A systematic literature review published in Cluster Computing has identified significant gaps in the current landscape of machine learning-based intrusion detection systems for cloud environments. The study, which screened publications from 2020 to 2025, analyzed 79 primary studies selected from an initial pool of 1,013 records. By mapping the attacks addressed in these studies to the MITRE ATT&CK Cloud Matrix, the researchers found that while many traditional network threats are well-covered, critical cloud-specific attack vectors remain largely unaddressed in current evaluations. This work serves as a comprehensive reference for understanding the alignment between academic research and real-world cloud security requirements.
The review was conducted following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework to ensure a transparent and reproducible selection process. The researchers searched five major indexing databases, including IEEE Xplore, Springer Link, Scopus, ACM Digital Library, and Web of Science. Inclusion criteria focused on peer-reviewed articles that employed supervised, unsupervised, or hybrid machine learning approaches for intrusion detection in cloud computing. The study explicitly excluded traditional statistical methods and non-peer-reviewed sources to maintain a focus on modern machine learning techniques.
To organize the findings, the authors proposed a taxonomy that classifies existing research into three analytical perspectives: performance optimization, learning and adaptation, and environment-aware design. The performance optimization perspective includes studies that use nature-inspired algorithms or lightweight architectures to improve detection efficiency. The learning and adaptation perspective covers methods such as federated learning and anomaly detection that allow systems to respond to evolving threat patterns. The environment-aware perspective focuses on designs tailored to specific cloud layers, such as hypervisor-based or multi-cloud intrusion detection systems.
The analysis revealed a strong concentration of research in traditional machine learning and nature-inspired optimization categories. Specifically, 25 studies focused on traditional machine learning-based intrusion detection, while 20 studies utilized nature-inspired optimization algorithms. In contrast, emerging areas such as federated learning, adversarial-resilient systems, and multi-cloud detection remained comparatively underexplored, with only four to five studies in each of these categories. This distribution suggests that while improving detection efficiency remains a dominant priority, the field has not yet fully embraced the complexities of distributed and adversarial cloud environments.
A significant methodological finding of the review is the heavy reliance on supervised learning approaches. Approximately 74.7% of the reviewed studies employed supervised machine learning methods, whereas only 3.8% utilized unsupervised learning. This imbalance indicates a strong focus on labeled attack scenarios, which may limit the ability of current systems to detect zero-day or previously unseen threats. The authors noted that the wide availability of labeled datasets drives this trend, but it leaves a methodological gap in detecting novel behaviors that fall outside predefined training sets.
The datasets used in these studies also present a major limitation for real-world applicability. The review found that 26 studies relied on the NSL-KDD dataset, a legacy benchmark that lacks comprehensive depictions of contemporary cloud-specific attack patterns. Other frequently used datasets, such as KDDCup99 and CICIDS2017, were also developed before the emergence of modern cloud-native threats. The authors observed that models evaluated on these legacy benchmarks often report extremely high accuracy values, which may not translate to effective performance in dynamic, real-world cloud environments with heterogeneous traffic and complex infrastructure.
To bridge the gap between academic research and industry standards, the study mapped the identified attacks to the MITRE ATT&CK Cloud Matrix. This framework provides a structured representation of adversary tactics, techniques, and procedures in cloud environments. The mapping revealed that studied attacks cluster around tactics such as Initial Access, Execution, and Impact. However, cloud-relevant tactics including Persistence and Collection received no attention across the reviewed studies. This lack of representation suggests that current intrusion detection research is not adequately preparing for post-compromise behaviors that are critical to modern cloud security.
The mapping process required careful behavioral alignment because most legacy datasets do not include native MITRE ATT&CK technique labels. The researchers matched attack types to the matrix based on their underlying adversarial behavior and operational goals. For example, denial-of-service attacks were mapped to the Impact tactic, while SQL injection was aligned with the Initial Access tactic. This approach allowed the authors to interpret legacy benchmark attacks within a contemporary cloud-security threat model, highlighting which adversarial behaviors are well-represented and where significant detection gaps remain.
The study also identified a research bias toward network-based intrusion detection systems. Approximately 77.6% of the reviewed work focused on network-level traffic monitoring, while host-based intrusion detection systems appeared in only about 11.8% of the studies. Given that cloud environments rely heavily on virtualization and containerized workloads, the authors argue that host-level monitoring is essential for comprehensive security coverage. The limited attention to host-based detection represents a critical gap in ensuring that threats within the virtualization layer are effectively identified and mitigated.
Furthermore, the review highlighted the insufficient attention to adversarial attacks, which are increasingly prevalent in modern cloud environments. Only a limited number of studies explicitly addressed adversarial robustness, such as the ability to resist evasion or poisoning attacks against machine learning models. The authors emphasized that the effectiveness of an intrusion detection system in the real world depends largely on its resilience against such adversarial tactics. Future research must therefore develop detection models that can maintain accuracy even when attackers attempt to manipulate or mislead the system.
