Performance And Efficiency Analysis Of Lightweight Intrusion Detection Models For Cloud Microservices

Abdullah Albalawi

doi:10.29284/nk1jps71

Authors

Abdullah Albalawi Department of Computer Science, College of Computing and Information Technology, Shaqra University, Shaqra, Saudi Arabia

DOI:

https://doi.org/10.29284/nk1jps71

Keywords:

intrusion detection system, cloud security, microservices architecture, lightweight machine learning, performance-efficiency trade-off

Abstract

Cloud computing and microservices have revolutionized contemporary application development and deployment. Modern application architecture ensures scalability, reliability, and quick development. However, cloud computing expands cloud infrastructure vulnerability. Network-related threats, such as distributed denial-of-service, port scanning, brute force authentication, and hacking, remain common cloud threats in a microservices setup. The Intrusion Detection System (IDS) has a critical role to play in securing cloud infrastructure. Yet, most intrusion detection systems in use today rely on machine-learning and deep-learning techniques, which remain highly computation-intensive, contradictory to cloud-native application services. This paper examines whether lightweight machine learning models can meet intrusion detection requirements without imposing prohibitive overhead. Using the CICIDS2017 dataset, eight multi-day traffic files are merged and pre-processed to produce a large-scale, realistic, and class-imbalanced dataset. Lightweight linear classifiers are evaluated against a Random Forest baseline, with performance assessed through standard detection metrics accuracy, precision, recall, and F1-score together with training time and analysis using confusion matrices and performance-efficiency visualizations. The results show that Random Forest delivers near-perfect detection but at a computational cost that limits deployability in microservices environments. Lightweight linear models achieve comparable detection performance with substantially lower training time and resource consumption; Logistic Regression offers the most consistent balance between accuracy and F1-score, while SGDClassifier excels in efficiency and scalability. These findings establish lightweight IDS models as a practical and scalable alternative to heavyweight ensemble approaches for securing cloud microservices.

References

[1]. Mukkamala, S., Sung, A. H., & Abraham, A., Intrusion detection using ensemble of soft computing paradigms. Journal of Network and Computer Applications, 28(2), 167–182, 2005.

[2]. Sabhnani, M. & Serpen, G., Application of machine learning algorithms to KDD intrusion detection dataset. Proc. IEEE Int. Conf. Machine Learning and Applications, Los Angeles, CA, USA, 209–215, 2003.

[3]. Breiman, L., Random forests. Machine Learning, 45(1), 5–32, 2001.

[4]. Zhang, J. & Zulkernine, M., Anomaly based network intrusion detection with unsupervised outlier detection. Proc. IEEE Int. Conf. Communications, Istanbul, Turkey, 2388–2393, 2006.

[5]. Buczak, A. L. & Guven, E., A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176, 2016.

[6]. Chen, T. & Guestrin, C., XGBoost: A scalable tree boosting system. Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, San Francisco, CA, USA, 785–794, 2016.

[7]. Yin, C., Zhu, Y., Fei, J., & He, X., A deep learning approach for intrusion detection using recurrent neural networks. IEEE Access, 5, 21954–21961, 2017.

[8]. Kim, G., Lee, S., & Kim, S., A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Systems with Applications, 41(4), 1690–1700, 2014.

[9]. Tang, T., Mhamdi, Z., McKeown, D., & Krishnamachari, B., Deep learning approach for network intrusion detection in software defined networking. IEEE Wireless Communications, 27(4), 90–97, 2020.

[10]. Ahmed, M., Mahmood, A. N., & Hu, J., A survey of network anomaly detection techniques. Journal of Network and Computer Applications, 60, 19–31, 2016.

[11]. Shone, N., Ngoc, T. N., Phai, V. D., & Shi, Q., A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), 41–50, 2018.

[12]. Crammer, K., Dekel, O., Keshet, J., Shalev-Shwartz, S., & Singer, Y., Online passive-aggressive algorithms. Journal of Machine Learning Research, 7, 551–585, 2006.

[13]. Powers, D. M. W., Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. Journal of Machine Learning Technologies, 2(1), 37–63, 2011.

[14]. Chawla, N. V., Bowyer, K. W., Hall, L. O., & Kegelmeyer, W. P., SMOTE: Synthetic minority over-sampling technique. Journal of Artificial Intelligence Research, 16, 321–357, 2002.

[15]. Conti, M., De Cristofaro, E., Prasad, R. R., & Crispo, B., A survey on security and privacy issues of cloud computing. IEEE Communications Surveys & Tutorials, 20(1), 107–131, 2018.