AI Technology and Security in Cloud/Big Data

1. Introduction

Recent advancements in cloud computing and big data technologies have accelerated the integration of AI-based services as core infrastructure components in various industrial sectors [1,2,3,4]. Cloud computing facilitates large-scale computing resources and flexible storagewhile big data platforms provide an environment for collecting, storing, and analyzing vast amounts of data in real time [1,2]. In particular, AI technology is widely used in data analysis, predictive modeling, automation services, and intelligent decision-making systems in cloud-based big data environments [3]. Recently, the importance of cloud-based AI services has increased further due to advancements in generative AI and large-scale language models (LLM), and companies are actively pursuing AI-based digital transformation [4].

However, cloud big data environments are accompanied by various security and privacy issues [5,6,7,8]. The multi-user structure, distributed storage systems, and open network characteristics of cloud environments leading to increased security threats such as data leakage, account hijacking, insider attacks, API vulnerabilities, and denial-of-service (DDoS) attacks [5,6]. In addition, as AI technology is integrated into cloud environments, new security issues such as data poisoning, adversarial attacks, model stealing, and privacy infringement are emerging [7,8]. The convergence of AI technology and security technology is therefore essential to build a secure cloud big data environment.

Recent research shows that AI-based security technology is being effectively utilized for threat detection and response in cloud environments [9,10,11]. Machine learning and deep learning technologies can perform anomaly detection, intrusion detection, malware analysis, and cyber attack prediction by analyzing large-scale network traffic and log data [9,10]. In particular, AI-based security systems offer higher detection accuracy and automated response capabilities than existing rule-based systems, and have the advantage of enabling real-time security management [11]. Furthermore, explainable AI (XAI), federated learning, and zero trust-based security models have been attracting attention recently as next-generation cloud security technologies [12]. Research on cloud-based AI and security is actively underway. HCIS-based research focuses not only on improving the performance of AI technology but also on user reliability, privacy protection, and secure data utilization [13,14,15]. In particular, research on access control in cloud environments, AI-based intrusion detection, and IoT convergence security frameworks provides important directions for building future intelligent cloud security environments [13,14].

This Special Issue therefore features papers on AI and security technologies in cloud/big data environments.

2. An Overview of Published Articles

Zhang, H. et al. [Con. 1] discuss the theory and architecture of the Cyberspace Endogenous Security paradigm to overcome the limitations of addressing security through patches. The core of the paradigm is to internalize security concepts such as heterogeneity, dynamism, and redundancy from the system design stage. Theoretically, through the Dynamic Heterogeneous Redundancy (DHR) model, it transforms deterministic individual component attacks into probabilistic system-level events, providing fundamental immunity against zero-day threats or supply chain attacks. In terms of architecture, it describes an evolution from an initial hardware-based Mimic Defense prototype to a current software-defined, general-purpose framework combining artificial intelligence (AI) and cloud-native technologies. Experimentally, its feasibility has been proven through demonstrations in the fields of 5G core networks and autonomous vehicles, achieving 99.999% high availability with very low performance overhead (less than 3%).

Wang, Z. et al. [Con. 2] propose a method for constructing user profiles based on high-dimensional features using Stacking Ensemble Learning to mitigate unpredictable social behavior in online social networks (OSN). The 3Cs (Capacity, Character, Conditions) address the issues of existing data sparsity and the concealment of user behavior, and redefine the 5Cs credit evaluation principles to suit social networks. Based on this, three basic attributes regarding demographics, tweet information, and social activity were extracted, and various algorithms such as logistic regression, SVM, and MLP were combined. This improved stacking model was able to extract high-dimensional features representing potential behavioral patterns within each attribute group. The model integrating these high-dimensional features showed a 9.26% improvement in prediction accuracy on balanced datasets compared to existing methods, and a 3.69% improvement in the AUC metric on imbalanced datasets. This paper thus enhances the efficiency of social stability surveys and online community monitoring by effectively identifying and predicting individual users exhibiting anomalies using public social data.

