VIRTUOSO: A Multilayer Cloud Security and Risk Management Framework

Abstract

Despite its continued growth, cloud computing remains susceptible to significant security challenges, as shared virtualised environments pose threats at multiple levels. These vulnerabilities are caused by a lack of security coverage in the responsibility model between the provider and the tenant. In this work, we propose the multi-layered architecture VIRTUOSO (VIRTual Unified Operation Security Optimiser) to cover these security gaps through advanced automation and ML. VIRTUOSO has four layers. The Input Layer extracts key risk components from collected telemetry data. The Deep Automation Security Layer provides automated actions and continuous monitoring of security defences. Its counterpart, the Intelligent Security Layer, predicts threats using anomaly detection. The last layer, the Output Layer, returns an aggregated risk summary. The datasets we used were chosen for their relevance: the UNSW-NB15 dataset, a subset of the web-attack classification from CSE-CIC-IDS2018, and a sample of anonymised log events from AWS CloudTrail. Our ensemble classifiers achieve a best accuracy of 95.08% ± 0.13% on UNSW-NB15 (RF), with statistically significant differences among models confirmed by the Friedman test (p < 0.004) and Nemenyi post hoc analysis, and 99.25% ± 0.52% on web-attack (CatBoost), where ensemble differences are not statistically significant (p = 0.093), consistent with the high separability of this dataset. The training-test gap and DNN curves show no overfitting, whereas our adversarial tests show a maximum accuracy loss of 8.1% at ε = 0.02. With these promising results, we can assert that, pending verification in an actual cloud environment and potential integration with FL, our ensemble classifier model appears to be a good real-world prototype.

1. Introduction

The advent of cloud has truly reshaped the IT industry, spurred by exponential growth in worldwide public cloud expenditure [1]. The cloud provides resources on demand, reducing the high costs associated with older fixed-capacity systems. However, the price of these savings appears to be a rapid increase in global cybercrime costs, which are estimated to reach $10.5 trillion by 2025 [2]. Through the distribution of workloads and security controls, we observe an ever-increasing attack surface, introducing distributed security concerns that traditional perimeters cannot effectively address [3]. In turn, this demands a unified and automated approach to cloud security.

The current cloud security environment is shaped by three converging issues: (a) the increasing reliance on automation and DevSecOps practices, (b) the limitations and open challenges of ML-based detection in real-world environments, and (c) the evolving and often unclear operationalisation of the Cloud Shared Responsibility (CSR) model. Driven by these trends, the IT industry has gradually adopted automation and DevOps principles. DevOps and DevSecOps are now commonplace, with more emphasis placed on integrating security into the development and deployment process, making a level of automation and configuration checking fully expected [4]. At the same time, despite increased implementation of ML in threat detection and the successes demonstrated by various ensemble and deep neural network (DNN) methods on benchmark datasets, key questions about the real-world applicability, overfitting, and adversarial robustness of such techniques persist [5,6,7,8]. What also emerges is that the CSR model continues to evolve. However, from what we have seen, many organisations still have no real conception of the split of responsibility between provider and client, increasing the risk of being targeted due to their own misconfigured systems. Whilst these problems have gradually been addressed, solutions so far seem to tackle specific aspects in isolation. Intrusion Detection System (IDS) research focuses on classification accuracy; tools like Cloud-Native Application Protection Platform (CNAPP) aim to achieve configuration compliance; and discussions on the CSR remain mainly theoretical. What seems to be lacking, and what this research addresses, is a unified framework that bridges the gap between detection, automation, and governance, whilst providing empirical evidence via a range of telemetry feeds.

In this paper, we propose VIRTUOSO, a multi-layered security framework designed for cloud environments. The key components of VIRTUOSO are:

Deep Automation Security Layer: this layer includes a broad set of security best practices for cloud environments, supports configuration and policy enforcement, and integrates with modern CI/CD pipelines and CNAPP-style tools, including infrastructure as code (IaC) and container security scanning via tools such as Checkov and Trivy.

Intelligent Security Layer: the framework uses modern ML algorithms, including ensemble methods and a lightweight deep learning (DL) model, to help with intrusion detection in network traffic and anomaly detection in cloud control-plane logs, operating across two distinct channels and datasets: Channel 1 covers network traffic from the UNSW-NB15 dataset [9] and web-application traffic from CSE-CIC-IDS2018 [10]. Channel 2 concerns, instead, cloud audit logs generated by AWS CloudTrail [11].

Integration Interface: the framework exports a unified risk snapshot that aggregates detection outputs, adversarial robustness metrics, and scanning findings into a single, machine-readable summary for governance decisions.

VIRTUOSO integrates ML-based detection with automated evidence, providing extensive security protection, rather than focusing on only one model or layer. This architecture aims to combine centralised security governance with telemetry and detection distributed across multiple data channels.

The main contributions of this paper are the following:

• A multilayer security framework that combines network intrusion detection, cloud audit-log anomaly detection and configuration scanning under a single, reproducible pipeline, designed to address and mitigate security risks in the cloud as well as during the transition to cloud-native environments, while managing the increasing complexity of multi-cloud and edge-like use cases through a combination of network intrusion detection, cloud audit log analytics, and CNAPP integration.
• A mapping of the proposed layers to the Cloud Shared Responsibility (CSR) model, clarifying how responsibilities for security “of” the cloud and “in” the cloud can be operationalised across providers and consumers with verifiable automation evidence.
• An empirical evaluation of the framework using most known large-scale datasets like UNSW-NB15, CSE-CIC-IDS2018 web attacks, and CloudTrail logs, including adversarial robustness and anomaly detection stress tests, 5-fold cross-validation with statistical significance Friedman–Nemenyi testing, overfitting diagnostics (train/test gap analysis, DNN learning curves, adaptive capacity constraints for small datasets), hyperparameter sensitivity analysis, and computational cost profiling.
• More effective protection of cloud environments by strengthening security automation in the infrastructure and container scanning, CI/CD integration through ML/AI-based detection components, and an aggregated risk view.

Based on the above structure, the remainder of this paper is organised as follows: Section 2 reviews existing cloud security models and frameworks, categorising them into five main areas and discussing the CSR model. Section 3 presents the VIRTUOSO framework and examines the role of layers within the CSR model. Section 4 describes the experimental setup, datasets, and evaluation methodology. Section 5 reports and discusses the results, including statistical analysis and overfitting diagnostics. Section 6 concludes with limitations and future work.

2. Related Work

This section provides an in-depth review of the relevant literature about cloud security and the most common frameworks or models in the field. We classify related work into five persistent challenges with cloud security relying on VIRTUOSO layers. Specifically, this section reviews security challenges across delivery models (IaaS, PaaS, SaaS, and others) and the associated security concerns. We also examine the vulnerability of shared computing resources such as memory, storage, I/O, and CPUs to external attacks, which becomes even more significant when cloud platforms are integrated with IoT systems [12].

2.1. Virtualisation

The key prerequisite for virtualisation technologies at the virtualised layer is to ensure strong security against potential threats. Several methods have been proposed to secure virtualised computer environments, but current research focuses on container-based virtualisation. This method has attracted interest as a substitute for conventional hypervisor-based virtualisation owing to its alleged lightweight characteristics and reduced deployment time. Existing domain-specific models and frameworks include the NIST Cloud Computing Security Reference Architecture [13] and the HyperSafe framework [14]. The scope of NIST architecture encompasses a broad approach to securing virtualised environments across service models (e.g., IaaS, PaaS, and SaaS). HyperSafe also addresses hypervisor security by adopting a lightweight approach to control-flow integrity. However, multi-tenancy still introduces specific challenges, as resource sharing can disrupt or degrade user processes in IaaS and PaaS service delivery models. Therefore, virtualisation security is not only a question of platform primitives, but also of operational assurance, which involves validating and monitoring images and configurations, and runtime artefacts are validated and monitored. Against this backdrop, the VIRTUOSO framework implements a layered security architecture specifically designed for virtualised cloud infrastructures. Rather than proposing new virtualisation primitives, VIRTUOSO complements existing virtualisation security guidance by supporting evidence-based checks on deployment artefacts and by integrating scans that can surface vulnerable components within container and infrastructure configurations. As a result, VIRTUOSO builds on these foundations and later compares classical and modern ML-based intrusion detection models within a realistic virtualised environment.

2.2. Security of Cloud Platforms

At the platform level, cloud security focuses on information safety, secure applications, and enterprise infrastructure. It aims to ensure that services within the data and informatics ecosystem are always accessible to consumers. Major advances in this area are the so-called Zero Trust architectures, as well as AI-driven Security Operations Centres (SOCs) for incident response. The Cloud Controls Matrix (CCM), created by the Cloud Security Alliance, provides a standard set of controls that are continuously refined for cloud-specific security control implementation [15]. This matrix includes the most important features that pose key risks for cloud platforms and help organisations assess their overall risk posture with a selected provider. Major cloud providers have adopted the CSR model, designed to address the complexities of modern cloud environments. For example, AWS has explicitly articulated the concept of “shared controls” to clarify where each party has a stake in responsibility [16]. Figure 1 illustrates this model.

Figure 1. The Shared Responsibility model and security responsibility boundaries.

In IaaS platforms, cloud users are responsible for maintaining the operating system (OS), middleware, and applications on virtualised systems. Within PaaS, cloud users are responsible for data, application and middleware security. Cloud providers handle OS tasks and network or virtual machine hardening. In SaaS, cloud users are responsible only for the data they upload and manage. However, this boundary model is difficult to operationalise in complex multi-cloud and hybrid settings. Here, the same control must be implemented consistently across heterogeneous platforms and teams. Within this shared responsibility landscape, VIRTUOSO aims to complement existing CSR guidance by providing additional detection and automation layers, particularly within IaaS and PaaS platforms. In practice, this means combining network intrusion detection, cloud audit log analytics, and CNAPP-style findings to produce auditable evidence that supports consistent governance decisions across layers, rather than replacing CSR accountability.

