SCALED-IDS: A Deep Semantic Class-Aware Layered Framework for Multiclass Intrusion Detection in Cloud-IoT Environments

Ramya K. M.; Rajashekhar C. Biradar

doi:10.48084/etasr.12379

Authors

Ramya K. M. REVA University, Bangalore, India | B.M.S. College of Engineering, Bull Temple Road, Bengaluru -560019, KA, India
Rajashekhar C. Biradar REVA University, Bangalore, India

Volume: 15 | Issue: 6 | Pages: 28411-28419 | December 2025 | https://doi.org/10.48084/etasr.12379

Received: 26 May 2025 | Revised: 17 July 2025 | Accepted: 27 July 2025 | Online: 8 December 2025

Corresponding author: Ramya K. M.

Abstract

The growing adoption of cloud-enabled Internet of Things (IoT) systems has introduced new layers of complexity and vulnerability in network security. With billions of interconnected devices generating vast amounts of traffic, traditional Intrusion Detection Systems (IDSs) often fall short, particularly when tasked with identifying diverse and evolving attack types in real time. Existing solutions, whether rule-based or machine learning-driven, struggle with issues such as class imbalance, limited adaptability, and reduced accuracy when exposed to high-dimensional and dynamic data streams. To address these challenges, this paper presents SCALED-IDS, a deep learning-based framework specifically designed for multiclass intrusion detection in cloud-integrated IoT environments. The proposed model introduces a modular architecture that combines semantic understanding and class-aware learning. At its core, the Multi-Stage Attention Representation Extractor (MARE) captures semantic relationships within network traffic using multi-head attention mechanisms. This is followed by Class-Aware Focused Embeddings (CAFE), which guide the decoding process based on class-specific characteristics, improving the detection of rare or underrepresented attack types. The Class-Level Attention Decoder (CLAD) further enhances performance by breaking down the classification task into progressive layers, refining decisions across dominant and minority classes. The effectiveness of SCALED-IDS is demonstrated through experiments on two publicly available datasets, BoT-IoT and CIC-IoT 2023. The results show that the proposed model consistently outperforms existing methods in terms of accuracy, F1-score, and recall, particularly in identifying complex and low-frequency attack classes.

Keywords:

multiclass intrusion detection, cloud-IoT environments, deep learning framework, Multi-stage Attention Representation Extractor (MARE), Class-Aware Focused Embeddings (CAFE)

Downloads

Download data is not yet available.

References

H. Sadia et al., "Intrusion Detection System for Wireless Sensor Networks: A Machine Learning Based Approach," IEEE Access, vol. 12, pp. 52565–52582, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3380014

A. Binbusayyis, "Innovative Defense: Deep Learning-Powered Intrusion Detection for IoT Networks," IEEE Access, vol. 13, pp. 31105–31120, 2025. DOI: https://doi.org/10.1109/ACCESS.2025.3542275

S. U. Jan, S. Ahmed, V. Shakhov, and I. Koo, "Toward a Lightweight Intrusion Detection System for the Internet of Things," IEEE Access, vol. 7, pp. 42450–42471, 2019. DOI: https://doi.org/10.1109/ACCESS.2019.2907965

V. Gaur and R. Kumar, "Analysis of Machine Learning Classifiers for Early Detection of DDoS Attacks on IoT Devices," Arabian Journal for Science and Engineering, vol. 47, no. 2, pp. 1353–1374, Feb. 2022. DOI: https://doi.org/10.1007/s13369-021-05947-3

Kamaldeep, M. Malik, and M. Dutta, "Feature Engineering and Machine Learning Framework for DDoS Attack Detection in the Standardized Internet of Things," IEEE Internet of Things Journal, vol. 10, no. 10, pp. 8658–8669, Feb. 2023. DOI: https://doi.org/10.1109/JIOT.2023.3245153

Ismail et al., "A Machine Learning-Based Classification and Prediction Technique for DDoS Attacks," IEEE Access, vol. 10, pp. 21443–21454, 2022. DOI: https://doi.org/10.1109/ACCESS.2022.3152577

S. Sadhwani, B. Manibalan, R. Muthalagu, and P. Pawar, "A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques," Applied Sciences, vol. 13, no. 17, Jan. 2023, Art. no. 9937. DOI: https://doi.org/10.3390/app13179937

W. Sheng and J. Zhigang, "IDS classification algorithm based on fuzzy SVM models," Application Research of Computers, vol. 37, no. 2, 2018.

J. Gu and S. Lu, "An effective intrusion detection approach using SVM with naïve Bayes feature embedding," Computers & Security, vol. 103, Apr. 2021, Art. no. 102158. DOI: https://doi.org/10.1016/j.cose.2020.102158

B. Mahbooba, M. Timilsina, R. Sahal, and M. Serrano, "Explainable Artificial Intelligence (XAI) to Enhance Trust Management in Intrusion Detection Systems Using Decision Tree Model," Complexity, vol. 2021, no. 1, 2021, Art. no. 6634811. DOI: https://doi.org/10.1155/2021/6634811

W. W. Lo, S. Layeghy, M. Sarhan, M. Gallagher, and M. Portmann, "E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT," in NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, Budapest, Hungary, Apr. 2022, pp. 1–9. DOI: https://doi.org/10.1109/NOMS54207.2022.9789878

