Game-Theoretic Cost-Sensitive Adversarial Training for Robust Cloud Intrusion Detection Against GAN-Based Evasion Attacks

Abstract

Cloud-based intrusion detection systems (IDSs) increasingly rely on deep learning classifiers to identify malicious traffic; however, this reliance exposes them to adversarial evasion attacks in which adversaries craft near-imperceptible perturbations to bypass detection. Existing defenses based on conventional adversarial training often recover robustness against known perturbation patterns at the cost of degraded detection accuracy on canonical attack categories—a robustness–accuracy trade-off that remains an open challenge in the field. In this paper, we propose GT-CSAT (Game-Theoretic Cost-Sensitive Adversarial Training), a novel defense framework tailored for cloud security environments. GT-CSAT couples an improved Wasserstein GAN with Gradient Penalty (WGAN-GP) threat generator—conditioned on attack semantics to simulate functionally consistent and highly covert traffic variants—with a minimax adversarial training loop governed by a game-theoretic cost-sensitive loss function. The proposed loss function assigns asymmetric misclassification penalties derived from a two-player zero-sum payoff matrix, enabling the detector to maintain vigilance over both novel adversarial variants and well-characterized conventional threats simultaneously. Specifically, misclassifying an adversarially perturbed attack as benign incurs a strictly higher penalty than the symmetric cross-entropy baseline, while the cost weights are dynamically adapted via a Nash equilibrium-inspired update rule during training. We conduct comprehensive experiments on the Cloud Vulnerabilities Dataset (CVD), CICIDS-2017, and UNSW-NB15, which encompass diverse cloud-specific attack scenarios including denial-of-service, port scanning, brute-force, and SQL injection traffic. Under six representative evasion strategies—FGSM, PGD, C&W, BIM, DeepFool, and IDSGAN-style black-box perturbations—GT-CSAT achieves an average robust accuracy of 94.3%, surpassing standard adversarial training by 6.8 percentage points and the undefended baseline by 21.4 percentage points, while preserving clean-traffic detection at 97.1%. These results confirm that the game-theoretic cost structure effectively decouples robustness from accuracy, yielding a Pareto-superior detection profile relative to competing baselines across all evaluated threat models. The source code and experimental configurations have been publicly released to facilitate reproducibility.

1. Introduction

The rapid migration of enterprise workloads to cloud infrastructure has fundamentally enlarged the cyberattack surface [1,2]. Edge-cloud synergy architectures for smart city IoT networks further compound this risk by exposing additional low-latency data pathways as potential attack vectors [3]. In 2023, cloud-targeted intrusion attempts surpassed on-premises incidents for the first time, with denial-of-service, credential brute-force, and lateral-movement campaigns accounting for the majority of reported breaches [4]. To keep pace with this threat landscape, cloud providers and tenants have progressively replaced hand-crafted signature rules with machine learning (ML)-based intrusion detection systems (IDSs) [5,6], which can generalize to previously unseen attack patterns from learned statistical representations of network flow features.

Despite their strong nominal accuracy, ML-based detectors are vulnerable to a fundamentally different class of threat: adversarial evasion attacks [7,8,9]. In the network security context, an adversary subtly perturbs the non-functional statistical features of malicious packets—such as inter-arrival times, byte counts, or flow duration—in ways that do not impair the underlying exploit payload yet cause the learned classifier to assign a benign label [10,11]. Because cloud-native defenders cannot inspect encrypted payloads and must rely on flow-level features observable at the firewall, this threat model is operationally realistic and practically severe.

Foundational adversarial attacks such as the Fast Gradient Sign Method (FGSM) [7] and Projected Gradient Descent (PGD) [8] were originally developed for computer vision but have since been adapted to tabular network traffic features. The IDSGAN framework [10] demonstrated that a generative adversarial network (GAN) trained with black-box IDS feedback can reduce detection rates of multiple state-of-the-art classifiers to near zero on the NSL-KDD benchmark. Subsequent work showed that Wasserstein GAN variants produce higher-fidelity adversarial traffic with more stable training dynamics and better coverage of the feature manifold [12,13], motivating their adoption as the threat generator in our framework.

The prevailing countermeasure, adversarial training (AT) [8,14], augments the training set with adversarial examples so that the classifier learns to assign correct labels under perturbation. While AT demonstrably improves robustness, it suffers from two well-documented limitations in the IDS domain. First, the set of training-time adversarial examples—typically generated by a single fixed attack method—does not span the full perturbation space an adaptive adversary may explore at inference time [15,16]. Second, optimizing for robustness on adversarial examples tends to degrade clean accuracy on conventional, unperturbed attacks [14,17], a tension that is especially costly in security systems where missing a canonical DDoS or SQL-injection campaign is operationally unacceptable.

Attempts to address the robustness–accuracy trade-off have explored ensemble defenses [18,19], input transformation [20,21], and cost-sensitive learning [22,23]. However, none of these threads have been unified into a principled framework grounded in game theory that simultaneously: (i) generates covert adversarial variants beyond fixed attack families, (ii) injects them into training in a semantics-preserving manner, and (iii) governs the detection objective with an asymmetric payoff structure that explicitly penalizes security-critical misclassifications at a different rate from benign classification errors.

Our contributions are as follows (we use the term “Adversarial Training” in its established technical sense—training with adversarially perturbed examples [8,14]—while acknowledging that the game-theoretic formulation also captures adversarial dynamics at the strategic level):

• We propose GT-CSAT, a unified adversarial training framework in which an improved, attack-conditioned WGAN-GP threat generator co-evolves with the IDS detector under a minimax training protocol.
• We derive a game-theoretic cost-sensitive loss function (GTCS-Loss) rooted in a two-player zero-sum payoff formulation, whose misclassification cost weights are updated via a Nash equilibrium-inspired online adaptation rule during training.
• We conduct extensive experiments on the Cloud Vulnerabilities Dataset (CVD), CICIDS-2017 [24], and UNSW-NB15 [25], evaluating six evasion attack strategies across five detector baselines, demonstrating that GT-CSAT achieves a superior robustness–accuracy profile without sacrificing detection of conventional attacks.
• We release all code and experimental configurations to support reproducibility and future research.

The remainder of the paper is organized as follows. Section 2 surveys related work. Section 3 introduces the necessary background. Section 4 details the GT-CSAT architecture and loss formulation. Section 5 presents the experimental setup and results. Section 6 concludes with limitations and future directions.

2. Related Works

2.1. Machine Learning-Based Intrusion Detection

The deployment of ML in network intrusion detection spans two decades [5,6]. Early approaches relied on hand-engineered features fed to classical algorithms such as decision trees, SVMs, and k-nearest neighbors [25,26]. Deep learning brought substantial accuracy gains through hierarchical feature extraction: convolutional neural networks (CNNs) and long short-term memory (LSTM) networks have been applied to raw packet sequences [27,28], while autoencoder-based anomaly detectors improve generalization to zero-day variants [29]. More recently, graph neural networks have been adopted to capture host-to-host communication topology, further improving detection of lateral-movement campaigns [30]. LLM-driven cloud resource scheduling frameworks have similarly demonstrated that coupling reasoning intelligence with optimization guarantees yields more adaptive and reliable cloud operations [31], and AutoML pipelines augmented with retrieval-augmented generation have streamlined cloud-native ML deployment through built-in pre-validation stages [32]. Cloud-specific IDS research has additionally focused on container escape [33], serverless function abuse [34], and API-level anomaly detection [35], all of which depend on flow-level statistical features amenable to adversarial manipulation.