Based on these findings, the authors outlined several directions for future research. They recommended the development of cloud-native benchmark datasets that include multi-stage attack chains and multi-layered telemetry types, such as hypervisor events and cloud audit logs. These datasets should explicitly cover MITRE-defined tactics that are currently unmapped, such as Persistence and Collection. Additionally, the study suggested exploring the potential of large language models to augment intrusion detection by semantically interpreting unstructured security data and correlating events across multiple cloud layers.
The systematic review provides a clear roadmap for aligning academic research with industrial security standards. By identifying the specific gaps in attack coverage and dataset limitations, the study offers a foundation for developing more robust and adaptable intrusion detection systems. As cloud computing continues to evolve, the need for detection methods that can handle the complexity and scale of modern distributed infrastructures becomes increasingly urgent. This work underscores the importance of moving beyond legacy benchmarks to address the full spectrum of cloud-specific security threats.
Beyond high-level categories, the review detailed the distribution of underlying algorithmic architectures across the literature. Pure machine learning techniques accounted for nearly 52 percent of examined approaches, while deep learning architectures made up 29 percent, and hybrid frameworks represented the remaining 19 percent. Among deep learning designs, convolutional neural networks appeared most frequently across 11 studies, followed by long short-term memory networks in nine studies, deep neural networks in six studies, and reinforcement learning in six studies. Advanced variants also surfaced within optimization pipelines, including bidirectional long short-term memory paired with adaptive rat swarm optimization, horse herd optimization pipelines, and improved squirrel search algorithms linked to modified deep belief networks.
The study also mapped specific adversarial techniques to granular MITRE ATT&CK categories. Under initial access, SQL injection aligned with exploiting public-facing applications, cross-site scripting mapped to drive-by compromise, and account hijacking corresponded to valid accounts. In execution, hypervisor-jacking mapped to command and scripting interpreter interfaces, specifically hypervisor command-line tools, as well as cloud administration commands. For credential access, brute-force attacks corresponded to standard brute-force techniques, side-channel attacks aligned with unsecured credentials, and Heartbleed exploits mapped to exploitation for credential access. Discovery activities such as port scanning and fuzzing reflected network service discovery, while inference attacks mapped to account discovery. In lateral movement, worm-based and secure shell exploits aligned with remote services, whereas data theft via file transfer protocol and web requests mapped to exfiltration over alternative protocols and web services.
The authors contextualized these technical findings within broader cloud infrastructure challenges and operational impacts. They emphasized that distinct cloud service models introduce divergent vulnerability profiles, ranging from configuration errors in infrastructure as a service to vulnerable application programming interfaces in platform as a service and data leakage risks in software as a service. These vulnerabilities contributed to substantial real-world incidents, such as the 2024 Snowflake multi-cloud breach and exploitation of Amazon Web Services load balancers, occurring against a backdrop where the global average data breach cost reached $4.88 million in 2024. To guarantee rigorous evidence synthesis, the authors evaluated their own review using five quantitative quality criteria, attaining a maximum score of 5 out of 5, while simultaneously scoring all 79 included primary studies across five methodological quality criteria evaluating objectives, methodological descriptions, dataset transparency, evaluation metrics, and comparative baseline validations.
Methodological analysis of experimental evaluations further showed that dataset selection heavily skews reported detection performance. The review noted that studies relying on static legacy datasets consistently achieve ceiling-level accuracy scores, yet these figures reflect within-dataset effectiveness rather than real-world operational capability. As a concrete example of this discrepancy, the authors cited an evaluation where an identical sequence-to-sequence detection model achieved 98.2 percent accuracy on a multi-domain benchmark but fell to 94.2 percent when evaluated against mixed log data containing CSE-CIC-IDS2018 and LogHub traces. Because the underlying model and experimental pipeline remained constant, the performance divergence demonstrated that reported detection capabilities often depend on dataset idiosyncrasies rather than actual model efficacy across modern cloud architectures.
Subject of Research: Machine learning-based cloud IDS: a systematic literature review and MITRE ATT&CK mapping
Article Title: Machine learning-based cloud IDS: a systematic literature review and MITRE ATT&CK mapping
Article References: Ali, S. W., Shah, I. A., Zahid, F., Munir, D., Syed, I., & Hossain, M. A. (2026). Machine learning-based cloud IDS: a systematic literature review and MITRE ATT&CK mapping. Cluster Computing, 29(16), Article 920. https://doi.org/10.1007/s10586-026-06730-5
Image Credits: AI Generated
DOI: 10.1007/s10586-026-06730-5
Keywords: Machine, learning-based, cloud, systematic, literature, review, MITRE, mapping, scientific research
News Source: Denise Maddox. (November 9, 2026). Review Finds Gaps in Cloud Intrusion Detection Research. Scienmag.