L. Chang and P. Branco, "Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms." arXiv, Nov. 26, 2021.

X. Deng, J. Zhu, X. Pei, L. Zhang, Z. Ling, and K. Xue, "Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks," IEEE Transactions on Network and Service Management, vol. 20, no. 1, pp. 684–696, Mar. 2023. DOI: https://doi.org/10.1109/TNSM.2022.3213807

G. Duan, H. Lv, H. Wang, and G. Feng, "Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning," IEEE Transactions on Information Forensics and Security, vol. 18, pp. 699–714, 2023. DOI: https://doi.org/10.1109/TIFS.2022.3228493

X. Hu, W. Gao, G. Cheng, R. Li, Y. Zhou, and H. Wu, "Toward Early and Accurate Network Intrusion Detection Using Graph Embedding," IEEE Transactions on Information Forensics and Security, vol. 18, pp. 5817–5831, 2023. DOI: https://doi.org/10.1109/TIFS.2023.3318960

H. Nguyen and R. Kashef, "TS-IDS: Traffic-aware self-supervised learning for IoT Network Intrusion Detection," Knowledge-Based Systems, vol. 279, Nov. 2023, Art. no. 110966. DOI: https://doi.org/10.1016/j.knosys.2023.110966

S. Huan et al., "T-Shaped CAN Feature Integration With Lightweight Deep Learning Model for In-Vehicle Network Intrusion Detection," IEEE Transactions on Intelligent Transportation Systems, vol. 25, no. 12, pp. 21183–21196, Dec. 2024. DOI: https://doi.org/10.1109/TITS.2024.3478371

F. S. Alrayes, N. Nemri, N. Aljaffan, A. Alshuhail, A. A. Alhashmi, and A. Mahmud, "Distributed Multiclass Cyberattack Detection Using Golden Jackal Optimization With Deep Learning Model for Securing IoT Networks," IEEE Access, vol. 12, pp. 132434–132443, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3443202

U. C. Akuthota and L. Bhargava, "Transformer-Based Intrusion Detection for IoT Networks," IEEE Internet of Things Journal, vol. 12, no. 5, pp. 6062–6067, Mar. 2025. DOI: https://doi.org/10.1109/JIOT.2025.3525494

M. Huang, Y. Lin, N. Li, X. Chen, and E. Bertino, "CARD: Robustness-Preserving Transfer Learning for Network Intrusion Detection via Contrastive Adversarial Representation Distillation," IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 5, pp. 5134–5151, Sep. 2025. DOI: https://doi.org/10.1109/TDSC.2025.3562600

N. Koroniotis, N. Moustafa, E. Sitnikova, and J. Slay, "Towards Developing Network Forensic Mechanism for Botnet Activities in the IoT Based on Machine Learning Techniques," in Mobile Networks and Management, vol. 235, J. Hu, I. Khalil, Z. Tari, and S. Wen, Eds. Springer International Publishing, 2018, pp. 30–44. DOI: https://doi.org/10.1007/978-3-319-90775-8_3

N. Koroniotis, N. Moustafa, and E. Sitnikova, "A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework," Future Generation Computer Systems, vol. 110, pp. 91–106, Sep. 2020. DOI: https://doi.org/10.1016/j.future.2020.03.042

N. Koroniotis and N. Moustafa, "Enhancing network forensics with particle swarm and deep learning: The particle deep framework." arXiv, May 02, 2020. DOI: https://doi.org/10.5121/csit.2020.100304

N. Koroniotis, N. Moustafa, F. Schiliro, P. Gauravaram, and H. Janicke, "A Holistic Review of Cybersecurity and Reliability Perspectives in Smart Airports," IEEE Access, vol. 8, pp. 209802–209834, 2020. DOI: https://doi.org/10.1109/ACCESS.2020.3036728

E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, "CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment," Sensors, vol. 23, no. 13, Jan. 2023, Art. no. 5941. DOI: https://doi.org/10.3390/s23135941

V. Borisov, J. Haug, and G. Kasneci, "CancelOut: A Layer for Feature Selection in Deep Neural Networks," in Artificial Neural Networks and Machine Learning – ICANN 2019: Deep Learning, 2019, pp. 72–83. DOI: https://doi.org/10.1007/978-3-030-30484-3_6

A. Ghorbani and S. M. Fakhrahmad, "A Deep Learning Approach to Network Intrusion Detection Using a Proposed Supervised Sparse Auto-encoder and SVM," Iranian Journal of Science and Technology, Transactions of Electrical Engineering, vol. 46, no. 3, pp. 829–846, Sep. 2022. DOI: https://doi.org/10.1007/s40998-022-00498-1

I. A. Nellas, S. K. Tasoulis, V. P. Plagianakos, and S. V. Georgakopoulos, "Supervised Dimensionality Reduction and Image Classification Utilizing Convolutional Autoencoders." arXiv, Nov. 03, 2022.

D. Bian and J. Liu, "GMCWAE: A Representation Learning Technique for Network Intrusion Detection in IoT," IEEE Internet of Things Journal, vol. 12, no. 12, pp. 20343–20356, Jun. 2025. DOI: https://doi.org/10.1109/JIOT.2025.3542845