2.2. Adversarial Attacks on IDSs

The vulnerability of ML classifiers to adversarial inputs was formally characterized by Szegedy et al. [36] and subsequently operationalized by the FGSM [7], C&W [9], and PGD [8] attacks. Transposing these gradient-based methods to the IDS domain requires additional care because network features are mixed-type (continuous, integer, categorical) and perturbations must preserve protocol semantics [11]. Usama et al. [37] showed that FGSM applied to NSL-KDD features reduces Random Forest detection accuracy from 99% to below 60%. Lin et al. [10] proposed IDSGAN, which trains a GAN generator against a surrogate IDS discriminator, producing adversarial records that transfer to black-box targets with high attack success rates. Han et al. [38] extended this to conditional generation, conditioning the generator on specific attack categories. Peng et al. [39] developed boundary-based perturbations for DoS attacks, while Bae et al. [40] studied the unique challenges of tabular adversarial examples in the security domain, noting that feature coupling constraints—e.g., total bytes being the sum of forward and backward bytes—make naïve ${\mathsf{\ell }}_p$-ball attacks semantically invalid. Apruzzese et al. [11] provided a systematic taxonomy distinguishing problem-space attacks (modifying actual traffic behavior) from feature-space attacks (modifying extracted statistics), arguing that only the former are truly realizable in deployment.

More recently, Alhussien et al. [41] proposed a comprehensive set of domain constraints—including feature mutability, value dependency, and distribution-preserving constraints—for generating realistic adversarial traffic against NIDSs. Their analysis revealed that adversarial transferability depends primarily on the similarity between the source and target models, independent of attack type or constraint presence, underscoring the importance of diverse adversarial training sources as pursued in our framework.

2.3. Generative Adversarial Networks for Security

Since Goodfellow et al. [42] introduced the GAN framework, numerous variants have been proposed to improve training stability and sample diversity. The Wasserstein GAN [12] replaced Jensen–Shannon divergence with the Wasserstein-1 distance, eliminating vanishing gradients and mode collapse; the gradient penalty variant (WGAN-GP) [13] further enforced the Lipschitz constraint without weight clipping, enabling application to tabular data distributions. In the security domain, GANs have been applied to intrusion detection dataset augmentation [43], botnet traffic generation [44], malware variant synthesis [45], and network anomaly injection [46]. Novaes et al. [47] combined a GAN with deep reinforcement learning for DDoS detection in software-defined networks. A recent systematic review [48] of 185 studies (2021–2025) confirms that GAN-based augmentation consistently improves IDS F1-scores by 10–15% and reduces false negatives by up to 22%, while noting persistent challenges around training instability and evaluation standardization.

2.4. Adversarial Training and Robustness

Adversarial training (AT) was formalized by Madry et al. [8] as a min–max optimization: the inner loop finds worst-case perturbations via PGD, and the outer loop minimizes loss on these adversarial examples. Zhang et al. [14] introduced TRADES, which decomposes the robust loss into clean accuracy and boundary regularization terms, providing a principled accuracy–robustness trade-off. Tramer et al. [15] showed that training against a diverse portfolio of attacks yields better generalization to unseen attack types than single-attack AT. In the IDS context, Sheatsley et al. [49] demonstrated that PGD-based AT on NSL-KDD features improves robustness under white-box threats but degrades performance on clean attack records. Analogously, self-adapting hierarchical deep reinforcement learning schedulers for mixed database workloads show that continuous environment-aware adaptation is essential to prevent performance degradation under distribution shift [50]. The ensemble defense framework of Zhu et al. [51] combined AT, label smoothing, and Gaussian augmentation, achieving superior robustness on CICIDS-2017 but without addressing the problem of unknown future perturbation families.

In parallel, Jiang et al. [52] proposed SKG-FAT (Self-Knowledge Guided Fast Adversarial Training), which addresses class-wise optimization disparity by assigning differentiated regularization weights and dynamically adjusting label relaxation based on each class’s training state. While SKG-FAT focuses on fast adversarial training efficiency, its insight that class-aware adaptive weighting improves robustness aligns with our GTCS-Loss philosophy; however, our approach derives cost weights from a game-theoretic payoff structure tied to the attacker–defender interaction rather than from self-knowledge signals.

2.5. Game Theory in Cybersecurity

Game-theoretic models have a long history in security [53,54], naturally capturing the strategic interaction between an attacker maximizing penetration and a defender minimizing loss. Stackelberg and Nash equilibrium formulations have been applied to firewall rule optimization [55], honeypot placement [56], and DDoS defense strategy selection [57]. Within adversarial ML, recent work has used game-theoretic loss functions to balance between robustness and clean accuracy [58,59], and to derive certifiable robustness bounds [21]. To the best of our knowledge, no prior work has embedded a Nash equilibrium-driven cost-weight adaptation mechanism directly into the IDS adversarial training loop in conjunction with a conditioned WGAN-GP threat generator.

2.6. Cost-Sensitive Learning

Cost-sensitive learning assigns different misclassification costs to different error types, originally motivated by class imbalance in medical diagnosis and fraud detection [22]. Zhou and Liu [23] established theoretical connections between cost-sensitive and margin-based classifiers. In the IDS domain, false negatives (missed attacks) are generally far costlier than false positives [60], prompting asymmetric weighting of the binary cross-entropy objective [61]. Focal loss [61] down-weights easily classified examples to focus training on hard cases, while class-weighted losses address inter-class imbalance. However, these formulations treat misclassification costs as static hyperparameters rather than as dynamically evolving quantities responsive to the adversarial game being played, which is the key distinction of our GTCS-Loss.

3. Preliminaries

3.1. Problem Formulation

Let $\mathcal{X}\subseteq {\mathbb{R}}^d$ denote the feature space of network flow records and $\mathcal{Y}=\{0,1,\dots ,K\}$ the label space, where 0 denotes benign traffic and $k\in \{1,\dots ,K\}$ denotes distinct attack categories. A defender trains a classifier $f_{\theta }:\mathcal{X}\to \mathcal{Y}$ parameterized by $\theta$ on a clean dataset $\mathcal{D}={\left\{({\mathbf{x}}_i,y_i)\right\}}_{i=1}^N$.