2.3. Cryptography and Data Security

At the data protection level, security measures spanning availability, integrity and confidentiality are indispensable in cloud environments. More recently, new homomorphic encryption techniques have been developed, allowing computation over encrypted data without decryption and revealing the original information, and these techniques have been proposed for protecting sensitive information in cloud settings [17]. These cryptographic mechanisms provide the foundational guarantees on which higher-level detection and automation layers can build. VIRTUOSO complements such work by assuming that cryptographic controls and storage protections are handled by the platform and organisational policies, and focusing on detection, automation, and risk aggregation on top of them [18].

2.4. Trust and Trust Management

Trust management is still an essential aspect of cloud security. For instance, one recent development in this area is the use of blockchain technology to provide trust services across cloud environments [19]. In response to the demands of trust management in cloud computing based on decentralised identity, an open-source ecosystem developed by DIF (Decentralised Identity Foundation) is established for promoting the application and compliance with nascent standards [20]. However, many of these models are still evaluated with limited real-world data and do not always capture the operational logic of large distributed systems. In this work, we do not propose a new trust model. Instead, VIRTUOSO focuses on operationalising security decisions through multilayer telemetry and evidence, including IDS outputs, CloudTrail-derived anomaly signals, and CNAPP-style scan findings. Cloud platforms increasingly promote and enforce secure policies through automated environments and recommended best practices, and VIRTUOSO’s Deep Automation Security Layer follows the same principles by aligning with SecOps-oriented tooling. Table 1 illustrates some cloud tools in relation to SecOps principles.

Table 1. Cloud computing tools and coverage of SecOps-related functions.

Tools	Compliance Framework	Security Testing	Security Orchestration
Jenkins	✓	✓	✓
GitLab	✓	✓	✓
Ansible	✓	-	✓
Terraform	✓	-	✓
Docker	-	✓	✓
Kubernetes	-	✓	✓
Prometheus	-	-	✓
ELK Stack	-	-	✓

The tools in Table 1 offer a wide range of security automation approaches, from compliance frameworks to specialised security testing and orchestration. However, the cloud security toolscape is changing quickly, and newer solutions are being released to address increasingly complex multi-cloud environments. Therefore, VIRTUOSO does not assume a fixed toolchain. Instead, it defines an integration pattern in which baseline checks and scan findings can be incorporated as structured evidence and can be combined with ML-based detection signals for more consistent operational prioritisation.

2.5. Privacy

From a privacy perspective, concerns in cloud computing have become increasingly significant, particularly with laws such as the General Data Protection Regulation (GDPR) in the EU and the California Consumer Privacy Act (CCPA) in the US. Recent research efforts have concentrated on mechanisms that protect privacy while processing sensitive data securely in the cloud. Federated learning (FL) has become very popular in recent years, enabling the training of ML models locally on distributed datasets without transferring raw data to a central server [21]. In this context, Kairouz et al. [22] provided a thorough overview of the still-open issues in FL, ranging from communication efficiency to non-IID data distributions to formal guarantees such as differential privacy (DP).

The issues discussed above are indeed strictly linked with intrusion detection and the analysis of audit logs, which we found particularly relevant for a multi-layered security framework like VIRTUOSO. The audit logs produced by the cloud infrastructure, e.g., AWS CloudTrail events, that we used in our Channel 2, inherently contain sensitive operational information (user identities, IP addresses, API call patterns, etc.). This is precisely the reason why the flAWS dataset we used was anonymised by the author through a thorough and consistent pseudonymisation of the identities, an example of how to carry out security research while preserving privacy. Generally, anonymisation techniques such as k-anonymity, data minimisation, and pseudonymisation are fundamental to any practical log-based anomaly detection implementation [23]. In VIRTUOSO, we directly tackle the issue of privacy through the initial design phase, introducing various countermeasures that we are describing in Section 5.10.2: the framework operates on pre-extracted feature vectors, never on raw payloads; it is built using the principle of data minimisation, and, at the end, we only provide aggregate risk scores, without revealing single records. These architectural decisions are fully aligned with Article 25 of the GDPR on data protection “by design” and “by default”. As a logical next step, as described in Section 6, we envision that FL could also be integrated into the Intelligent Security Layer, enabling distributed model training locally at the individual organisation and thereby avoiding the transfer of raw telemetry to a centralised server.

2.6. Integrated Cloud Security Frameworks

Up to now, we have been dealing with single security dimensions: virtualisation, cloud platform security, encryption, trust, and privacy. In the recent literature, several papers attempt to combine these multiple dimensions into a unified framework. Hence, we have selected representative works from the current literature and compared them with our VIRTUOSO framework.

For instance, papers such as those of Mehmood et al. [24] propose a multi-factor, multi-level authentication framework for cloud platforms. It includes access control and intrusion detection mechanisms, as well as adaptive authentication selection. Their solution covers a substantial part of the identity and access security dimension. However, what becomes evident is the absence of ML-based traffic analysis and configuration scanning components, effectively limiting the security scope to the authentication perimeter.

Regarding the ENISA Multilayer Framework for Good Cybersecurity Practices for AI [25], we observe that it presents a governance-oriented reference architecture spanning legislative and organisational levels up to the most technical aspects. The proposed framework offers valuable strategic guidance on AI resilience and bias mitigation. However, it primarily consists of guidelines, which appear more theoretical than what can be achieved through pipeline-based empirical validation. There is no empirical evaluation based on benchmark datasets, which limits its operational applicability.

More specifically, in relation to ML and cloud security, there is an increasingly large body of surveys classifying security detection techniques. A survey by Alzoubi et al. [26] reviewed and categorised more than 4000 papers on DL and ML applied to cloud computing security. Anomaly detection, intrusion detection, and security automation emerge as the most active research trends. Similarly, cloud IDS surveys analysed in our study provide systematic comparisons of supervised, unsupervised, and DL approaches [27]. The reported results indicate strong performance in many cases, particularly for ensemble methods such as Random Forest (RF) and XGBoost evaluated on benchmark datasets, including UNSW-NB15 and CIC-IDS2018, which are also used in our work. These studies move towards a more operational perspective. Even so, very few evaluations consider adversarial robustness, and they rarely integrate multi-layered architectures that combine dynamic detection pipelines with security management tools commonly used for cloud configuration and protection.

This suggests a persistent fragmentation between runtime detection and preventive security layers. At an industrial level, several solutions have converged into the Cloud-Native Application Protection Platform (CNAPP), a term introduced by Gartner in 2021 [28]. Commercial platforms from CrowdStrike, Palo Alto Networks, and Wiz integrate Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), IaC scanning tools, and runtime threat detection within a unified interface. These platforms demonstrate the practical benefits of integrating multiple security capabilities. However, their proprietary nature limits reproducibility. Evaluation metrics are also typically focused on feature coverage rather than controlled empirical validation using public datasets.

Overall, our analysis indicates a gap between the ML and DL research community, which focuses on optimising classifier performance on largely isolated datasets, and the DevSecOps community, which provides mature scanning and configuration management tools but lacks integrated detection mechanisms based on these data sources. To characterise this gap in greater detail, Table 2 summarises how five key capabilities interact with the analysed frameworks and our VIRTUOSO framework, which are: (a) ML-based network IDS, (b) cloud audit log anomaly detection, (c) configuration and container scanning, (d) adversarial robustness testing, and (e) mapping against the CSR model.

Table 2. Comparison of selected capabilities covered by literature and VIRTUOSO.

Framework/Review	ML-IDS	Audit-Log Anomaly	Config Scanning	Adversarial Eval	CSR Mapping
Multifactor–Multilayer [24] (2023)	-	Partial (Auth only)	-	-	Partial
ENISA Multilayer [25] (2023)	-	-	Guidance only	-	-
Alzoubi et al. [26] (2024)	Review	Review	-	Mentioned	-
Commercial CNAPPs [28]	Vendor-specific	Vendor-specific	Yes	-	Implicit
VIRTUOSO framework	Yes (4 ensembles + DNN)	Yes (AE + IF)	Yes (Checkov, Trivy)	Yes (FGSM, PGD)	Yes (explicit)

As shown in Table 2, we focused our efforts in VIRTUOSO on covering all five capabilities within a single pipeline. The primary limitation concerns reproducibility in production-like environments, an aspect we will address further in Section 5.10.3. While commercial CNAPP platforms operate on real-time production telemetry within operational environments, we tested VIRTUOSO using public benchmark datasets under strictly controlled conditions. Nevertheless, at least in this initial phase, our goal is to demonstrate architectural feasibility and provide empirical evidence for this multi-level approach. We have no pretension of replacing production-ready tools at this early stage.

3. VIRTUOSO Framework

This section describes the VIRTUOSO architecture, each layer’s role, and its integration within the pipeline. The Intelligent Security Layer follows established DL anomaly detection approaches, using autoencoder models to capture routine operations and detect deviations. We also provide an in-depth description of each framework layer and its connections.

3.1. Overview of VIRTUOSO Architecture

The VIRTUOSO framework consists of four layers, each performing a distinct function within the pipeline.

Figure 2 provides a visual overview of how these layers are organised and relate to the overall architecture. The following paragraphs introduce the role and interconnection of each layer in detail.

Figure 2. An overview of the multi-layered VIRTUOSO framework.

In our framework these layers operate across two primary data channels:

• Channel 1 (network and web-application traffic), built from the UNSW-NB15 and CSE-CIC-IDS2018 web-attack datasets;
• Channel 2 (cloud control-plane activity), built from AWS CloudTrail logs and complemented by Checkov and Trivy scan reports.

