Blockchain espoused recalling-enhanced recurrent neural network with fractional discrete meixner moments encryption for cyber security in cloud computing

Abstract

Cybersecurity in cloud computing has become increasingly challenging due to the sophistication of cyber-attacks that target the confidentiality, integrity, and availability of data. Conventional intrusion detection and encryption approaches suffer from high false alarm rates, weak adaptability to emerging threats, heavy computational costs, and limited scalability in real-world deployments. Addressing these limitations, this paper proposes a novel framework that integrates a Recalling-Enhanced Recurrent Neural Network (RERNN) for accurate intrusion classification, Fractional Discrete Meixner Moments Encryption (FDMME) for efficient and robust data protection, and a Direct Acyclic Graph (DAG)-based blockchain for scalable, tamper-proof storage. Preprocessing is carried out using Z-score normalization to handle missing and duplicate values, followed by Entropy–Kurtosis-based feature selection to enhance data quality and reduce dimensionality. Using the NSL-KDD benchmark dataset, the proposed model achieves high detection performance with 98.79% accuracy, 98.78% precision, 98.56% sensitivity, and a Cohen's Kappa value of 98.53%. The false positive rate (0.0144) and false negative rate (0.0025) remain exceptionally low, reducing both false alarms and missed detections. Latency analysis demonstrates near real-time performance with an average processing time of 295 ms, while scalability testing indicates blockchain storage growth from 160 GB to 480 GB and off-chain storage from 15 TB to 45 TB over three years. These findings establish that the proposed RERNN-FDMME-BC-CC framework not only improves classification accuracy and encryption strength but also ensures practical feasibility for deployment in dynamic cloud environments, making it a promising solution for modern cybersecurity challenges.

Keywords

Cyber security cloud computing environment NSL-KDD benchmark dataset z-score normalization entropy– kurtosistechnique recalling-Enhanced recurrent neural network fractional discrete meixner moments encryption technique direct acyclic graph

1. Introduction

Dependence lack in common virtualized infrastructure structured in cloud environments is the greatest disability of security in decentralized applications.¹ Cyber-attacks by malicious nature, such as DDoS, ransomware, attack cloud-based platforms, triggers accessibility features of platforms and cloud computing networks.² This type of mounting attacks in complexity and complication, leading to unorganized significances which undermines availability, data integrity, and confidentiality.³ Ability to recognize and respond to such attacks focuses necessary adjustment in improved cloud services.⁴ Evasion of intrusion and detection systems is typically structured for identifying those erudite attacks from cloud system endpoints, limiting the organization of distributed intrusion and detection systems allow the associate occurrence of warnings in security.⁵ Cloud network systems notwithstanding erudite attack impact boosted by the incidence of blockchain.⁶ The attackers misuse cryptocurrency systems and boost over partial global mining hash rate.⁷ Attackers misused all systems of cryptocurrency and achieve additional half of entire global mining hash rate.⁸ This vulnerability enabled attackers to drain double transactions which later pretended integrity of entire system of network.⁹ Blockchain is utilized in many areas to support privacy of information, intelligence of allowing members to exchange communications and give statistics while maintaining conviction level, trustworthiness and enhanced transparency.^10,11 Alternatively, use of blockchain has accounted for behind business amenities such as digital currency.¹² History of data sharing stored in immutable audit trails that assessed by clandestinely hosted by cloud providers.¹³ NIDS placed in infrastructure layer of cloud networks for monitoring traffic in network system.¹⁴ It could anticipate direct flooding, indirect flooding, port-scanning attacks, backdoor and malicious malware activities.^15,16 NSL-KDD benchmark dataset¹⁷ is most common dataset used. Providing security for cloud deployments has always been a perilous endeavor.¹⁸

Various approaches were given for security management in cloud computing environment.^19,20 However, they are insufficient to provide security to the data which is stored and also some malicious hackers will steal the data from the cloud.^21,22 Current approach does not make the cloud data secure and does not classify the attacks correctly. A solution is needed to address these problems, and this encouraged to conduct this research work.²³ This paper presents a novel cybersecurity framework that integrates Blockchain, Recalling-Enhanced Recurrent Neural Networks (RERNN), and Fractional Discrete Meixner Moments Encryption (FDMME) to secure cloud environments. While previous works have explored the individual applications of these techniques, our approach is unique in combining these methods to address the challenges of real-time intrusion detection, data confidentiality, and scalable security in cloud computing. By leveraging Blockchain for tamper-proof storage, RERNN for attack classification, and FDMME for encryption, the proposed system provide a comprehensive solution to the evolving cybersecurity needs of cloud systems.