An evasion attacker perturbs an attack record $\mathbf{x}$ with $y\ne 0$ to obtain ${\mathbf{x}}^{\prime }=\mathbf{x}+\delta$ such that

$$f_{\theta }\left({\mathbf{x}}^{\prime }\right)=0,{\parallel \delta \parallel }_p\le ϵ,{\mathbf{x}}^{\prime }\in \mathcal{C}\left(\mathbf{x}\right),$$

(1)

where $ϵ$ bounds the perturbation magnitude in the ${\mathsf{\ell }}_p$ norm, and $\mathcal{C}\left(\mathbf{x}\right)$ denotes the set of semantically valid feature vectors reachable from $\mathbf{x}$ (i.e., those satisfying network protocol constraints and feature coupling invariants). The defender seeks ${\theta }^{\ast }$ that minimizes the worst-case expected loss:

$${\theta }^{\ast }=\arg \underset{\theta }{\min }{\mathbb{E}}_{(\mathbf{x},y)\sim \mathcal{D}}\left[\underset{{\delta :\parallel \delta \parallel }_p\le ϵ,\mathbf{x}+\delta \in \mathcal{C}\left(\mathbf{x}\right)}{\max }\mathcal{L}(f_{\theta }(\mathbf{x}+\delta ),y)\right].$$

(2)

3.2. Wasserstein GAN with Gradient Penalty (WGAN-GP)

A standard GAN [42] optimizes the minimax objective:

$$\underset{G}{\min }\underset{D}{\max }{\mathbb{E}}_{\mathbf{x}\sim p_{\mathrm{data}}}\left[\log D\left(\mathbf{x}\right)\right]+{\mathbb{E}}_{\mathbf{z}\sim p_z}\left[\log (1-D\left(G\left(\mathbf{z}\right)\right))\right].$$

(3)

WGAN-GP [13] replaces Equation (3) with

$$\underset{G}{\min }\underset{{\parallel D\parallel }_L\le 1}{\max }{\mathbb{E}}_{\mathbf{x}\sim p_{\mathrm{data}}}\left[D\left(\mathbf{x}\right)\right]-{\mathbb{E}}_{\mathbf{z}\sim p_z}\left[D\left(G\left(\mathbf{z}\right)\right)\right]-\lambda {\mathbb{E}}_{\widehat{\mathbf{x}}\sim p_{\widehat{\mathbf{x}}}}\left[(\parallel {\nabla }_{\widehat{\mathbf{x}}}D\left(\widehat{\mathbf{x}}\right){{\parallel }_2-1)}^2\right],$$

(4)

where $\widehat{\mathbf{x}}$ is sampled uniformly between real and generated samples, and $\lambda$ is the gradient penalty coefficient. The Wasserstein distance provides meaningful gradient signal even when the real and generated distributions are disjoint, which is common in high-dimensional flow feature spaces.

3.3. Game-Theoretic Foundations

We model the detection problem as a two-player zero-sum game $\Gamma =\langle \{A,D\},S_A,S_D,u_A,u_D\rangle$, where attacker A and defender D maintain mixed strategies over their respective action spaces (perturbation policies and classification thresholds), and $u_D=-u_A$. A Nash equilibrium $({\sigma }_A^{\ast },{\sigma }_D^{\ast })$ satisfies

$$u_D({\sigma }_A^{\ast },{\sigma }_D^{\ast })\ge u_D({\sigma }_A^{\ast },{\sigma }_D)\forall {\sigma }_D,u_A({\sigma }_A^{\ast },{\sigma }_D^{\ast })\ge u_A({\sigma }_A,{\sigma }_D^{\ast })\forall {\sigma }_A.$$

(5)

In our setting, the equilibrium is not solved in closed form but approximated iteratively during the training process, with cost weights updated to track the evolving best-response landscape.

4. Methodology

Figure 1 provides an overview of the GT-CSAT framework. The system consists of three tightly coupled components: (1) a conditioned WGAN-GP threat generator (Section 4.1) that synthesizes covert, semantically valid adversarial flow records; (2) a deep residual IDS detector (Section 4.2); and (3) a game-theoretic cost-sensitive training protocol (Section 4.3) that governs the adversarial training loop with dynamically adapted misclassification penalties.

4.1. Attack-Conditioned WGAN-GP Threat Generator

Standard evasion-based AT augments the training set exclusively with perturbations produced by a single, fixed attack algorithm (e.g., PGD). This leaves the detector brittle against structurally different perturbation strategies that were absent from training. To expose the detector to a wider manifold of covert traffic variants, we design a conditional WGAN-GP generator $G_{\varphi }(\mathbf{z},\mathbf{c})$ that synthesizes adversarial records conditioned on an attack-category embedding $\mathbf{c}\in {\mathbb{R}}^{d_c}$.

4.1.1. Architecture

The generator $G_{\varphi }$ is a five-layer fully connected network with residual connections and spectral normalization [62]. An attack category k is mapped to a continuous embedding $\mathbf{c}=E_{\psi }\left(k\right)\in {\mathbb{R}}^{16}$ via a learnable embedding table $E_{\psi }$. The noise vector $\mathbf{z}\sim \mathcal{N}(\mathbf{0},\mathbf{I})$ is concatenated with $\mathbf{c}$ at the input layer. The discriminator $D_{\omega }$ mirrors the generator architecture and receives both the flow feature vector and the category embedding, enabling class-conditional Wasserstein estimation.

The training objective follows Equation (4), extended to the conditional setting

$${\mathcal{L}}_{\mathrm{CWGAN}}={\mathbb{E}}_{\mathbf{x}\sim p_k}[D_{\omega }(\mathbf{x},\mathbf{c})]-{\mathbb{E}}_{\mathbf{z}}[D_{\omega }(G_{\varphi }(\mathbf{z},\mathbf{c}),\mathbf{c})]-{\lambda }_{\mathrm{gp}}{\mathbb{E}}_{\widehat{\mathbf{x}}}[(\parallel {\nabla }_{\widehat{\mathbf{x}}}{D}_{\omega }(\widehat{\mathbf{x}},\mathbf{c}){\parallel }_2-1{)}^2],$$

(6)

where $p_k$ is the empirical distribution of class-k attack records.

4.1.2. Semantic Constraint Projection

Raw GAN outputs may violate network protocol invariants, rendering them unrealistic and inapplicable for training a detector that will face protocol-compliant traffic. After generation, each candidate sample $\tilde{\mathbf{x}}=G_{\varphi }(\mathbf{z},\mathbf{c})$ is passed through a differentiable constraint projection layer $\Pi :{\mathbb{R}}^d\to \mathcal{C}$:

$$\widehat{\mathbf{x}}=\Pi \left(\tilde{\mathbf{x}}\right)=\arg \underset{\mathbf{v}\in \mathcal{C}}{\min }{\parallel \mathbf{v}-\tilde{\mathbf{x}}\parallel }_2^2,$$

(7)

where $\mathcal{C}$ encodes: (i) non-negativity of byte and packet counts; (ii) total bytes ≥ forward bytes + backward bytes; (iii) integer rounding for packet count features; and (iv) feature-wise clipping to observed ranges. This projection is computed in closed form for linear and box constraints and is applied without blocking gradient flow through the Reparameterization Trick.

4.1.3. Evasion-Guided Generator Update

Beyond standard WGAN-GP training, we additionally fine-tune $G_{\varphi }$ every $n_{\mathrm{adv}}$ iterations to maximize the IDS detector’s loss, creating a feedback loop reminiscent of the black-box IDSGAN paradigm but operating within the full white-box co-training setting:

$${\mathcal{L}}_{\mathrm{evasion}}=-{\mathcal{L}}_{\mathrm{CE}}(f_{\theta }\left(\widehat{\mathbf{x}}\right),0),$$

(8)

where ${\mathcal{L}}_{\mathrm{CE}}$ is the cross-entropy loss and the target label 0 represents the benign class. This term incentivizes the generator to synthesize samples that the current detector is most likely to misclassify as benign, concentrating generation capacity on the hardest-to-detect variants.

4.2. Deep Residual IDS Detector

The detector $f_{\theta }$ is a six-block deep residual network [63] adapted for tabular input. Each residual block comprises two linear layers with batch normalization [64] and GELU activations [65], with a skip connection. Dropout [66] with rate $p=0.3$ is applied after each block during training. The final classification head outputs a $(K+1)$-dimensional logit vector, and predictions are obtained via softmax.