Both channels are ingested via L1, which sequentially passes the collected telemetry to L2. L2 processes and extracts posture evidence, then forwards the output to L3 for ML-based detection. The processed results are subsequently sent from L3 to L4, where all outputs are aggregated into a unified risk representation. This sequential transition clarifies how each layer receives input from the previous layer before passing outputs onward. Since the Input and Output Layers primarily serve as data entry and reporting interfaces, and our empirical evaluation concentrates on L2 and L3, which form the operational core of VIRTUOSO. The four layers are described in detail as follows:

• Input Layer (L1): it aggregates heterogeneous telemetry from virtualisation, platform, cryptographic, trust, and privacy-relevant sources. In our implementation, L1 ingests: (a) network flow and HTTP/HTTPS feature CSVs from the IDS benchmark datasets; (b) CloudTrail audit events exported as JSON/CSV from the flaws.cloud challenge environment; and (c) JSON reports from Checkov and Trivy. In a production deployment, for example, Channel 1 would receive feature vectors from a flow exporter for anomaly detection such as CICFlowMeter, while Channel 2 would stream CloudTrail logs from an S3 bucket or CloudWatch subscription filter.
• Deep Automation Security Layer (L2): this layer implements a DevSecOps-oriented baseline assessment that produces structured scan evidence before detection analytics are applied. In practice, L2 focuses on two concrete aspects: (a) static analysis and misconfiguration detection over IaC templates using Checkov; and (b) container image scanning with Trivy. Both tools are invoked programmatically; their JSON outputs are parsed into a common finding’s schema (check identifiers, severities, target resources, etc.) that enables the Integration Interface to merge scan findings with ML detection outputs. Extending the framework to additional scanners (e.g., tfsec, KICS, Grype) requires only a conforming parser. Reinforcement learning (RL) for cyber-defence automation has been proposed in prior work [29] but is not part of the current implementation. However, we consider this point as a future extension in Section 6.
• Intelligent Security Layer (L3): The Intelligent Layer hosts ML-based detection models. In Channel 1, L3 trains tree-based ensembles (Random Forest, XGBoost, LightGBM, CatBoost) and a lightweight DNN on the UNSW-NB15 and CSE-CIC-IDS2018 web-attack datasets. This is consistent with the use of ensemble and neural models in cybersecurity [30,31]. In Channel 2, L3 runs an autoencoder on benign CloudTrail sessions to detect anomalous reconstruction error, following deep anomaly detection methods [32]. Once L2 baseline checks are satisfied, the telemetry is treated as higher-trust input at L3. L3 outputs are then interpreted with L2 scan evidence and exported to the unified risk snapshot. Advanced directions, such as RL-based cyber defence and insider threat monitoring, are considered future work.
• Integration Interface and Output Layer (L4): The Integration Interface bridges the layers. It collects model metrics (such as clean and adversarial accuracy and ROC/PR values) and CNAPP findings. These are combined in a single machine-readable risk snapshot table that summarises the current security posture for both channels. This table is used for analysis in Section 5. The interface exports information in a structured, machine-readable format rather than a GUI. The risk snapshot is a tabular artefact designed for use by governance tools or analysts.

Regarding the automation scope, we perform dataset preprocessing, feature selection, model training, cross-validation, adversarial perturbation, autoencoder threshold calibration, and risk snapshot export without manual intervention. Only two aspects remain manual. The first is the configuration of scan targets, such as Terraform files or container images. The second concerns the interpretation of the aggregated snapshot. We leave this final task to a human analyst, consistent with the human-in-the-loop principle we described in Section 3.5.

3.2. The Deep Automation Security Layer

Figure 3 illustrates L2 in operation. The layer enforces a minimum security baseline on infrastructure and workload configurations before telemetry is passed to the ML-based detection components. Its four operational functions are:

Figure 3. The Deep Automation Security Layer in action. Scan evidence is generated and summarised before detection and outputs are interpreted.

• Automated policy enforcement: The layer applies scan rules, baseline checks, and standard security benchmarks to produce structured findings that can support governance decisions.
• Automated monitoring: The pipeline can be re-executed to identify newly introduced misconfigurations or vulnerable artefacts.
• Automated configuration management: Periodic audit evidence enables versioned reporting of configuration state over time.
• Automated incident response: L2 generates structured findings that can ben consumed by external orchestration or security orchestration, automation, and response (SOAR) tools. However, fully automated remediation such as automatic issue resolution is left for future work.

By reducing the likelihood that vulnerable configurations are overlooked before detection, L2 contextualises L3 model outputs with posture signals, ensuring that ML decisions are not consumed in isolation.

3.3. The Intelligent Security Layer

The Intelligent Security Layer executes ML-based detection models and exports structured evidence across both channels. This layer consists of the following components:

• Anomaly detection: This uses supervised ensembles and a DNN to distinguish benign from malicious flows in Channel 1; an autoencoder flags high-reconstruction-error sessions in Channel 2.
• Dynamic robustness and assessment: The layer quantifies detection stability under perturbations by evaluating IDS models on adversarial perturbed inputs.
• Predictive decision support: Beyond detection, the evidence exported by VIRTUOSO can be used to support anticipatory risk assessment, for instance by identifying repeated exposure patterns, rising anomaly score trends, or recurring misconfiguration classes across successive runs. In the current implementation, this capability is realised as periodic re-evaluation and comparison of exported evidence rather than as a separate predictive model. Therefore, predictive decision support is treated as a governance-oriented extension that can guide proactive hardening and scheduling of remediation, without introducing autonomous policy changes.
• ML engine: This component manages the learning and inference pipeline across both channels. For Channel 1, it integrates classical ensemble learners mentioned earlier as well as a lightweight DNN for supervised intrusion detection. For Channel 2, it employs an autoencoder trained on benign CloudTrail events for reconstruction-based anomaly detection. Model outputs and associated metrics are standardised and exported to the unified risk snapshot.

L3 operates in conjunction with L2, which provides baseline assurance signals used to contextualise detection outputs. L2 does not block assets or enforce patching, but it exports findings that L3 uses to contextualise and prioritise detections. Once baseline checks are satisfied, telemetry is treated as higher-trust input at L3, and outputs are aggregated into the unified risk snapshot (Figure 4).

Figure 4. The Intelligent Security Layer in action. Telemetry passing the Deep Automation Security Layer checks is analysed by ML-based detectors. Channel 1 applies supervised intrusion detection models, while Channel 2 applies reconstruction-based anomaly detection on CloudTrail logs, with outputs exported to the unified risk snapshot.

Our findings are consistent with recent ML and DL research on IDS [33].

3.4. Integration of Layers

L2 and L3 are integrated through systematic aggregation rather than automatic policy updates. Scan findings and severity ratings from L2, combined with detection metrics and adversarial robustness scores from L3, surface to the same unified risk snapshot. When both signals converge on the same asset or control, the system treats this overlap as a high-confidence indicator requiring priority review, with any rule change remaining a governed human decision. This design provides a complete and auditable evidence trail from raw telemetry through module-level analytics to prioritisation-oriented reporting.

3.5. Conflict Management and Adaptability

A key feature of VIRTUOSO is the conflict resolution and management between security policies that may occur among different cloud computing layers (virtualisation, cryptographic trust mechanism, privacy) as well as amongst tenants, applications or service models. In this work, rather than claiming an automated policy engine, we rely on clear evidence produced by the Deep Automation Security Layer and measurable outputs from the Intelligent Security Layer, so that policy decisions can be taken on a transparent and auditable basis.

3.5.1. Security Policy Conflict Management

VIRTUOSO implements a multi-level conflict resolution mechanism to keep the security policies consistent and applicable.

• Risk-based prioritisation: Policies are ranked by risk level, driven by two converging signals—scanner findings and severities from L2, and detection and robustness metrics from L3. Overlap on the same asset is treated as a high-confidence urgency indicator [34].
• Predefined composition rules: Conflicting policies are resolved through a rule set informed by security-by-design optimisation, which selects configurations that balance security requirements and operational constraints [35].
• Dynamic resolution: The Intelligent Security Layer uses contextual signals to interpret suspicious activity and prioritise response actions, reflecting the principle that security decisions depend on content in context [36].
• Human-in-the-loop escalation: Critical conflicts that cannot be resolved autonomously are escalated to a human analyst, supported by explainable AI (XAI) techniques that provide insight into model predictions to improve transparency and reliability of security decisions [37]. In the current implementation, the tree-based ensembles natively expose feature importance rankings, which offer a first level of interpretability; integrating post hoc methods such as SHAP values is identified as a future extension.

3.5.2. Adaptability Across Tenants and Service Models

VIRTUOSO supports multi-tenancy by running the same multilayer workflow on tenant-scoped evidence sources and exporting results to a unified, machine-readable risk snapshot. Adaptability is realised through:

• Tenant profiles and metadata: Each exported record carries structured metadata fields (channel, dataset, layer, tier, source), enabling per-tenant reporting, cross-tenant comparison, and auditing without merging raw data across organisational boundaries.
• Channel-specific analytics: Models can be trained, calibrated, and re-evaluated on tenant-specific data while preserving a common reporting schema—supervised classification metrics for Channel 1 and reconstruction-based anomaly signals for Channel 2.
• Fine-grained policy alignment: The unified risk snapshot can be filtered by layer and source to link policy decisions to explicit, traceable findings at the workload, control-plane, or infrastructure level, across IaaS, PaaS, and SaaS service models.

3.6. Effects of Deep Automation Security Layer on CSR Model

L2 operationalises the Cloud Shared Responsibility model by applying verifiable security baselines through automated evidence generation on deployment artefacts and cloud configuration surfaces [38].

This supports a more evidence-driven interpretation of shared controls, rather than a transfer of accountability between providers and users. Table 3 and Table 4 summarise this operationalisation.

Table 3. New Shared Responsibility model under VIRTUOSO.

Security Domain	Iaas	PaaS	SaaS
Data and Data Access	Shared	Shared	Shared
Application	User	User	Provider
Middleware	User	Shared	Provider
Operating Systems	Shared	Provider	Provider
Network	Shared	Provider	Provider
Virtual Environments	Shared	Provider	Provider
Physical Security	Provider	Provider	Provider

Table 4. Comparison of traditional CSR Model and VIRTUOSO CSR with operational mapping.