Zhong, X. et al. [Con. 3] enhance the penetration testing capabilities of language models (LLMs) by proposing PenQA (A Comprehensive Instructional Dataset for Enhancing Penetration Testing Capabilities in Language Models), a high-quality instructional dataset. Based on cybersecurity data from MITRE ATT&CK and Metasploit, this paper automatically generated a dataset of 50,000 question-and-answer responses using a high-performance model (GML-4). This dataset systematically covers the five major stages of penetration testing, including reconnaissance, scanning, and vulnerability assessment. Furthermore, to verify the effectiveness of PenQA, small models with fewer than 10 billion parameters (such as Llama3 and Qwen2) were fine-tuned. As a result, performance was significantly improved across key evaluation metrics such as BLEU, ROUGE, and BERTScore. In particular, the fine-tuned models provide much more accurate and concise answers compared to previous complex Metasploit module configurations or specific attack techniques. This paper therefore demonstrated that general models can be fully utilized in the field of cybersecurity, which requires a high level of expertise, through the construction of specialized datasets.

Yang, X. et al. [Con. 4] proposed the DimAug-TimesFM framework to address the limitations of large errors in long-term forecasting caused by dynamic demand changes and short historical data of cloud resources. By doing so, they aim to overcome few-shot scenarios in cloud computing environments and accurately forecast regular demand. The framework utilizes Delivery Period Extraction technology to identify key periods of surging actual demand, and Dimension Augmentation techniques based on Dynamic Time Warping (DTW) to combine data from a pool of similar resources to supplement insufficient training data. For experiments, actual data from Chinese telecommunications companies was used, and the framework was designed to leverage the benefits of transfer learning by utilizing Google’s time-series model, TimesFM, as the backbone. As a result, the Root Mean Square Error (RMSE) was reduced to approximately 72.9–81.7% compared to the existing SOTA model, PatchTST DLinear. Furthermore, it demonstrated high stability and robustness even in scenarios where existing models failed (such as few-shot scenarios with extremely limited data). This can be fully utilized as a general-purpose framework applicable to time series forecasting problems.

Yoon, Y. et al. [Con. 5] propose Design of Experiments (DoE)-based adaptive scheduling to address resource waste and performance degradation issues caused by existing experience-driven resource allocation methods. This facilitates the simultaneous optimization of application execution time and cost in a Kubernetes environment. Furthermore, this paper utilizes Response Surface Analysis (RSM) to construct a predictive model that derives the optimal CPU and memory sizes for each workload characteristic with minimal experimentation. Additionally, five applications with diverse characteristics, including CPU and memory-intensive tasks and AI inference, were tested using the proposed method. The results showed an average improvement of approximately 1.5 times in performance and cost efficiency scores compared to the existing maximum resource allocation method, while guaranteeing statistical significance (p-value < 0.05) in all results. This enables the application of the derived optimal resource information to a Kubernetes custom scheduler, allowing for the provision of lightweight services by simultaneously achieving Service Level Agreement (SLA) compliance and cost reduction in a cloud environment.

Sathaporn, P. et al. [Con. 6] propose a DDoS detection system based on a hybrid deep learning model that combines CNN-RNN (BiLSTM) and Multi-Head Attention mechanisms to protect cloud infrastructure. To address class imbalance, preprocessing techniques such as SMOTE and Information Gain-based feature selection were applied, and the performance of the model was tested using the BCCC-cPacket-Cloud-DDoS-2024 dataset. In the test experiments, the proposed model (CNN+BiLSTM+Multi-Head Attention) showed superior performance compared to existing single and hybrid deep learning models (CNN, CNN+GRU, CNN+BiGRU, CNN+LSTM, CNN+BiLSTM, CNN+LSTM+Multi-Head Attention), recording an accuracy of 97.78%, precision of 98.66%, and recall of 94.53%.