In this paper, Blockchain advocated RecallingEnhanced Recurrent Neural Network with Fractional Discrete Meixner Moments encryption for Cyber security in Cloud Computing Environment is recommended. Z-score normalization method is utilized for pre-processing to remove duplicate data and to clean missing values. Then pre-processed data is provided to Entropy–Kurtosis based feature selection method for selecting best features. With this, the quality and reliability of data can be enhanced. For enhancing data security, FDMME algorithm for encryption and decryption is employed to secure cloud data. DAG based blockchain approach is suggested to enhance the cyber security.²⁴

Existing cybersecurity solutions in cloud environments show critical gaps. IDS models struggle with high false positives and poor adaptability to zero-day attacks, while blockchain systems face scalability and latency issues. Encryption methods provide confidentiality but incur heavy computation costs. These limitations highlight the need for an integrated framework that ensures accuracy, efficiency, and secure scalability.

The novelty of this work lies in the unified RERNN–FDMME–BC–CC framework, which simultaneously enhances intrusion detection, encryption, and blockchain scalability. Unlike existing models that address these challenges separately, our approach uniquely combines RERNN for accurate classification, FDMME for lightweight yet secure encryption, and DAG-based blockchain for scalable, low-latency storage, offering an end-to-end cybersecurity solution for cloud environments.

Key contributions of this manuscript are as follows:

Blockchain advocated Recalling-Enhanced Recurrent Neural Network with Fractional Discrete Meixner Moments encryption for Cyber security in Cloud Computing Environment is presented RERNN-FDMME-BC-CC.

Nrmalization technique is applied for pre-processing to remove missing values and duplicate data.

Pre-processed data is then provided to Entropy–Kurtosis based feature selection to get best features. Based on this, data quality and reliability can be enhanced.

Optimum feature based, the data are classified as Back, Ipsweep, Neptune, Normal, Satan and Smurf using RERNN.

Fractional Discrete Meixner Moments encryption technique is utilized for encryption and decryption to enhance data security.

Direct Acyclic Graph based blockchain approach is proposed to improve cyber security.

Proposed RERNN- FDMME -BC-CC approach is simulated in Python tool.

Performance measures, including F-Score, sensitivity, precision, accuracy, specificity, AUC, FPR is analyzed.

1.1 Objective

Obtain normal and attack traffic compositions pertinent to cloud computing cybersecurity using input data collection with NSL-KDD benchmark dataset.

Preprocess collected data using Z-score normalization to remove missing values and remove duplicate records for enhancing data quality.

Secure cloud data by encrypting and decrypting using the Fractional Discrete Meixner Moments Encryption (FDMME) technique.

Boost cybersecurity in cloud platform by using Direct Acyclic Graph based blockchain approach for secure data transmission.

1.2 Structure of paper

Paper is organised in five sections. The introduction (Section 1) provides systematic motivation, background, and issues associated with the need to ensure cybersecurity in cloud computing scenarios by stating that current models lack anything in this field and further sophisticated methods are needed. In section 2 (Related Works), the recent progress in deep learning, encryption and block-chain-based cybersecurity models are critically reviewed to determine potential gaps in which the proposed framework should help fill. Section 3 (Proposed Methodology) describes the entire pipeline of the envisioned RERNN-FDMME-BC-CC framework which entails the acquisition of data via NSL-KDD dataset, preprocessing of raw data via Z-score normalization, optimal feature selection via EntropyKurtosis based approach, classification of the attack types via Recalling-Enhanced-Recurrent Neural Network technique, Confidentiality of the data via the Fractional Discrete Meixner Moments Encryption technique, and Enhance Results and Discussion section between sections 4 provides a thorough assessment of proposed model using a wide range of performance parameters, namely accuracy, precision, recall, specificity, F-score and false negative rate, as well as confusion matrices. It also contains experimental results on execution time and inference latency, memory required and memory overhead added by FDMME and blockchain components and its measurement of vendors in the form of scalability and robustness tests of the system when faced with different network resource needs, noisy data and adversarial condition, all at the aim of measuring feasibility of real-world applicability of the solution. Section 5 (conclusion) gives summary of major findings including effectiveness and practical implications.

2. Related works

Alkadi et al.²⁵ presented blockchain based intrusion detection framework to protect cloud environment. BiLSTM was utilized to detect intrusion system. Blockchain was improved in order to provide secrecy to disseminated intrusion detection system by offering it for secrecy in front of it. Method has the potential to support decision system that helps end user as well as cloud suppliers shifting their records in proper time. It provides increased specificity with lower precision.