Security Domain	Traditional CSR	VIRTUOSO CSR	VIRTUOSO Operational Evidence
Data and Data Access	User	Shared	Channel 2 autoencoder detects anomalous data access patterns in CloudTrail logs (e.g., unusual GetObject/PutObject frequency); Checkov verifies S3 bucket policies and encryption settings
Application	User (IaaS, PaaS), Provider (SaaS)	User (IaaS, PaaS), Provider (SaaS)	Channel 1 IDS classifiers detect web-application attacks (BF-Web, XSS, SQLi) in HTTP traffic features; Trivy scans application container images for known CVEs
Middleware	User (IaaS), Provider (PaaS, SaaS)	User (IaaS), Shared (PaaS), Provider (SaaS)	Checkov validates middleware configuration artefacts (e.g., API gateway settings, load balancer TLS policies) against baseline rules
Operating Systems	User (IaaS), Provider (PaaS, SaaS)	Shared (IaaS), Provider (PaaS, SaaS)	Trivy filesystem scanning detects OS-level vulnerabilities in deployed images; Channel 1 IDS captures network-level indicators of OS exploitation
Network	Shared	Shared (IaaS), Provider (PaaS, SaaS)	Channel 1 ensemble classifiers (RF, XGBoost, LightGBM, CatBoost) and DNN perform real-time classification of network flows across 9 attack categories
Virtual Environments	Provider	Shared (IaaS), Provider (PaaS, SaaS)	Checkov evaluates IaC templates (Terraform, CloudFormation) for virtualisation-related misconfigurations before deployment
Physical Security	Provider	Provider	Outside VIRTUOSO scope remains provider responsibility

Table 3 shows the revised responsibility assignments under VIRTUOSO; Table 4 maps each domain to the specific VIRTUOSO component that generates supporting evidence.

For example, the shift from “User” to “Shared” in the Data and Data Access domain does not transfer data protection responsibility to the provider. Rather, the autoencoder we deployed on the CloudTrail logs provides an additional behavioural detection layer. This directly complements the user’s own access policies. In a closely related way, the ensemble classifiers we trained on UNSW-NB15 augment provider-level network controls with application-aware threat detection.

Providers are obviously not responsible for insecure configurations or customer-controlled changes that increase exposure [39,40]. We address this exact gap by coupling telemetry analytics with posture-oriented checks. These checks surface insecure configurations as structured, auditable findings before any operational action occurs. Shifting the focus to shared responsibility clarifies control boundaries and supports more consistent governance across different service models [41]. Consequently, we can frame this layer as a fundamental security guardrail as it produces results through verifiable evidence. Secure development practices and change control, however, remain strictly under the tenant’s responsibility.

4. Experimental Setup and Datasets

We ran the VIRTUOSO pipeline in a Google Colab notebook. We chose this setup because it is easy to reproduce and easily customisable. In addition to this, we deliberatively used limited resources comparable to a shared compute node with 2 CPU cores and 12 GB of RAM, and an optional access to an NVIDIA L4 GPU only for heavy tasks. All steps, from data processing and feature creation to model training and reporting, were combined into one workflow. We used popular open-source Python libraries: scikit-learn 1.6.1, XGBoost 3.2.0, LightGBM 4.6.0, CatBoost 1.2.10, TensorFlow 2.19.0, pandas 2.2.2, and Matplotlib 3.10.0. The notebook handled raw UNSW-NB15 and CSE-CIC-IDS2018 CSV files for analysing network and web attacks, applied label encoding and feature scaling, and used 5-fold cross-validation for the main machine learning models. For neural networks, we trained the model with a stratified train-test split and an internal validation split to choose training settings and report performance. We also analysed cloud activity using AWS CloudTrail logs from the flAWS challenge dataset. Events were grouped into session-level records and examined with two unsupervised detectors: a neural network that learned typical behaviour and an isolation-based detector. Anomaly scores were reported in the same way as the rest of the framework. To test robustness, we modified network features in the intrusion detection models and introduced controlled input changes to the CloudTrail detector, ensuring the evaluation measured both prediction accuracy and stability. We included security posture evidence by parsing results from infrastructure and container scanners, then combined these findings with detection outputs in a single risk table for prioritisation. The workflow was built to run on a single, affordable node and to be portable across common cloud platforms, using standard software and file-based outputs. This approach allows for a structured assessment of performance, robustness, and coverage across all evidence sources in VIRTUOSO. We simulated data preparation steps to ensure the transformed datasets matched those used in regular operation. By using public datasets, our method stays reproducible and easy to check. Since the setup supports both classical machine learning and neural models, it enables a thorough evaluation of VIRTUOSO against different types of attacks and real-world vulnerabilities.

4.1. Machine Learning Algorithms (Baseline and Advanced Models)

To assess the VIRTUOSO framework, we executed and evaluated several ML algorithms. Specifically, we included a baseline model and a set of more advanced algorithms that researchers frequently use for tabular security data.

Baseline model: Random Forest (RF) serves as the baseline model in our framework. This model aggregates the output of several decision trees. RF thus serves as an optimal baseline model, given its out-of-the-box performance on security datasets, and can be reliable, with minimal hyperparameter tuning, with the relative ease of training and evaluation.

Advanced learners. To enhance empirical evaluation, we also test the following models:

• XGBoost: This is based on a gradient boosting technique for training on tabular data more effectively [42].
• LightGBM: A gradient boosting-based technique that is often faster on large tabular datasets [43].
• CatBoost: A gradient boosting technique with categorical variable support [44].
• Deep Neural Networks (DNN): These are multi-layered feed-forward architectures implemented in Tensor Flow representing nonlinear interaction.

For consistency and reproducibility, all algorithms were implemented using popular open-source Python frameworks such as scikit-learn, XGBoost, LightGBM, CatBoost, and TensorFlow. In addition, when advanced learners are assessed methodologically, the Random Forest is chosen as a baseline, offering three additional benefits:

• Benchmarking clarity: Random Forest acts as a popular baseline reference model for tabular security tasks.
• Interpretability and operational cost: Using a conventional feature importance rating, RF can provide simple evidence on variable importance. In addition, it gives effective training results on commodity CPUs, which makes it appropriate for limited-computation resources.
• Gradual shift to bigger capacity models: After recording the RF baseline, incremental improvements in discrimination and error trade-offs can be used as motivation to move to boosted trees (XGBoost, LightGBM, and CatBoost) and DNNs. Neural models can help when nonlinear interactions are substantially significant, but a boosted tree has a fixed detection rate that reduces false alarms.

Finally, computational cost is not an afterthought but a key part of the evaluation. Therefore, we use RF as the low overhead reference model and resort to more complex learning models only when they provide sufficiently large gains that justify the increased training and tuning effort.

4.2. Evaluation Metrics

To evaluate model performance, we rely on eight complementary metrics: accuracy, precision, recall, F1 score, AUC-ROC, false positive rate (FPR), false negative rate (FNR), and the Matthews correlation coefficient (MCC). The current literature widely accepts these choices, particularly the inclusion of MCC [45]. We incorporate both threshold-dependent measures (accuracy, precision, recall, F1, FPR, FNR) and threshold-independent ones (AUC-ROC). This allows us to capture the classifier’s behaviour across different operating points. We selected MCC to guarantee a balanced assessment even when class distributions are not uniform. This proves highly relevant for the UNSW-NB15 dataset, where attacks represent 63.9% of the records. FPR and FNR deserve explicit attention, as they carry a direct operational meaning in security contexts. A high FPR drastically increases validation difficulty for analysts due to an excessive number of false alarms. Even more severely, a high FNR implies missed detections. These blind spots can easily lead to incorrectly identified breaches. Following the methodology we described in Section 4.3, we report all metrics as mean ± standard deviation. We extract these values across a 5-fold stratified cross-validation for the ensemble models and across five repeated random splits for the DNN.

4.3. Experimental Procedure

The experimental workflow in this study was carefully structured as follows:

• Data preparation and preprocessing: Raw CSV files from UNSW-NB15 and CSE-CIC-IDS2018 were ingested with pandas; categorical fields (IP, port, service, protocol, state) were label-encoded, while numerical attributes were standardised with StandardScaler.
• Class balance control: For each training fold, the minority class was increased using SMOTE and, in parallel, class weights were applied during model fitting. Therefore, the training process reduces the risk that the models optimise accuracy by favouring the majority class, which would typically reduce detection performance on attacks.
• Sampling for compute constraints: To keep the study reproducible in Google Colab, the most computationally demanding models were trained on a stratified 10% subsample of UNSW NB15, while preserving the benign to attack ratio. At the same time, the smaller web attack subset was processed in full to avoid unnecessary information loss.
• Cross validation: All models were evaluated with 5-fold stratified cross validation (shuffle enabled, seed 42), and metrics were averaged across folds.
• Baseline and advanced models: A plain Random Forest was used as the baseline. The advanced models included XGBoost, LightGBM, CatBoost, and a feed-forward neural network trained on scaled tabular features with explicit class balance control.
• Performance criteria: Accuracy, precision, recall, F1 score, Matthews’s correlation coefficient, and AUC-ROC were recorded for each model and dataset. Rank-based measures such as AUC were emphasised because they are less sensitive to a single probability threshold.
• Model update protocol, retraining and parameter choice: Models were retrained from scratch whenever training was executed within the experimental protocol, using the same preprocessing and class balance steps defined for the corresponding fold or split. Parameter values were selected through a limited, compute-bounded search for the tree-based models, while the neural model relied on early stopping and learning rate reduction to stabilise training. Across runs, the same search ranges, seeds, and evaluation protocol were kept fixed to preserve comparability.
• Resource monitoring: Training time and peak memory use were recorded to confirm that the workflow remained feasible within a modest single node setting.

Overall, the procedure aimed to keep the evaluation reproducible under constrained resources while maintaining statistically meaningful comparisons across models and datasets.

4.4. Dataset Analysis

Table 5 summarises the three datasets used to evaluate the VIRTUOSO framework across both detection channels.

Table 5. Dataset summary across datasets used in our study.