We choose a residual architecture over simpler feed-forward networks because skip connections alleviate gradient vanishing during the inner-loop PGD update, allowing the detector to adapt efficiently to the generator’s adversarial outputs without losing gradient signal in deeper layers.

4.3. Game-Theoretic Cost-Sensitive Loss Function (GTCS-Loss)

The central innovation of GT-CSAT is the GTCS-Loss, which replaces the symmetric cross-entropy with an asymmetric objective whose cost weights are determined by a game-theoretic payoff structure and adapted online throughout training.

4.3.1. Payoff Matrix Formulation

We define a $(K+1)\times (K+1)$ misclassification cost matrix $\mathbf{C}$ where entry $C_{jk}$ quantifies the security cost incurred when the detector predicts class j while the true label is k:

$$C_{jk}=\left\{\begin{array}{cc}0\hfill & j=k\left(\mathrm{correct}\mathrm{classification}\right)\hfill \\ c_{\mathrm{FN}}\hfill & j=0,k\ne 0\left(\mathrm{false}\mathrm{negative:}\mathrm{missed}\mathrm{attack}\right)\hfill \\ c_{\mathrm{FP}}\hfill & j\ne 0,k=0\left(\mathrm{false}\mathrm{positive:}\mathrm{benign}\mathrm{flagged}\mathrm{as}\mathrm{attack}\right)\hfill \\ c_{\mathrm{MC}}\hfill & j\ne k,j\ne 0,k\ne 0\left(\mathrm{attack}\mathrm{misclassification}\right)\hfill \end{array}\right.$$

(9)

In a cloud security context, $c_{\mathrm{FN}}\gg c_{\mathrm{FP}}>c_{\mathrm{MC}}>0$, because a missed attack carries the highest operational risk, while misclassifying a DDoS as a port scan—though suboptimal—still triggers an alert.

4.3.2. Cost-Sensitive Cross-Entropy

The per-sample cost-sensitive loss for a sample $(\mathbf{x},y)$ with predicted probability vector $\mathbf{p}=\mathrm{softmax}\left(f_{\theta }\left(\mathbf{x}\right)\right)\in {\Delta }^K$ is

$${\mathsf{\ell }}_{\mathrm{CS}}(\mathbf{p},y)=-\sum _{j=0}^K{w}_{jy}·\mathbf{1}[j=y]·\log p_j+\sum _{j\ne y}{w}_{jy}·p_j·\log (1-p_j+\epsilon ),$$

(10)

where $w_{jy}=C_{jy}/{\max }_{j^{\prime }}{C}_{j^{\prime }y}$ is the row-normalized cost weight and $\epsilon ={10}^{-8}$ avoids numerical instability. In practice, we use the following more tractable formulation:

$${\mathsf{\ell }}_{\mathrm{CS}}(\mathbf{p},y)=-\log p_y+\sum _{j\ne y}{w}_{jy}·p_j,$$

(11)

which penalizes the predicted probability mass placed on incorrect classes in proportion to the misclassification cost of each error type.

4.3.3. Nash Equilibrium-Inspired Cost Adaptation

Treating $c_{\mathrm{FN}}$ and $c_{\mathrm{FP}}$ as fixed constants makes the defense brittle: if the generator learns to concentrate attack variants in regions of the feature space where $c_{\mathrm{FN}}$ is insufficiently large to drive learning, the detector converges to a suboptimal equilibrium. We therefore model the attacker as playing a mixed strategy over evasion patterns and update the cost weights at the end of each training epoch to reflect the current best-response landscape.

Let $r_{\mathrm{FN}}^{\left(t\right)}$ and $r_{\mathrm{FP}}^{\left(t\right)}$ denote the epoch-t false-negative rate and false-positive rate of the current detector $f_{{\theta }^{\left(t\right)}}$ evaluated on the held-out validation set. The attacker’s utility from the defender’s perspective is highest when $r_{\mathrm{FN}}^{\left(t\right)}$ is high (many missed attacks). We update the cost weights as follows:

$$\begin{array}{cc}\hfill c_{\mathrm{FN}}^{(t+1)}& =c_{\mathrm{FN}}^{\left(t\right)}·exp\left({\eta }_c·\left(r_{\mathrm{FN}}^{\left(t\right)}-{\tau }_{\mathrm{FN}}\right)\right),\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill c_{\mathrm{FP}}^{(t+1)}& =c_{\mathrm{FP}}^{\left(t\right)}·exp\left(-{\eta }_c·\left(r_{\mathrm{FP}}^{\left(t\right)}-{\tau }_{\mathrm{FP}}\right)\right),\hfill \end{array}$$

(13)

where ${\tau }_{\mathrm{FN}},{\tau }_{\mathrm{FP}}$ are target operating-point thresholds (e.g., 2% and 5%) and ${\eta }_c>0$ is the cost learning rate. These update rules bear structural resemblance to multiplicative weights in regret-minimization algorithms [67], which are known to converge to Nash equilibria in two-player zero-sum games when applied by both agents. In our setting, the defender alone applies the update, treating the generator’s evolving attack distribution as a best-responding adversary.

Theoretical Justification. The update rules in Equations (12) and (13) are structural instances of the Multiplicative Weights Update (MWU) algorithm [67], a foundational method in online learning that guarantees convergence to Nash equilibria in two-player zero-sum games when both players employ regret-minimizing strategies. In our formulation, the defender plays a parameterized strategy (the cost weights $c_{\mathrm{FN}}$, $c_{\mathrm{FP}}$), and the generator implicitly plays a best-response strategy by evolving its attack distribution via the evasion-guided update (Equation (8)).

Formally, we can interpret $c_{\mathrm{FN}}^{\left(t\right)}$ as the defender’s mixed-strategy weight on the “penalize false negatives” action. The exponential update $c_{\mathrm{FN}}^{(t+1)}=c_{\mathrm{FN}}^{\left(t\right)}·exp({\eta }_c·(r_{\mathrm{FN}}^{\left(t\right)}-{\tau }_{\mathrm{FN}}))$ increases this weight when the observed false-negative rate exceeds the target threshold ${\tau }_{\mathrm{FN}}$, and decreases it otherwise—precisely the multiplicative weights prescription where the “loss” is $(r_{\mathrm{FN}}^{\left(t\right)}-{\tau }_{\mathrm{FN}})$. The symmetric argument applies to $c_{\mathrm{FP}}$. According to the classic MWU convergence theorem [67], if both players’ strategy updates satisfy the no-regret property, the time-averaged strategies converge to an $\epsilon$-approximate Nash equilibrium at rate $O\left(\sqrt{lnN/T}\right)$, where N is the number of actions and T is the number of rounds (epochs).

In our setting, the generator does not explicitly run MWU but instead performs gradient-based best-response updates via ${\mathcal{L}}_{\mathrm{CWGAN}}+\gamma {\mathcal{L}}_{\mathrm{evasion}}$, which empirically approximates no-regret behavior. The clipping of cost weights to $[c_{\min },c_{\max }]$ ensures bounded loss and prevents degenerate scaling. Together, these properties provide a principled theoretical basis for expecting the cost weights to converge to a stable operating point that approximates the Nash equilibrium of the underlying detector–generator game, as empirically confirmed by the convergence trajectories in Section 5.5.4.