Alowaidi, A.E.A. et al. [Con. 7] propose a new Adaptive Volcano Support Vector Machine (AVSVM) model capable of malware detection via leveraging the dynamics of volcanic activity. The AVSVM model overcomes the limitations of conventional SVMs, which suffer from performance degradation in data with complex and noisy static decision boundaries, by integrating four biological mechanisms: pressure estimation, eruption-triggered kernel perturbations, lava flow-based margin refinement, and exponential cooling schedules. Furthermore, the eruption mechanism enables the model to move beyond local optima and explore better decision boundaries, while the cooling schedules provide convergence and stability during training. To validate this, the UNSW-NB15 dataset was used, and the model demonstrated excellent performance with an accuracy of 96.7% and a low false-positive rate (FPR) of 3.1% compared to existing models such as SVM, PSO-SVM, and CNN. AVSVM is superior in computational efficiency compared to deep learning model CNN due to its shorter training time, and it possesses adaptability and robustness in modern malware detection environments that are unbalanced and noisy.

Yoon, S.C. et al. [Con. 8] researched a role-based access control (RBAC) scheme based on zk-SNARK to securely verify user roles in cross-domain data sharing environments between clouds with different security policies. To achieve this, they combined zero-knowledge proofs (zk-SNARK) and hash-chain technology to resolve the limitations of existing methods, which are vulnerable to external exposure of role information or replay attacks. The proposed method ensures strong role privacy by allowing users to prove their legitimate authority without revealing specific role information, and fundamentally blocks attacks that reuse previous proofs by generating a new proof value every time through a synchronized hash chain. Accordingly, this paper demonstrates that the proposed scheme offers superior security compared to existing studies (I-RBAC, PE-RBAC, etc.) and provides higher security while maintaining a similar level of computational overhead on the validator side. These technologies will be effectively applied to defense and public cloud infrastructures where security is critical, such as in the military, healthcare, and government agencies.

The paper by Yoo, H.-K. et al. [Con. 9] proposed ‘ToR-Lite,’ a lightweight framework that decomposes queries using only geometric analysis of the embedding space without LLM. The framework aims to address the problem of high latency and cost associated with existing large-scale language model (LLM)-based query decomposition methods when processing complex multi-hop queries in cloud-based AI systems. In particular, the proposed ‘Word-Window Splitting’ algorithm decomposes queries by using sliding window embeddings to detect points (valleys) where semantic similarity between words drops sharply; unlike existing methods that require multiple LLM calls, it performs only a single LLM call during the final answer generation stage. The MultiHop-RAG benchmark experiment, the search success rate (Hits@10) improved by 6.03%p and the exact match rate by 0.89%p compared to the baseline model. It was also proven that it operates 3.18 times faster than the existing LLM-based method (Adaptive ToR) and that the search improvement efficiency per unit cost is approximately 1.9 times higher. Therefore, this paper demonstrated that effective query decomposition is possible using only pure geometric embedding analysis without LLM calls.

3. Conclusions

This Special Issue features nine high-quality papers selected through a rigorous peer-review process. The topics in focus include: the DHR (Dynamic Heterogeneous Redundancy) architecture based on the Endogenous Security paradigm, OSN user credit evaluation and anomaly prediction based on Stacking Ensemble Learning, construction of the specialized dataset ‘PenQA’ to enhance LLM’s Penetration Testing capabilities, long-term time series forecasting of cloud resource demand using the DimAug-TimesFM framework, Kubernetes adaptive scheduling based on Design of Experiments (DoE) and Response Surface Analysis (RSM), a cloud infrastructure DDoS detection system based on Hybrid DL (CNN-BiLSTM-Attention), malware detection based on Adaptive Volcano Support Vector Machine (AVSVM) applying volcanic activity dynamics, cross-domain role-based access control (RBAC) based on zk-SNARK (Zero-Knowledge Proof) and hash chains, and ‘ToR-Lite’, a lightweight query decomposition framework using geometric analysis of embedding space. The contributions in this Special Issue offer valuable insights and we hope they will be a comprehensive resource for researchers in this field.