Dataset	Channel	Records	Features	Classes	Attack Types	Balance
UNSW-NB15	Channel 1 (IDS)	257,673	39 (numeric)	Binary (Normal/Attack)	9 categories	63.9% attack
CSE-CIC-IDS2018-WEB	Channel 1 (IDS)	1856 (balanced)	38 (after selection)	Binary (Benign/Web Attack)	3 (BF-Web, XSS, SQLi)	50/50
CloudTrail flAWS	Channel 2 (CloudTrail)	11,624 sessions	5 (engineered)	Unsupervised	Multi-level AWS attacks	N/A

UNSW-NB15. We used the official training and testing partition (175,341 + 82,332 = 257,673 records) provided by this dataset, which contains 93,000 normal and 164,673 attack instances (63.9% attack ratio) across nine categories: Generic (58,871), Exploits (44,525), Fuzzers (24,246), DoS (16,353), Reconnaissance (13,987), Analysis (2677), Backdoor (2329), Shellcode (1511) and Worms (174). After dropping the multi-class label and non-numeric columns, 39 numeric features were retained for binary classification (normal vs. attack).

CSE-CIC-IDS2018 Web-Attack Subset: We selected the two most representative days of attacks in CSE-CIC-IDS2018, Thursday 22nd February and Friday 23rd February, where web attacks are concentrated (2,097,150 raw data flows in total). However, only 928 were labelled as web attacks (611 Brute Force–Web, 230 Brute Force–XSS, 87 SQL Injection); the remaining flows were benign traffic. Thus, we balanced the data by selecting 928 randomly sampled benign flows, and the resulting dataset comprised 1856 samples. Due to the low number of samples, we used a two-stage feature selection process. First, a variance threshold filter allowed us to discard 10 features whose variance was approximately zero (78 → 68). Following this initial filtering, the Pearson correlation pruning at a threshold of ∣r∣ > 0.95 removed another 30 redundant features (68 → 38). Ultimately, we retained 38 features, resulting in a sample-to-feature ratio of 48.8. This approach successfully mitigated the risk of overfitting tied to the high dimensionality relative to the number of samples.

CloudTrail flAWS: We used publicly accessible, anonymised CloudTrail logs from the flaws cloud environment. The raw corpus comprises 1,939,207 API events. These correspond to 3.5 years of attacks across several levels targeting AWS services (public S3 buckets, EBS snapshot exfiltration, EC2 metadata theft, and IAM privilege escalation). To manage this volume, we aggregated these events into 11,624 sessions. We rigidly define each session by the tuple (user ARN, source IP). From this setup, we derive exactly five numerical features per session: number of events, number of distinct event names, number of distinct event sources, error rate, and number of events per hour. This produces a clear unsupervised anomaly detection problem in this channel. We tackle this by deploying a combination of an autoencoder and an Isolation Forest. We chose these specific algorithms simply due to a total lack of ground-truth labels at the session level.

For the ensemble classifiers on Channel 1, we evaluated all models using a 5-fold stratified cross-validation. For the smaller subset CSE-CIC-IDS2018-WEB (n < 5000), we applied constraints consistent with the model capacity, including reduced tree depth, a lower number of estimators, and stronger regularisation to prevent memorisation of the training set, as described in detail in Section 5.

5. Results and Discussion

This section presents a full review of the VIRTUOSO framework on the chosen datasets and presents the results of our experiments. Based on them, we also include real-life case studies that can lead VIRTUOSO being used and tested in real-life environments.

5.1. Network Intrusion Detection Analysis (UNSW-NB15 Dataset)

We evaluated each algorithm’s performance using the eight metrics discussed in Section 4.2. All ensemble classifiers were evaluated via 5-fold stratified cross-validation on 257,673 records (39 numeric features), while the DNN was assessed over five repeated 80/20 stratified splits with different random seeds. Results are reported as mean ± standard deviation to quantify variability across folds.

Figure 5a presents bar charts for all eight metrics with error bars representing one standard deviation, alongside a comparative ROC curve overlay shown in Figure 5b. Among the ensemble models, Random Forest achieves the highest accuracy (95.08% ± 0.13%) and F1 score (96.15% ± 0.10%), followed closely by XGBoost (94.76% ± 0.15%) and LightGBM (94.75% ± 0.16%). CatBoost ranks fourth at 94.53% ± 0.16%. All four ensembles attain AUC-ROC values above 0.99, indicating strong discrimination between normal and attack traffic. The DNN achieves 93.04% ± 0.19% accuracy, lower than the ensembles, with a higher FNR (8.11% ± 0.47%) compared to RF (3.93% ± 0.14%), suggesting that the lightweight two-layer architecture trades recall for precision (97.06% ± 0.22%).

Figure 5. (a) Performance metrics for UNSW-NB15 dataset and (b) ROC curves.

We applied the non-parametric Friedman test to the per-fold values of accuracy, F1, MCC, and AUC-ROC to assess if the observed differences between the ensemble models were statistically significant. For all four metrics considered, the test rejected the null hypothesis of performance equivalence (p < 0.004). What emerges from the Nemenyi post hoc analysis is that RF significantly outperforms CatBoost (p = 0.0014 for accuracy, F1, and MCC). Conversely, we found no significant differences between XGBoost and LightGBM (p = 0.99), nor between LightGBM and RF (p = 0.32). These findings indicate that the ensemble model choice heavily impacts this dataset, with RF showing a relevant edge.

Moving to false positive and false negative rates, RF achieves an FPR of 6.66% ± 0.28% alongside an FNR of 3.93% ± 0.14%. Within the ensembles, LightGBM exhibits the lowest FPR (6.21% ± 0.21%), whereas RF presents the lowest FNR. We note that the DNN secures the lowest absolute FPR (4.94% ± 0.41%), yet it faces a higher FNR (8.11%). In fact, this latter metric drives an even more substantial uncertainty in decision-making terms. On a practical level, an FPR of 6–7% across a dataset with 93,000 benign records would generate around 5800 to 6500 false alarms per evaluation cycle. As discussed in Section 3.4, such figures demand different aggregate-level subdivisions based on priority, allowing us to filter only the alarms that are genuinely relevant to the considered detection system.

5.2. Web Attack Analysis (CSE-CIC-IDS2018 Subset Dataset)

In this section, we provide an in-depth evaluation of the VIRTUOSO framework’s performance on the web-based threat-focused CSE-CIC-IDS2018 subset. As described in Section 4.4, this subset comprises 1856 balanced samples (928 attacks, 928 benign), drawn from log files recorded on Thursday 22 and Friday 23 February 2018 and covering three categories of web attack: Brute Force–Web (611 flows), Brute Force–XSS (230 flows), and SQL Injection (87 flows). Two stages of feature selection reduced dimensionality from 78 to 38 variables (VarianceThreshold followed by Pearson correlation pruning at |r| > 0.95), giving a samples-to-features ratio of 48.8. Given the limited sample size (n = 1856), model capacity was constrained to reduce the risk of overfitting: Random Forest was limited to max_depth = 10, 100 trees, and min_samples_leaf = 5; and boosting-based methods used max_depth = 4, 150 iterations, and L1/L2 regularisation (reg_alpha = reg_lambda = 1.0). These constraints ensure no model achieves perfect training accuracy, as confirmed by the train/test gap analysis in Section 5.4. Figure 6a presents comparative bar charts for each evaluation metric from (1) to (8). All algorithms show consistently strong performance on this dataset. CatBoost achieves the highest accuracy (99.25% ± 0.52%) and the best MCC (0.9849 ± 0.0104), followed by LightGBM (99.08% ± 0.24%) and Random Forest (99.03% ± 0.78%). XGBoost ranks fourth at 98.76% ± 0.36%. All four ensemble methods, shown separately in Figure 6b, reach an AUC-ROC above 0.998, with CatBoost and Random Forest at 0.9993 and 0.9992 respectively. The DNN achieves 95.38% ± 0.82%, below the ensemble methods, with a notably higher FPR (8.71% ± 1.59%) but the lowest FNR (0.54% ± 0.38%), suggesting the network favours recall over precision on this dataset.

Figure 6. (a) Performance metrics for the subset of CSE-CIC-IDS2018 dataset and (b) ROC curves.

Unlike the UNSW-NB15 results, the Friedman test fails to reject the null hypothesis for accuracy (p = 0.093), F1 (p = 0.178), and AUC-ROC (p = 0.323), indicating that performance differences among ensemble models on this dataset are not statistically significant. This outcome is consistent with both the small sample size and the high separability of web-attack features after selection: all models converge towards near-optimal classification boundaries, leaving little room for differentiation. This stands in contrast to the UNSW-NB15 results, where RF was significantly superior to CatBoost (p = 0.0014), suggesting that model selection matters more on larger, noisier datasets.

The higher accuracy on this subset relative to UNSW-NB15 (99% vs. 95%) reflects the curated nature of the web-attack data rather than overfitting. As shown in Figure 6a, most models score slightly higher on this balanced, feature-selected dataset than on the larger, imbalanced UNSW-NB15 dataset. Three factors account for this gap: (a) class balance (50/50 vs. 63.9% attack) removes the challenge of minority-class detection; (b) feature selection eliminated redundant and noisy variables; and (c) web-attack traffic patterns such as brute-force login attempts, XSS payloads and SQL injection strings produce more distinctive flow-level signatures than the heterogeneous nine-category attack mix in UNSW-NB15. These findings are corroborated by the overfitting diagnostics in Section 5.4.

5.3. Machine Learning Model Performance

We now compare in greater detail the performance of the machine learning algorithms on both datasets, as summarised in Table 6. All ensemble results report mean ± standard deviation across 5-fold stratified cross-validation; DNN results report mean ± standard deviation across 5 repeated 80/20 stratified splits.

Table 6. Performance of machine learning algorithms (5-fold CV, mean ± std). Bold denotes the best result for each metric within each dataset. For FPR, FNR, and training time, lower values indicate better performance.