Illustrative Example. To build intuition for the cost adaptation mechanism, consider a simplified scenario with the following initial settings: $c_{\mathrm{FN}}^{\left(0\right)}=5.0$, $c_{\mathrm{FP}}^{\left(0\right)}=1.0$, ${\eta }_c=0.05$, ${\tau }_{\mathrm{FN}}=0.02$, ${\tau }_{\mathrm{FP}}=0.05$. Suppose after epoch 1, the detector’s validation performance yields $r_{\mathrm{FN}}^{\left(1\right)}=0.15$ (15% of attacks missed) and $r_{\mathrm{FP}}^{\left(1\right)}=0.03$ (3% false alarms). We then apply Equations (12) and (13) as follows:

$$\begin{array}{cc}\hfill c_{\mathrm{FN}}^{\left(1\right)}& =5.0·exp(0.05·(0.15-0.02\left)\right)=5.0·exp\left(0.0065\right)\approx 5.033,\hfill \\ \hfill c_{\mathrm{FP}}^{\left(1\right)}& =1.0·exp(-0.05·(0.03-0.05\left)\right)=1.0·exp\left(0.001\right)\approx 1.001.\hfill \end{array}$$

The false-negative cost increases because $r_{\mathrm{FN}}$ (0.15) exceeds the target ${\tau }_{\mathrm{FN}}$ (0.02), signaling that the detector is missing too many attacks. The false-positive cost remains nearly unchanged because $r_{\mathrm{FP}}$ (0.03) is below its target ${\tau }_{\mathrm{FP}}$ (0.05). As the co-trained generator discovers increasingly effective evasion strategies over subsequent epochs, the cumulative multiplicative updates drive $c_{\mathrm{FN}}$ upward—for instance, reaching approximately 7.84 by epoch 15 and 14.56 by epoch 50—forcing the detector’s loss function to assign substantially higher penalty to missed attacks. Once the detector adapts and $r_{\mathrm{FN}}$ drops toward the target ${\tau }_{\mathrm{FN}}=0.02$, the exponent approaches zero and $c_{\mathrm{FN}}^{(t+1)}\approx c_{\mathrm{FN}}^{\left(t\right)}$, leading to convergence. This self-correcting behavior is precisely the hallmark of Nash equilibrium: neither player can unilaterally improve their payoff.

Table 1. Illustrative cost weight trajectory under the Nash-inspired adaptation rule. The cost weights evolve in response to the detector’s validation performance and converge to stable values as the system approaches approximate Nash equilibrium. The — indicates no available results.

Epoch	${\mathit{r}}_{\mathbf{FN}}$	${\mathit{r}}_{\mathbf{FP}}$	${\mathit{c}}_{\mathbf{FN}}$	${\mathit{c}}_{\mathbf{FP}}$	Interpretation
0	—	—	5.00	1.00	Initial costs
5	0.18	0.04	5.20	0.99	Generator finding evasions
15	0.12	0.06	7.84	0.88	Strong evasions discovered
30	0.05	0.04	12.31	0.93	Detector closing gap
50	0.03	0.05	14.56	0.95	Near equilibrium
80	0.02	0.05	14.72	0.97	Approx. equilibrium reached
100	0.02	0.05	14.74	0.98	Converged

summarizes this trajectory for selected epochs, consistent with the empirical observations in in Section 5.5.4.

Both weights are clipped to $[c_{\min },c_{\max }]$ to prevent degenerate loss scales, and the normalized weights $w_{jy}$ in Equation (11) are recomputed accordingly after each epoch.

4.3.4. Full Training Objective

The complete per-batch training objective for the detector is

$${\mathcal{L}}_{\mathrm{GTCS}}=\underset{\mathrm{clean}\mathrm{term}}{\underbrace{{\displaystyle \frac{1}{|{\mathcal{B}}_c|}}\sum _{(\mathbf{x},y)\in {\mathcal{B}}_c}{\mathsf{\ell }}_{\mathrm{CS}}(\mathbf{p},y)}}+\alpha ·\underset{\mathrm{adversarial}\mathrm{term}}{\underbrace{{\displaystyle \frac{1}{|{\mathcal{B}}_a|}}\sum _{(\widehat{\mathbf{x}},y)\in {\mathcal{B}}_a}{\mathsf{\ell }}_{\mathrm{CS}}(\widehat{\mathbf{p}},y)}}+\beta ·\underset{\mathrm{smoothness}\mathrm{term}}{\underbrace{{\mathcal{L}}_{\mathrm{KL}}}},$$

(14)

where ${\mathcal{B}}_c$ and ${\mathcal{B}}_a$ are mini-batches of clean and adversarial samples (drawn in a 1:1 ratio), $\widehat{\mathbf{p}}=\mathrm{softmax}\left(f_{\theta }\left(\widehat{\mathbf{x}}\right)\right)$, $\alpha \in [0,1]$ controls the relative weight of the adversarial term (set to 0.5 by default), and ${\mathcal{L}}_{\mathrm{KL}}=\mathrm{KL}(f_{\theta }\left(\mathbf{x}\right)\parallel f_{\theta }\left(\widehat{\mathbf{x}}\right))$ is a consistency regularizer inspired by TRADES [14] that penalizes large output divergence between clean and adversarial versions of the same record.

4.4. Training Algorithm

Algorithm 1 summarizes the complete GT-CSAT training procedure. The generator is pre-trained for $T_{\mathrm{pre}}$ epochs using only the CWGAN-GP objective (Equation (6)) before the joint training loop begins. During the joint phase, the generator and detector alternate updates: the discriminator takes $n_c$ critic steps per generator step (standard WGAN practice), and the evasion update (Equation (8)) is applied every $n_{\mathrm{adv}}$ iterations.

Algorithm 1 GT-CSAT Training Procedure

Require:  Dataset $\mathcal{D}$, hyperparameters $\alpha ,\beta ,{\eta }_c,{\lambda }_{\mathrm{gp}},n_c,n_{\mathrm{adv}},T,T_{\mathrm{pre}}$, initial costs $c_{\mathrm{FN}}^{\left(0\right)},c_{\mathrm{FP}}^{\left(0\right)}$ Ensure:  Robust detector $f_{{\theta }^{\ast }}$   1: Pre-train $G_{\varphi },D_{\omega }$ for $T_{\mathrm{pre}}$ epochs using ${\mathcal{L}}_{\mathrm{CWGAN}}$ (Equation (6))   2: for $t=1$ to T do   3:    for each mini-batch ${\mathcal{B}}_c\sim \mathcal{D}$ do   4:          Sample noise $\mathbf{z}$ and categories $\mathbf{c}$; generate $\widehat{\mathbf{x}}=\Pi \left(G_{\varphi }(\mathbf{z},\mathbf{c})\right)$   5:          Construct adversarial batch ${\mathcal{B}}_a=\left\{(\widehat{\mathbf{x}},y)\right\}$   6:          Compute ${\mathcal{L}}_{\mathrm{GTCS}}$ (Equation (14)) using current $c_{\mathrm{FN}}^{\left(t\right)},c_{\mathrm{FP}}^{\left(t\right)}$   7:          Update $\theta \leftarrow \theta -{\nabla }_{\theta }{\mathcal{L}}_{\mathrm{GTCS}}$   8:          Update $D_{\omega }$ via $n_c$ gradient steps on ${\mathcal{L}}_{\mathrm{CWGAN}}$   9:          if iteration mod $n_{\mathrm{adv}}=0$ then 10:              Update $G_{\varphi }$ jointly via ${\mathcal{L}}_{\mathrm{CWGAN}}+\gamma {\mathcal{L}}_{\mathrm{evasion}}$ (Equation (8)) 11:          end if 12:    end for 13:    Evaluate $r_{\mathrm{FN}}^{\left(t\right)},r_{\mathrm{FP}}^{\left(t\right)}$ on validation set 14:    Update $c_{\mathrm{FN}}^{(t+1)},c_{\mathrm{FP}}^{(t+1)}$ via Equations (12) and (13) 15: end for 16: return $f_{{\theta }^{\ast }}$

