM, and autoencoders & 89\% \\
[27] & 2020 & Kddcup99 & Multi-layer perceptron (MLP) & 91.4\% \\
[28] & 2019 & NSL-KDD & Ensemble learning model with various ML algorithms & 85.2\% \\ \hline \hline \end{tabular}
\end{table}
Table 1: _Cont._  
Figure 1: The proposed model.  
tacks. Finally, we evaluated the performance of trained deep learning models and proposed the best-performing model for efficient intrusion detection in the cloud environment.  
The proposed intrusion detection model for cloud environments leverages a convolutional neural network (CNN) architecture with multiple layers and blocks to efficiently detect intrusions. The model features three Conv1D layers, each with 64 filters and a kernel size of 6 and activated by the ReLU function, followed by batch normalization for stable training and MaxPooling1D layers for down-sampling. After the convolutional and pooling layers, a Flatten layer converts the feature maps into a one-dimensional vector, which is then processed by two fully connected Dense layers with 64 units each and ReLU activation. A Dropout layer with a 0.5 dropout rate is included to prevent overfitting. The final output layer is a Dense layer activated by the SoftMax function to generate class probabilities. Our CNN parameters are shown in Table 2.  
During training, the preprocessed data are divided into balanced sets for training and testing, with the model iteratively extracting hierarchical representations of the input data through the Conv1D layers, batch normalization, and MaxPooling layers. The Dense layers, positioned after the Flatten layer, consolidate the extracted features for classification, with the first Dense layer acting as an intermediary and the Dropout layer enhancing generalization. The final Dense layer before the Softmax activation outputs probability distributions for each class, providing predictive uncertainty. Post-training evaluation on an independent dataset assesses the model's real-world performance using metrics such as accuracy, precision, recall, and F1-score, demonstrating the model's reliability and effectiveness in network intrusion detection for cloud environments. All of these stages are further described in the following subsections.