Model	Dataset	Accuracy	Precision	Recall	F1	AUC-ROC	FPR (↓)	FNR (↓)	MCC	Train (s)
RF	UNSW-NB15	0.9508	0.9623	0.9607	0.9615	0.9921	0.0666	0.0393	0.8935	23.2
XGBoost	UNSW-NB15	0.9476	0.9635	0.9542	0.9588	0.9916	0.0641	0.0458	0.8870	2.1
LightGBM	UNSW-NB15	0.9475	0.9645	0.9528	0.9586	0.9916	0.0621	0.0472	0.8868	2.4
CatBoost	UNSW-NB15	0.9453	0.9609	0.9532	0.9570	0.9908	0.0687	0.0468	0.8818	4.8
DNN	UNSW-NB15	0.9304	0.9706	0.9189	0.9440	0.9869	0.0494	0.0811	0.8543	28.1
RF	CIC-IDS18-W	0.9903	0.9924	0.9882	0.9903	0.9992	0.0076	0.0118	0.9807	0.3
XGBoost	CIC-IDS18-W	0.9876	0.9850	0.9903	0.9876	0.9989	0.0151	0.0097	0.9753	0.1
LightGBM	CIC-IDS18-W	0.9908	0.9914	0.9903	0.9908	0.9991	0.0086	0.0097	0.9817	0.1
CatBoost	CIC-IDS18-W	0.9925	0.9946	0.9903	0.9924	0.9993	0.0054	0.0097	0.9849	0.2
DNN	CIC-IDS18-W	0.9538	0.9196	0.9946	0.9556	0.9937	0.0871	0.0054	0.9107	6.3

Table 6 shows how well both basic and advanced machine learning models performed on the two Channel 1 datasets:

• UNSW-NB15 (257,673 records, 39 features): RF achieves the highest accuracy (95.08% ± 0.13%) and F1 score (96.15% ± 0.10%), followed by XGBoost (94.76% ± 0.15%) and LightGBM (94.75% ± 0.16%). CatBoost ranks fourth at 94.53% ± 0.16%. The Friedman test confirms that these differences are statistically significant (p < 0.004 for accuracy, F1, MCC and AUC-ROC), with Nemenyi post hoc analysis showing that RF is significantly superior to CatBoost (p = 0.0014). The DNN achieves 93.04% ± 0.19% accuracy with the lowest FPR among all models (4.94% ± 0.41%) but the highest FNR (8.11% ± 0.47%), reflecting a precision-oriented decision boundary imposed by the class weighting scheme.
• CSE-CIC-IDS2018 (1856 balanced samples, 38 features after selection): With adaptive capacity constraints applied (Section 4.4), CatBoost leads with 99.25% ± 0.52% accuracy and MCC of 0.9849 ± 0.0104, followed by LightGBM (99.08% ± 0.24%) and RF (99.03% ± 0.78%). The Friedman test fails to reject the null hypothesis for accuracy (p = 0.093), F1 (p = 0.178) and AUC-ROC (p = 0.323), indicating that the differences among ensemble models are not statistically significant on this smaller, well-separated dataset. The DNN reaches 95.38% ± 0.82% accuracy with very high recall (99.46% ± 0.38%) but an elevated FPR (8.71% ± 1.59%).

On both datasets, tree-based ensembles consistently outperform the DNN in overall accuracy and MCC. At the same time, the strength of the DNN lies in recall on the subset of web attacks (99.46%) and in a low FPR on UNSW-NB15 (4.94%), which leads us to consider it as a complementary detector rather than a replacement for ensemble models. Our RF baseline on CSE-CIC-IDS2018 is consistent with previous work. Elhanashi et al. [46] reported RF accuracies of around 99.6% on the same dataset, confirming that the high accuracy reflects the separability of the dataset rather than an effect resulting from our pipeline.

The contribution of this work lies in the integrated multi-level framework, not in the individual classifiers. The algorithms evaluated so far are well established in the literature; what VIRTUOSO adds is the orchestration of these models across two distinct detection channels, combined with automated configuration scanning and a unified risk snapshot, all within a single reproducible pipeline.

5.4. Overfitting Diagnostics

Given the high accuracy values reported in Table 6, particularly on the CSE-CIC-IDS2018-WEB subset (99%), we present three lines of evidence that the observed performance does not stem from overfitting.

Train and test accuracy gap: Table 7 reports the mean training and testing accuracy for each model on both datasets. On UNSW-NB15, the boosted methods show gaps below 1% (CatBoost: 0.34%, XGBoost: 0.89%, LightGBM: 0.69%), indicating well-regularised models. RF exhibits a larger gap (4.66%) due to its unbounded tree depth on this large dataset, though its test accuracy remains the highest. On CSE-CIC-IDS2018-WEB, where capacity constraints are applied, no model reaches perfect training accuracy: RF attains 99.41%, XGBoost attains 99.33%, LightGBM attains 99.72% and CatBoost attains 99.89%. The corresponding test gaps are 0.38%, 0.57%, 0.63% and 0.65% respectively—all below 1%, confirming that the capacity constraints prevent memorisation without sacrificing test performance.

Table 7. Train and test gap summary.

Model	Dataset	Train Accuracy	Test Accuracy	Gap
RF	UNSW-NB15	0.9975	0.9508	0.0466
XGBoost	UNSW-NB15	0.9565	0.9476	0.0089
LightGBM	UNSW-NB15	0.9544	0.9475	0.0069
CatBoost	UNSW-NB15	0.9487	0.9453	0.0034
RF	CSE-CIC-IDS2018-WEB	0.9941	0.9903	0.0038
XGBoost	CSE-CIC-IDS2018-WEB	0.9933	0.9876	0.0057
LightGBM	CSE-CIC-IDS2018-WEB	0.9972	0.9908	0.0063
CatBoost	CSE-CIC-IDS2018-WEB	0.9989	0.9925	0.0065

DNN learning curves: Figure 7 plots training and validation loss/accuracy over 30 epochs without early stopping. On UNSW-NB15, the validation accuracy (93.44%) slightly exceeds training accuracy (93.02%), yielding a negative gap of 0.42 percentage points which is a clear indication that overfitting is absent. On CSE-CIC-IDS2018-WEB, the gap is +0.80 percentage points (train: 96.50%, val: 95.70%), and validation loss remains stable or decreasing in the final five epochs. Both patterns confirm that the DNN generalises to held-out data without memorising training examples.

Figure 7. DNN learning curves.

Feature selection impact: The two-stage feature selection applied to CSE-CIC-IDS2018-WEB (Section 4.4) reduced dimensionality from 78 to 38 features, improving the sample-to-feature ratio from 23.8 to 48.8. This step removed zero-variance features (10) and highly correlated pairs (30 at |r| > 0.95), which would otherwise inflate model capacity artificially. The combination of feature selection and capacity-constrained hyperparameters constitutes a principled approach to preventing overfitting on small datasets, consistent with best practices in the IDS literature.

5.5. Hyperparameter Sensitivity Analysis

We conducted a sensitivity analysis on the best-performing model (RF) across both datasets, varying two key parameters: max_depth and n_estimators, which represent the maximum number of splits (or depth per tree) and the number of decision trees respectively. Results are summarised in Table 8 and visualised in Figure 8.

Table 8. Sensitivity results across datasets. Bold indicates the highest mean accuracy obtained for each dataset.

Dataset	Parameter	Value	Accuracy (Mean ± Std)
UNSW-NB15	max_depth	6	0.917900 ± 0.002389
UNSW-NB15	max_depth	10	0.930664 ± 0.001752
UNSW-NB15	max_depth	15	0.940293 ± 0.002128
UNSW-NB15	max_depth	20	0.946467 ± 0.002028
UNSW-NB15	max_depth	30	0.950418 ± 0.001576
UNSW-NB15	max_depth	None	0.950860 ± 0.001262
UNSW-NB15	n_estimators	50	0.950076 ± 0.001429
UNSW-NB15	n_estimators	100	0.950744 ± 0.001366
UNSW-NB15	n_estimators	200	0.950810 ± 0.001078
UNSW-NB15	n_estimators	300	0.950860 ± 0.001262
UNSW-NB15	n_estimators	500	0.951112 ± 0.001400
CSE-CIC-IDS2018-WEB	max_depth	4	0.963357 ± 0.008241
CSE-CIC-IDS2018-WEB	max_depth	6	0.983832 ± 0.007630
CSE-CIC-IDS2018-WEB	max_depth	8	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	max_depth	10	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	max_depth	15	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	max_depth	None	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	n_estimators	50	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	n_estimators	100	0.990302 ± 0.007764
CSE-CIC-IDS2018-WEB	n_estimators	150	0.989762 ± 0.009978
CSE-CIC-IDS2018-WEB	n_estimators	200	0.990841 ± 0.006764
CSE-CIC-IDS2018-WEB	n_estimators	300	0.990302 ± 0.007764

Figure 8. Sensitivity plots and analysis of hyperparameters.

On UNSW-NB15, accuracy increases monotonically with max_depth from 91.79% (depth = 6) to 95.09% (depth = None), with diminishing returns beyond depth = 20. The n_estimators parameter shows rapid saturation: accuracy at n_estimators = 50 (95.01%) is within 0.1 percentage points of n_estimators = 500 (95.11%). This confirms that the choice of n_estimators = 300 in our main experiments is well within the plateau region and that additional trees provide negligible improvement.

On CSE-CIC-IDS2018-WEB, accuracy saturates at max_depth = 8 (99.03%) and remains unchanged through depth = None, validating our capacity-constraint choice of max_depth = 10 as optimal—it achieves the same test accuracy as an unconstrained forest while preventing perfect training-set memorisation. The n_estimators parameter is equally stable: accuracy at n_estimators = 50 (99.03%) matches n_estimators = 300. This robustness to hyperparameter choices indicates that the reported results are not sensitive to specific tuning decisions.

5.6. Computational Cost Analysis

Table 9 reports training time, inference time and throughput (samples per second) for each model on both datasets, measured on a Google Colab instance with two CPU cores, 12 GB RAM and an L4 GPU.

Table 9. Output of computational costs and efficiency of models used in our datasets.