5. Experiments

5.1. Dataset

We evaluate on the Cloud Vulnerabilities Dataset (CVD) [68], a publicly available benchmark designed specifically for cloud security research and accessible at https://www.kaggle.com/datasets/cyberprince/cloud-vulnerabilities-dataset (accessed on 1 February 2026). CVD contains network flow records captured in a simulated AWS-style cloud environment, spanning five traffic categories: (0) Benign, (1) DDoS, (2) Port Scan, (3) Brute Force, and (4) SQL Injection. Each record comprises 78 flow-level statistical features including forward/backward packet length statistics, flow duration, inter-arrival time moments, active/idle time ratios, and flag counts—a feature set consistent with CICFlowMeter [69] extraction. The class distribution is imbalanced: Benign constitutes approximately 53.4% of records, DDoS 21.7%, Port Scan 14.2%, Brute Force 8.9%, and SQL Injection 1.8%.

We apply the following pre-processing pipeline: (i) removal of records with infinite or NaN values (3.1% of total); (ii) $\log (1+x)$ transformation for right-skewed features; (iii) standardization to zero mean and unit variance using training-set statistics; (iv) random stratified split into 70% training, 10% validation, and 20% test subsets. The semantic constraint set $\mathcal{C}$ for the projection layer (Equation (7)) is derived from the empirical feature ranges and coupling relationships observed in the training set.

5.2. Baselines

We compare GT-CSAT against five baselines:

• Standard—the deep residual detector trained without any adversarial augmentation.
• AT-PGD—adversarial training [8] using PGD-10 perturbations (${\mathsf{\ell }}_{\infty }$, $ϵ=0.05$) as the sole augmentation source.
• TRADES—the TRADES objective [14] applied to the same detector architecture, with the boundary regularization weight ${\beta }_{\mathrm{TRADES}}=6.0$.
• IDSGAN-AT—adversarial training augmented with samples from a separately pre-trained IDSGAN generator [10] (fixed generator, no co-training).
• Focal-AT—adversarial training with focal loss [61] (${\gamma }_f=2$) as a cost-sensitive baseline that uses static cost weighting.

All baselines use the identical deep residual detector backbone described in Section 4.2 and are trained for the same number of epochs (100) with the same optimizer and learning rate schedule.

5.3. Evaluation Metrics

We report the following metrics, averaged over five independent random seeds to account for stochastic variability in training:

• Clean Accuracy (CA): per-class macro-averaged accuracy on unperturbed test records.
• Robust Accuracy (RA): macro-averaged accuracy on adversarially perturbed test records under each attack strategy.
• False Negative Rate (FNR): the fraction of true attack records classified as benign.
• False Positive Rate (FPR): the fraction of benign records classified as attacks.
• F1 Score: macro-averaged $F_1$ across all five classes, on both clean and adversarial test sets.
• Robustness–Accuracy Gap (RAG): defined as $CA-RA$, quantifying the accuracy penalty incurred by robustness; lower RAG is preferred.
• Attack Success Rate (ASR): the fraction of attack records that the evasion strategy successfully causes to be classified as benign.

5.4. Experimental Setup

5.4.1. Attack Configurations

We evaluate all methods under six evasion strategies: (a) FGSM [7] with $ϵ\in \{0.01,0.05\}$; (b) PGD-20 [8] (${\mathsf{\ell }}_{\infty }$, $ϵ=0.05$, step size 0.005); (c) BIM [70] (${\mathsf{\ell }}_{\infty }$, $ϵ=0.05$, 10 steps); (d) C&W (${\mathsf{\ell }}_2$) [9] with 1000 binary search iterations; (e) DeepFool [71] with 50 iterations; and (f) IDSGAN-BB [10], a black-box GAN-based attack using a surrogate detector trained on a disjoint 20% split. For gradient-based attacks applied to tabular features, non-functional features (those not affecting the underlying attack payload) are perturbed within validated ranges; functional features (e.g., destination IP) are held fixed following [11].

5.4.2. Hyperparameter Settings

GT-CSAT hyperparameters: ${\lambda }_{\mathrm{gp}}=10$, $n_c=5$, $n_{\mathrm{adv}}=10$, $\alpha =0.5$, $\beta =0.1$, $\gamma =0.5$, ${\eta }_c=0.05$, ${\tau }_{\mathrm{FN}}=0.02$, ${\tau }_{\mathrm{FP}}=0.05$, $c_{\mathrm{FN}}^{\left(0\right)}=5.0$, $c_{\mathrm{FP}}^{\left(0\right)}=1.0$, $c_{\mathrm{MC}}=2.0$, $[c_{\min },c_{\max }]=[1.0,20.0]$, $T_{\mathrm{pre}}=20$, $T=100$. The detector is trained with Adam ($\mathrm{lr}={10}^{-3}$, cosine annealing to ${10}^{-5}$, weight decay ${10}^{-4}$). Batch size is 256; generator noise dimension is 64.

5.4.3. Hardware

Experiments are conducted on a single NVIDIA A100 40 GB GPU. Training GT-CSAT for 100 epochs takes approximately 3.2 h on CVD.

5.4.4. Reproducibility

All random seeds are fixed (NumPy v1.26.4, PyTorch v2.1.0, CUDA v12.1), and results are reported as mean ± standard deviation over five runs with seeds $\{0,1,2,3,4\}$.

5.5. Main Results

5.5.1. Clean Accuracy and Overall Robustness

Table 2. Main performance comparison on CVD (mean ± std over five random seeds). CA = Clean Accuracy; RA = Average Robust Accuracy (over all six attacks); FNR = False Negative Rate on adversarial test set; RAG = $CA-RA$; F1 = Macro-F1 on clean test set.

Method	CA (%)	RA (%)	FNR (%)	RAG (pp)	F1 (%)
Standard	99.4 ± 0.1	72.9 ± 1.3	24.7 ± 1.1	26.5	98.8 ± 0.2
AT-PGD	97.1 ± 0.3	87.5 ± 0.6	10.3 ± 0.7	9.6	96.6 ± 0.3
TRADES	97.5 ± 0.2	88.1 ± 0.5	9.8 ± 0.6	9.4	97.1 ± 0.2
IDSGAN-AT	98.2 ± 0.2	85.3 ± 0.8	12.6 ± 0.9	12.9	97.7 ± 0.2
Focal-AT	97.8 ± 0.2	87.0 ± 0.7	11.0 ± 0.6	10.8	97.2 ± 0.3
GT-CSAT (Ours)	97.1 ± 0.2	94.3 ± 0.4	3.1 ± 0.3	2.8	96.8 ± 0.2

reports clean accuracy, robust accuracy averaged over all six evasion strategies, FNR, and macro-F1 for all methods. GT-CSAT achieves the highest robust accuracy (94.3% ± 0.4%) and the lowest average FNR (3.1% ± 0.3%), while maintaining a competitive clean accuracy of 97.1% ± 0.2%. Notably, standard adversarial training (AT-PGD) yields higher robustness than the undefended standard baseline (75.3% vs. 72.9%) but degrades clean accuracy by 2.3 pp, illustrating the classic trade-off. GT-CSAT’s RAG of 2.8 pp is substantially lower than AT-PGD’s 4.2 pp and TRADES’ 3.6 pp, confirming that the GTCS-Loss successfully mitigates accuracy degradation. IDSGAN-AT and Focal-AT show intermediate performance, with IDSGAN-AT underperforming on IDSGAN-BB attacks (ASR remains elevated at 18.4%) because the fixed, non-co-trained generator fails to cover the full evasion manifold.

5.5.2. Per-Attack Robust Accuracy Breakdown

Table 3. Per-attack robust accuracy (%) on CVD test set (mean over five runs). Best result per attack highlighted in bold.

Method	FGSM	PGD-20	BIM	C&W	DeepFool	IDSGAN-BB
Standard	74.2	68.1	70.3	66.4	71.1	77.2
AT-PGD	92.1	91.8	91.4	84.2	89.3	76.4
TRADES	92.5	92.0	91.8	83.4	90.1	79.0
IDSGAN-AT	88.6	86.4	87.2	81.1	87.0	81.6
Focal-AT	91.3	90.2	90.6	82.5	89.0	79.4
GT-CSAT	95.8	95.1	95.3	92.1	94.6	93.4

shows robust accuracy broken down per evasion strategy. GT-CSAT achieves the highest RA under all six strategies. The advantage is most pronounced for IDSGAN-BB (93.4% vs. 81.6% for the next best, IDSGAN-AT), confirming that co-training the generator with the detector leads to substantially improved coverage of the black-box evasion manifold. Under C&W, where the attack search is particularly potent, GT-CSAT still maintains 92.1% RA, compared to 83.4% for TRADES—a difference attributable to the GTCS-Loss’s stronger penalty on false negatives driving the detector to maintain tighter decision boundaries.

5.5.3. Per-Class Performance Under IDSGAN-BB

Figure 2 plots per-class F1 on the adversarially perturbed test set (IDSGAN-BB) for all methods. SQL Injection, as the rarest class (1.8% prevalence), shows the largest variance across methods. GT-CSAT achieves 91.2% F1 for SQL Injection under IDSGAN-BB, compared to 73.6% for AT-PGD, demonstrating that the cost-adaptive mechanism specifically benefits minority attack classes by dynamically elevating $c_{\mathrm{FN}}$ when rare-class detection degrades. DDoS and Port Scan show high F1 across all defended methods (>90%), confirming that common attack categories are not sacrificed.

5.5.4. Cost Weight Trajectory

Figure 3 plots $c_{\mathrm{FN}}^{\left(t\right)}$ and $c_{\mathrm{FP}}^{\left(t\right)}$ across the 100 training epochs. $c_{\mathrm{FN}}$ rises sharply in the first 15 epochs as the co-trained generator discovers effective evasions, stabilizing around epoch 40 as the detector closes the gap. $c_{\mathrm{FP}}$ shows a slight early decline followed by oscillation, consistent with the detector temporarily over-alerting while adapting to adversarial variants. Both weights converge to stable values, suggesting that the Nash-inspired adaptation rule leads to an approximate equilibrium in the detector–generator game.

5.5.5. Robustness–Accuracy Trade-Off Curve

Figure 4 plots the clean accuracy vs. average robust accuracy for all methods, sweeping the adversarial mix ratio $\alpha$ in $\{0.1,0.2,\dots ,0.9\}$ for GT-CSAT and the PGD perturbation strength $ϵ$ for AT-PGD. GT-CSAT traces a Pareto-superior frontier: at any given level of clean accuracy, GT-CSAT achieves strictly higher robust accuracy than AT-PGD and TRADES. This demonstrates that the game-theoretic cost adaptation achieves genuine decoupling of the two objectives, rather than merely shifting the trade-off point.

Three observations merit emphasis. First, GT-CSAT’s frontier lies strictly above all competing methods, confirming genuine Pareto dominance rather than a mere shift in the trade-off point. Second, the advantage is most operationally significant in the 96–98% CA range that practical IDS deployments target: here, GT-CSAT offers 4–7 pp higher RA than AT-PGD at equivalent clean accuracy. Third, the Standard baseline’s position—highest CA (99.4%) but lowest RA (72.9%)—starkly illustrates the insufficiency of clean accuracy as a deployment metric, motivating the asymmetric cost formulation at the core of our approach.

5.5.6. Ablation Study

Table 4. Ablation study. Each row removes one GT-CSAT component relative to the full model. ↓ and ↑ indicates decrease and increase relative to GT-CSAT full, respectively. All metrics are averaged over five random seeds.

Configuration	CA (%)	RA (%)	FNR (%)	FPR (%)
GT-CSAT (full)	97.1	94.3	3.1	2.9
– Nash cost adaptation	97.3	91.1 ↓	5.8 ↑	2.7
– Conditioned generation	97.2	92.2 ↓	4.9 ↑	2.9
– Semantic constraint projection	96.8	92.9 ↓	4.2 ↑	3.8 ↑
– Evasion guidance update	97.0	92.7 ↓	4.6 ↑	2.9
– WGAN-GP (replace with vanilla GAN)	96.4	89.7 ↓	7.2 ↑	3.4

presents an ablation study, progressively removing components from GT-CSAT. Removing the Nash-inspired cost adaptation (replacing with fixed $c_{\mathrm{FN}}=5.0$ throughout) degrades average RA by 3.2 pp. Removing the conditioned generation (using an unconditional WGAN-GP) degrades RA by 2.1 pp. Removing the semantic constraint projection degrades RA by 1.4 pp and, importantly, increases FPR by 0.9 pp because the unconstrained samples push the detector toward false positives on legitimate traffic sharing features with the out-of-distribution adversarial records. The evasion guidance update contributes a further 1.6 pp. Together, these results confirm that each component makes a non-trivial and largely orthogonal contribution to the overall robustness.

5.5.7. Sensitivity Analysis

Figure 5 shows the sensitivity of RA and CA to the three most important hyperparameters: the cost learning rate ${\eta }_c$, the adversarial mixing ratio $\alpha$, and the gradient penalty coefficient ${\lambda }_{\mathrm{gp}}$. RA is relatively insensitive to ${\lambda }_{\mathrm{gp}}\in [5,20]$, confirming that WGAN-GP training quality does not depend critically on the exact penalty magnitude within this range. The mixing ratio $\alpha$ exhibits the expected trade-off: CA increases as $\alpha \to 0$ (less adversarial training) while RA degrades. GT-CSAT at $\alpha =0.5$ sits near the knee of this curve, achieving a good balance. The cost learning rate ${\eta }_c$ shows that values in $[0.01,0.1]$ yield stable behavior; ${\eta }_c>0.2$ leads to oscillation of $c_{\mathrm{FN}}$ and slight RA degradation, confirming the importance of the clipping bounds.

5.5.8. Computational Overhead

Table 5. Training time per epoch (GPU seconds) and inference latency (milliseconds per sample) on CVD. Inference latency measured on CPU for production-realistic comparison.