Model	Dataset	Train (s)	Infer (s)	Throughput (Samples/s)
RF	UNSW-NB15	23.20 ± 0.96	0.224 ± 0.017	231,428 ± 16,809
XGBoost	UNSW-NB15	2.12 ± 0.65	0.051 ± 0.008	1,022,859 ± 126,413
LightGBM	UNSW-NB15	2.38 ± 0.84	0.100 ± 0.002	516,687 ± 9633
CatBoost	UNSW-NB15	4.79 ± 0.37	0.013 ± 0.001	4,151,589 ± 511,394
DNN	UNSW-NB15	28.08 ± 1.56	1.286 ± 0.630	N/A
RF	CSE-CIC-WEB	0.30 ± 0.00	0.029 ± 0.006	13,350 ± 2466
XGBoost	CSE-CIC-WEB	0.07 ± 0.00	0.001 ± 0.000	290,146 ± 5412
LightGBM	CSE-CIC-WEB	0.07 ± 0.01	0.001 ± 0.000	253,882 ± 28,814
CatBoost	CSE-CIC-WEB	0.21 ± 0.00	0.001 ± 0.000	385,304 ± 12,305
DNN	CSE-CIC-WEB	6.34 ± 0.61	0.968 ± 0.619	N/A

On UNSW-NB15, CatBoost achieves the highest inference throughput (4.15 M samples/s) despite ranking fourth in accuracy, making it the most efficient option for latency-sensitive deployments. XGBoost offers the best training speed (2.1 s) with strong throughput (1.02 M samples/s). RF is the slowest to train (23.2 s) but maintains competitive inference throughput (231 K samples/s). DNN is the most expensive in both training (28.1 s) and inference (1.29 s), reflecting the overhead of GPU-based forward passes on a relatively small network.

For Channel 2 (CloudTrail), the autoencoder trains in 19.5 s and infers in 1.3 s on 11,624 sessions, while the Isolation Forest trains in 0.5 s and infers in 0.1 s. These costs are modest relative to the ensemble classifiers and confirm that the anomaly detection component does not introduce a computational bottleneck.

Overall, all models complete a full training-and-inference cycle within one minute on commodity hardware, which is consistent with VIRTUOSO’s design goal of maintaining a pipeline that can be re-executed periodically without requiring dedicated compute infrastructure.

5.7. Implications for Cloud Security

VIRTUOSO’s Intelligent Security Layer makes it very useful for cloud security applications, as reflected by the high accuracy and low false positive rates on both datasets.

• Broad Threat Detection: The framework could accurately identify several attack vector types through basic and more advanced means, like DL-based intrusion detection methodologies [47]. Governance is also unified across cloud service models like IaaS, PaaS, and SaaS by treating detections as auditable results.
• Less false positives: In the tests conducted in our pipeline we reported low FPRs. For instance, on UNSW-NB15, RF yields a 6.6% FPR, and on CSE-CIC-IDS2018, it produces 0.76%, while XGBoost reduces these to 6.4% and 1.5%, respectively. LightGBM obtains 6.2% on UNSW-NB15 and 0.86% on CSE-CIC-IDS2018. In cloud real-world security use cases, the sub-1% FPR on the web-attack subset demonstrates that the framework can operate with minimal false alarms on well-separated traffic. On the more challenging UNSW-NB15, FPR values between 6% and 7% remain within acceptable operational bounds for a first-pass filter, especially when combined with the low FNR (below 4% for RF), which ensures few attacks go undetected.
• Flexibility: The framework keeps good discrimination between two datasets with different types of traffic, and it shows that the detection part can work in many different types of networks and web attacks.
• Computational Efficiency and Real-Time Suitability: The framework uses fast and accurate ML methods like XGBoost and LightGBM, and it can still work in small computing environments. This combination makes the framework ready to be used in cloud infrastructures where real-time detection is essential. It can also handle a lot of data, which is quite common in today’s cloud environments.

5.8. Comparison with Existing Approaches

We compared our results to other cloud security methods for further validation of our experiment. Table 10 shows this comparison, as well as a deep learning-based IDS, an unsupervised deep learning method (deep autoencoders) [48], and an anomaly-based ML study on the CSE-CIC-IDS2018 dataset. These methods are examples of popular frameworks for network intrusion detection, evaluated on the same benchmark datasets.

Table 10. Comparison of VIRTUOSO with existing approaches.

Approach	Dataset	Accuracy	FPR
VIRTUOSO-RF (best ensemble)	UNSW-NB15	95.08% ± 0.13%	6.66% ± 0.28%
VIRTUOSO-CatBoost (best ensemble)	CSE-CIC-IDS2018-WEB	99.25% ± 0.52%	0.54% ± 0.38%
VIRTUOSO-DNN	UNSW-NB15	93.04% ± 0.19%	4.94% ± 0.41%
VIRTUOSO-DNN	CSE-CIC-IDS2018-WEB	95.38% ± 0.82%	8.71% ± 1.59%
Deep learning-based IDS (CNN) [48]	CSE-CIC-IDS2018	97.38%	≈1.10%
Unsupervised DL (deep autoencoder) [48]	CSE-CIC-IDS2018	97.37%	≈1.12%
Anomaly-based ML (Random Forest) [46]	CSE-CIC-IDS2018	99.60%	n/r

Several observations emerge from this comparison. First, VIRTUOSO’s ensemble classifiers on CSE-CIC-IDS2018-WEB (99.25% for CatBoost, 99.03% for RF) are consistent with the 99.6% reported by in the research mentioned earlier in Section 5.3 by Elhanashi et al. using RF on the same dataset, confirming that our results fall within the expected range for this benchmark. The small discrepancy reflects differences in preprocessing: we apply feature selection (78 → 38 features) and capacity constraints that trade a marginal accuracy reduction for reduced overfitting risk.

Second, the CNN-based and autoencoder-based approaches achieved 97.37–97.38% on CSE-CIC-IDS2018 with a FPR of around 1.1%, which is lower than our DNN’s FPR (8.71%) but also lower in accuracy than our ensemble classifiers (99.25%). This highlights the trade-off between detection approach and false alarm rate: the ensemble classifiers in VIRTUOSO achieve higher accuracy, while the DNN achieves higher recall (99.46%) at the cost of elevated false positives.

Third, and most importantly, the comparison in Table 10 is limited to classification accuracy and FPR because existing approaches report only these metrics. VIRTUOSO provides a broader evaluation that includes confidence intervals, statistical significance tests, overfitting diagnostics, adversarial robustness evaluation and computational cost profiling—none of which are available for the compared methods. As discussed in Section 2.6, VIRTUOSO is the only framework that combines ML-based IDS with cloud audit-log anomaly detection, configuration scanning, and an explicit CSR mapping within a single reproducible pipeline. The comparison of individual model accuracy, while informative, does not capture this architectural contribution.

5.9. Scalability and Performance Analysis

To evaluate the VIRTUOSO framework’s scalability, we have also conducted scalability tests with increasing system load. The results show the following important points:

• Despite limited available resources, VIRTUOSO achieved a high level of classification accuracy: RF in particular attained 95.08% on the UNSW-NB15 dataset, while Catboost attained 99.25% on CSE-CIC-IDS2018, and also all other ensemble models attained over 99% accuracy.
• Efficient Model Optimisation: Stratified sampling, early stopping, and per-fold class weighting helped to minimise execution time. For instance, heavy learners such as the balanced DNN secured an F1 score of 0.9556 on CSE-CIC-IDS2018 despite training on a 10 per cent stratified subsample of UNSW-NB15.
• Scalability Potential: Although larger-scale live event ingestion was not simulated, there was significant potential for deployment with a view to high-throughput scenarios with the use of tree-based models that are effective and adopt parallelised execution with XGBoost and LightGBM. Their inference latency is relatively low, with an average training time increase being more tangible and appropriate for cloud-scale scenarios.
• Support for Multi-Tenant Cloud Environments: These results show that VIRTUOSO may be effectively implemented and scaled in multi-tenant cloud infrastructure in the real world, combined with optimisations to achieve strong performance despite coupled configurations that exhibit limitations.

5.10. Discussion

In this section, we discuss the practical implications, privacy safeguards, and current boundaries of the VIRTUOSO framework.

5.10.1. Theoretical Case Studies

Even if VIRTUOSO has not yet been deployed in physically observed case studies to date, we consider here its potential abilities through two theoretical examples. These scenarios draw upon the cloud security issues and best practices we overviewed in recent findings.

Detection and Mitigation of Advanced Persistent Threats (APTs)

Cloud environments face Advanced Persistent Threats (APTs) when having long dwell times as well as multi-stage activity that avoids point-in-time controls [49]. VIRTUOSO’s multi-layer approach addresses this issue through three main dynamics. Regarding early detection, using our ensemble of ML models (XGBoost, LightGBM and others in the Intelligent Security Layer) allows us to detect even subtle anomalous patterns that may emerge over extended periods. The APT detection framing follows survey evidence of APT techniques and ML-assisted detection directions [50]. When suspicious behaviour is surfaced, the Deep Automation Security Layer supports the response by producing structured, auditable findings that may be used to support isolation, credential rotation, and policy hardening by standard operating procedures. Finally, for iterative improvement, the evidence exported by the framework can be used to support periodic retraining and rule refinement under governance, without autonomous policy evolution assumptions, to enhance detection performance over time.

In a theoretically advanced APT scenario, VIRTUOSO could see a 0.1% rise over three months in outbound data transmission, which might act as an anticipated data exfiltration signal. It would also identify outliers in access to sensitive data stores, alerting security personnel to irregular access patterns. In addition to identifying the threats, VIRTUOSO would support network segmentation by identifying the assets and sorting the sessions related to the suspicious session, which would in turn contain the threat. It would also help in a targeted audit and credential rotation based on traceable indicators and prioritised findings to reduce the probability of long-term exposure. Ultimately, we envision continuous improvement: a reinforced system where periodic re-evaluation of newly collected evidence flags the presence of the same indicator in subsequent runs.