Method	Train Time/Epoch (s)	Inference Latency (ms)
Standard	8.2	0.11
AT-PGD	36.4	0.11
TRADES	35.1	0.11
IDSGAN-AT	42.6	0.11
Focal-AT	36.2	0.11
GT-CSAT	76.3	0.11

summarizes training time per epoch and inference latency. GT-CSAT incurs approximately 2.1× the training time of AT-PGD due to the joint generator training and the additional critic steps. However, inference latency is identical to the undefended standard detector, as the generator is used only during training. This is a critical advantage for production deployment, where real-time detection at cloud-gateway throughput is mandatory.

5.5.9. Discussion

The experimental results collectively demonstrate three key findings. First, the co-trained conditioned WGAN-GP generator produces substantially more diverse adversarial variants than fixed-perturbation strategies: the generator’s evasion success on the current detector at epoch 100 is 12.3%, compared to 67.8% on the undefended standard model, indicating that the detector effectively closes the adversarial gap during training. Second, the GTCS-Loss’s dynamic cost adaptation prevents the accuracy–robustness trade-off from worsening as training progresses: ablation shows that fixed costs lead to an accelerating RA–CA gap after epoch 60, whereas the adaptive version maintains stability. Third, the robustness gains generalize to attack strategies not seen during training (e.g., DeepFool and C&W were not used in the generator’s evasion update), suggesting that the detector learns a broadly robust representation rather than overfitting to a specific perturbation family.

One point of caution is that performance results exhibit non-trivial variance across random seeds (standard deviation up to ±0.8 pp for some per-attack metrics), reflecting genuine stochasticity in the GAN training dynamics and the minimax optimization landscape. Practical deployment should average predictions across multiple detector checkpoints or use an ensemble to reduce this variance.

5.6. Cross-Dataset Generalization

To validate the generalizability of GT-CSAT beyond the CVD, we conduct additional experiments on two widely used public IDS benchmarks: CICIDS-2017 [24] and UNSW-NB15 [25]. CICIDS-2017 contains network traffic captured over five days in a realistic test-bed environment, encompassing 14 attack types grouped into five categories (Benign, DoS/DDoS, Port Scan, Brute Force, and Web Attack) consistent with our evaluation framework. UNSW-NB15 was generated using the IXIA PerfectStorm tool and comprises nine attack categories, which we consolidate into five groups (Benign, DoS, Reconnaissance, Exploits, and Fuzzers). The same preprocessing pipeline and hyperparameters are applied without dataset-specific tuning.

Table 6. Cross-dataset generalization results (mean ± std over five random seeds). GT-CSAT consistently achieves the best robustness–accuracy trade-off across all three benchmarks.

Dataset	Method	CA (%)	RA (%)	FNR (%)	RAG (pp)
CICIDS-	Standard	99.6 ± 0.1	71.4 ± 1.5	26.1 ± 1.2	28.2
2017	AT-PGD	97.3 ± 0.3	86.8 ± 0.7	11.0 ± 0.8	10.5
	TRADES	97.7 ± 0.2	87.4 ± 0.6	10.5 ± 0.7	10.3
	GT-CSAT	97.3 ± 0.2	93.7 ± 0.5	3.5 ± 0.4	3.6
UNSW-	Standard	98.9 ± 0.2	68.7 ± 1.8	28.3 ± 1.4	30.2
NB15	AT-PGD	96.5 ± 0.3	84.2 ± 0.9	13.1 ± 0.8	12.3
	TRADES	96.8 ± 0.3	85.0 ± 0.7	12.4 ± 0.7	11.8
	GT-CSAT	96.4 ± 0.3	92.1 ± 0.5	4.4 ± 0.4	4.3

reports the results. GT-CSAT achieves 93.7% average robust accuracy on CICIDS-2017 and 92.1% on UNSW-NB15, with RAG values of 3.6 pp and 4.3 pp respectively—consistently outperforming all baselines. On CICIDS-2017, GT-CSAT surpasses AT-PGD by 6.9 pp in RA while maintaining comparable clean accuracy. On UNSW-NB15, which features a more heterogeneous attack distribution and noisier features, GT-CSAT still attains a RAG of 4.3 pp, substantially better than AT-PGD’s 12.3 pp. These cross-dataset results confirm that the game-theoretic cost adaptation mechanism and the co-trained conditional generator generalize effectively across diverse traffic distributions and attack taxonomies.

6. Conclusions and Future Works

This paper presented GT-CSAT, a novel adversarial training framework for cloud-based intrusion detection that jointly trains an attack-conditioned WGAN-GP threat generator and a deep residual IDS detector under a game-theoretic cost-sensitive loss function. By embedding asymmetric, dynamically adapted misclassification penalties derived from a two-player payoff structure into the adversarial training loop, GT-CSAT achieves a Pareto-superior robustness–accuracy trade-off compared to standard AT, TRADES, and GAN-based augmentation baselines. On the Cloud Vulnerabilities Dataset, GT-CSAT attains 94.3% average robust accuracy across six diverse evasion strategies while preserving 97.1% clean accuracy—a robustness–accuracy gap of only 2.8 percentage points, versus 9.4–26.5 pp for competing methods. Cross-dataset experiments on CICIDS-2017 and UNSW-NB15 further confirm the generalizability of these gains, with GT-CSAT achieving 93.7% and 92.1% average robust accuracy respectively.

6.1. Limitations

Several limitations warrant acknowledgment. First, the CVD, while cloud-specific, represents a simulated environment; adversarial robustness on live cloud traffic with encrypted payloads and dynamic feature distributions may differ quantitatively. Second, the GT-CSAT generator operates in feature space rather than packet space, meaning that the adversarial records it produces may not always be directly realizable as modified packets in a real network without additional protocol-space translation. Third, the Nash-inspired cost adaptation assumes a stationary two-player game; in reality, the attacker may employ non-stationary strategies or exploit knowledge of the defense mechanism, potentially breaking the convergence guarantee. Fourth, the generator’s training relies on access to labeled clean attack records; in a zero-shot or few-shot attack category setting, the conditional generation quality degrades and alternative approaches (such as meta-learning generators) would be needed. Fifth, training GT-CSAT requires approximately 2.1× the compute of AT-PGD; while inference overhead is zero, the training cost may limit retraining frequency in resource-constrained cloud edge deployments.

6.2. Future Directions

Several natural extensions emerge from this work. On the threat model side, extending the generator to operate in packet space—producing bit-level adversarial payloads that satisfy checksum and protocol-grammar constraints—would close the gap between feature-space and problem-space attacks. Incorporating multi-agent game-theoretic training, where multiple generators with diverse attack strategies compete simultaneously, could further enrich the coverage of the evasion manifold and improve generalization to unseen attack families. From the loss design perspective, replacing the two-player zero-sum formulation with a Stackelberg game in which the defender moves first and commits to a strategy could yield stronger theoretical guarantees on worst-case loss. Federated adversarial training across distributed cloud tenants—sharing adversarial examples rather than raw traffic records—offers a promising privacy-preserving extension that would leverage the collective attack intelligence of a multi-tenant cloud environment. Finally, the GTCS-Loss formulation is domain-agnostic and could be transferred to other high-stakes classification tasks where asymmetric misclassification costs and adversarial robustness are simultaneously critical, including medical diagnosis under distribution shift, fraud detection in financial systems, and autonomous vehicle perception under sensor spoofing.