Designing Security in Multi-Cloud Environments

Cloud ecosystems can be marked by recurring security gaps, with particular emphasis on heterogeneous control surfaces and fragmented identity and access management. This creates the potential for configuration drift, amplification and inconsistent enforcement decisions. We designed VIRTUOSO to compensate for these problems through unified security policies, cross-cloud threat intelligence, and compliance management automation. By supporting baselines expressed as checks and findings, the framework can reduce misconfiguration gaps across heterogeneous environments. In parallel, VIRTUOSO can support cross-environment correlation by normalising evidence produced from different sources into a common reporting structure, allowing analysts to compare indicators across providers. As for compliance, the framework can support these activities by exporting auditable evidence that can be mapped to organisational controls and privacy obligations, whilst enforcement remains a governance task.

In a hypothetical multi-cloud scenario, VIRTUOSO would be able to discover and connect activities aimed at services of the three largest providers, such as AWS, Azure, and GCP, simultaneously. Common patterns such as DDoS attacks on multiple platforms could be detected. These consistent indicators could support further mitigation efforts by enabling nudges and updates in rule-making and decisions for traffic management through existing operational tooling. It would also help surface identity and access inconsistencies by exporting evidence that helps operators review IAM policies and privilege assignments across providers [51]. Moreover, VIRTUOSO would produce a full compliance report that is useful from regulatory compliance to the improvement of the whole security management. Some of the possible applications described here demonstrate the potential of our design in addressing relevant challenges of current cloud security, particularly against APTs in multi-cloud environments. Therefore, the approach of coupling ML-based detection with evidence and repeatable checks can be used to strengthen cloud security decision-making in complex multi-cloud environments, while enforcement and change control remain under organisational governance.

5.10.2. Privacy Considerations

Despite the need for VIRTUOSO’s implementation for cloud security improvement, we must consider its possible consequences for real-world privacy. We cascade privacy into the framework’s configuration through several key principles. VIRTUOSO respects the principle of data minimisation when it comes to information associated with security matters. While addressing future possible real-world applications, our framework supports privacy-preserving analysis by limiting the exposure of identifiable information and enabling anonymisation or pseudonymisation of telemetry wherever feasible. To prevent privacy issues, it can use differential privacy mechanisms that reduce disclosure risk while retaining utility for detection tasks [52]. To guarantee confidentiality, we adopt access control measures that limit access to sensitive security data or analysis results to authorised personnel only. We can implement this task using Role-Based Access Control (RBAC), combined with Attribute-Based Access Control (ABAC) defined following NIST guidance [53]. With certain modifications, VIRTUOSO can be made compliant with governing privacy regulations like GDPR and CCPA. For example, the operational deployment can have support for data subject rights management and a register of processing activities [54]. To help make VIRTUOSO security decisions more understandable, it uses explainable AI techniques [55]. As a further extension, VIRTUOSO can integrate with FL for cross-domain multiple dataset model training without centralising sensitive data [56]. These privacy-centric design principles preserve the context of salient features in cloud-security management while encouraging a responsible context of output and security data.

5.10.3. Limitations and Future Work

Despite its promising results, we should consider several important limitations in this study. Although we used well-established and up-to-date datasets, they might not entirely represent the complexity and variability of real-world cloud environments. The datasets used, albeit comprehensive, remain static snapshots of network activity captured under controlled conditions. Production environments generate non-stationary traffic distributions that shift over time due to infrastructure changes, new application deployments, and evolving user behaviour, a phenomenon known as concept drift. VIRTUOSO does not currently incorporate online learning or drift detection mechanisms, and classifier performance may degrade if models are not periodically retrained on recent data.

Another element we must acknowledge is that the CSE-CIC-IDS2018 web-attack subset used in Channel 1 is relatively small (1856 balanced samples after feature selection). Although we applied capacity-constrained models (max_depth = 10, n_estimators = 100 for RF; max_depth = 4 with L1/L2 regularisation for boosted methods) to prevent overfitting, and the train/test gap analysis confirms gaps below 1%, the limited sample size restricts the diversity of web-attack patterns that the models can learn. Results on this subset should be interpreted as proof of concept rather than production-grade benchmarking.

We carried out the evaluation entirely on a Google Colab instance with two CPU cores, 12 GB RAM and L4 GPU for the higher demanding tasks. This resource-constrained setting demonstrates reproducibility but does not reflect enterprise-scale deployment. Training times (e.g., 23 s for RF on 257K samples) would scale differently on production hardware, and inference latency under sustained high-throughput traffic remains untested.

Looking at the automation aspects, the Deep Automation Security Layer currently integrates only two scanning tools (Checkov and Trivy) and operates on synthetic configuration artefacts rather than a live infrastructure state. In operational deployment, the number and variety of scan targets would be substantially larger, and the framework would need to handle incremental scan updates, concurrent multi-tenant evidence streams and integration with ticketing or SOAR platforms for remediation workflows.

An additional aspect is that the adversarial evaluation uses gradient-based perturbations (FGSM, PGD) applied directly to the feature space of the DNN. This tests robustness against white-box evasion attacks on the neural network component but does not cover adversarial strategies against the ensemble classifiers, which are non-differentiable and require different attack methodologies such as decision-based or query-based attacks [57,58]. Additionally, the perturbation budgets tested (ε = 0.01 for FGSM, ε = 0.02 for PGD) represent moderate perturbation levels; stronger adversaries operating at higher budgets may cause more significant degradation.

Finally, the organisational adoption of a multilayer framework like VIRTUOSO introduces challenges that this study does not address empirically. These include the need for cross-team coordination between security operations, DevOps and compliance functions; the training overhead for analysts who must interpret the unified risk snapshot; and the governance processes required to define and maintain the scan policies, detection thresholds and escalation rules that the framework relies upon. Furthermore, while the tree-based models expose native feature importance, more advanced interpretability methods (e.g., SHAP) are not yet integrated, which may limit analyst trust in the escalation decisions.

Future efforts should investigate more powerful environments to determine the full potential of such models and test their efficacy on larger volumes of fast-moving data. Evaluating VIRTUOSO on live telemetry streams, integrating online learning for concept drift adaptation, extending the adversarial evaluation to ensemble-specific attacks, and conducting a deployment case study in a multi-cloud enterprise environment would address the limitations identified above.

6. Conclusions and Future Work

This study presented VIRTUOSO, a multilayer security framework that combines deep automation with ML-based detection to provide evidence-driven security assessment across cloud environments. VIRTUOSO addresses major challenges in modern cloud architectures through four operational layers—Input, Deep Automation Security, Intelligent Security and Integration Interface—spanning two detection channels: network/web-application traffic (Channel 1) and cloud control-plane audit logs (Channel 2). The empirical evaluation, conducted on three public datasets (UNSW-NB15, CSE-CIC-IDS2018 web-attack subset and CloudTrail flAWS logs), produced the following key findings:

On UNSW-NB15 (257,673 records, 39 features), Random Forest achieved the highest accuracy among the ensemble classifiers (95.08% ± 0.13%, F1 = 96.15% ± 0.10%), with the Friedman test confirming statistically significant differences among models (p < 0.004) and Nemenyi post hoc analysis showing RF to be significantly superior to CatBoost (p = 0.0014). On the CSE-CIC-IDS2018 web-attack subset (1856 balanced samples, 38 features after selection), CatBoost achieved 99.25% ± 0.52% accuracy with capacity-constrained hyperparameters. The Friedman test did not reject the null hypothesis (p = 0.093 for accuracy), indicating that all ensemble models perform comparably on this well-separated dataset. The lightweight DNN achieved 93.04% ± 0.19% on UNSW-NB15 and 95.38% ± 0.82% on the web-attack subset, serving as a complementary detector with distinct precision–recall trade-offs compared to the ensembles. Overfitting diagnostics confirmed that the reported accuracy values are reliable: train/test gaps remain below 1% for all capacity-constrained models on the web-attack subset, and DNN learning curves show no validation loss divergence over 30 epochs. Hyperparameter sensitivity analysis demonstrated robustness to parameter choices, with accuracy saturating early for both max_depth and n_estimators.

Adversarial evaluation under FGSM (ε = 0.01) and PGD (ε = 0.02) perturbations showed graceful degradation on UNSW-NB15 (accuracy drop of 3.2% and 8.1% respectively), while the web-attack subset proved largely resilient to feature-space perturbations at these budgets.

On the CloudTrail channel, the autoencoder-based anomaly detector maintained stable reconstruction error (mean = 0.0119) under adversarial stress up to ε = 0.05, with the 99th-percentile threshold at 0.0251. The Deep Automation Security Layer, implemented through Checkov and Trivy, demonstrated the feasibility of integrating configuration scanning with ML-based detection in a single pipeline.

The framework layers were mapped explicitly to the Cloud Shared Responsibility model, illustrating how VIRTUOSO operationalises shared security controls across IaaS, PaaS and SaaS boundaries through verifiable automation evidence. All experiments were executed on a Google Colab instance (2 CPU cores, 12 GB RAM, L4 GPU) and completed within commodity resource constraints, with the full pipeline including dataset download, training, evaluation and export running in under 30 min. The pipeline is fully portable and self-contained, automatically downloading all datasets without external dependencies.

In future work, we identify six directions that address the limitations discussed in Section 5.10.3. First, RL could serve as a governed extension for adaptive defence and response support, while keeping change control and safety constraints under organisational oversight rather than delegating them to automation alone. Second, adversarial manipulation of learned detectors remains a central open direction; extending the evaluation to decision-based and query-based attacks against the ensemble classifiers would provide a more complete robustness profile. Third, evaluating VIRTUOSO on live telemetry streams with online learning and concept drift detection would assess the framework’s operational viability under non-stationary traffic conditions. Fourth, a deployment case study in a real multi-cloud enterprise environment would validate the organisational adoption challenges identified in Section 5.10.1, including cross-team coordination and governance process design. Fifth, integrating federated learning into the Intelligent Security Layer would enable collaborative model training across organisational boundaries without sharing raw telemetry, addressing the privacy considerations discussed in Section 5.10.2. Sixth, expanding the Deep Automation Security Layer to additional scanning tools and live infrastructure targets would strengthen the framework’s configuration coverage beyond the current proof-of-concept implementation with Checkov and Trivy, as well as incorporating post hoc interpretability techniques to support analyst decision-making during escalation.