Saveetha et al.²⁶ have presented blockchain based intrusion detection model with deep learning method to identify security attacks. Design a deep learning enabled intrusion detection system with the perspective of integrating blockchain technology by means of intrusion detection, inspired by correlating blockchain across entire domains. It supports improved accuracy in detecting the security attacks at lower recall.

Velmurugadass et al.²⁷ have envisioned to develop blockchain security in cloud computing with IoT environment based on “Elliptic Curve Integrated Encryption Scheme” and “cryptography hash algorithm”. Cloud-based software-defined network is composed of mobile Nodes, open flow switch, blockchain base controllers, cloud server, Authentication Server, investigator. All users were authenticated with authentication server and they received their secret key from authentication server under harmony search optimization. In the mobile nodes, packets were encrypted with ECIES and are sent to the cloud server. It provides greater sensitivity with lesser precision.

Rabbani et al.²⁸ presented hybrid method for detection of malicious attacks in cloud computing. For the detection and identification of attack in cloud environment, probabilistic neural network was used with particle swarm optimization. In the process of recognition, expressively transformed the activities of users into understandable form and predicted the malicious actions using multi-layer neural network. It shows higher accuracy with low recall.

Gopalakrishnan et al.²⁹ developed DL based cyber-attack detection in mobile edge computing systems. Approach involves three major contributions that are traffic detection, data offloading, and attack prediction. To begin with, the process of data offloading was facilitated through the use of traffic detection using BiLSTM. Adaptive sampling cross entropy (ASCE) approach was employed to improve the throughput of the network system. DBN enhanced by applying a barnacle mating optimization technique for the detection of the cyberattacks in MEC. It provides lower accuracy in attacks with higher specificity.

Rathore et al.³⁰ introduced blockchain-base deep learning model for cyber secure detection. DeepBlockIoTNet safeguarded deep learning approach based on blockchain for IoT network, where deep learning process was obtained among the edge nodes in decentralized edge layer. Blockchain system ensured secured deep learning process and prevents the control of centralized authority. It provides improved accuracy with optimal rate of false negative.

Hariharan et al.³¹ discussed Cybersecurity anomaly detection based on machine learning technique. Generic approach starts with recovering set of mixed classes of cybersecurity data by utilizing adaptive search, earlier running various machine learning algorithms for data processing which are Isolation Forest, Histogram-Based Outlier Score, Cluster-Based Local Outlier Factor and K-Means Clustering. It provides less precision with increased specificity. Basani et al.³² reviewed the role of AI, particularly machine learning and deep learning, in strengthening cybersecurity resilience. Building on this foundation, the current paper proposes an integrated RERNN–FDMME–Blockchain framework for accurate intrusion detection, secure encryption, and scalable cloud security.

Recent works have applied reinforcement learning to adaptively respond to evolving cyber-attacks and federated learning to build collaborative intrusion detection without centralizing sensitive data. While these methods improve adaptability and privacy, they face scalability and communication overhead issues. The proposed RERNN–FDMME–BC–CC framework complements these advances by combining accurate classification, lightweight encryption, and scalable blockchain storage.

Prior approaches show notable gaps: low recall leading to missed intrusions, high false positives reducing trust, scalability limits from chain-based blockchains, weak or costly encryption schemes, and lack of real-time validation. Our RERNN-FDMME-BC-CC model addresses these by improving accuracy, minimizing FPR, enabling scalable DAG-based storage, ensuring robust encryption, and supporting near real-time deployment.

To provide a structured comparison, the major related works in terms of datasets, performance metrics, and encryption or security methods. Alkadi et al. [employed the NSL-KDD dataset with a BiLSTM-based IDS and blockchain for storage, achieving 97.26% accuracy but suffering from high false positives due to limited adaptability. Saveetha et al. used the CICIDS2017 dataset with an LSTM–RNN integrated with blockchain, which reached 96.12% accuracy; however, the model showed weaker adaptability to emerging attack types. Velmurugadass et al. focused on IoT environments, applying ECIES with hash algorithms, but despite strong encryption, the intrusion detection accuracy was only 51%, highlighting poor classification ability. Rabbani et al. proposed a hybrid neural network with particle swarm optimization for cloud security, obtaining good accuracy but low recall, indicating a tendency to miss intrusions. In contrast, our proposed RERNN–FDMME–BC–CC framework, also validated on the NSL-KDD dataset, achieves 98.79% accuracy, 98.78% precision, and 98.56% sensitivity. Unlike prior works, it uniquely combines a Recalling-Enhanced RNN for robust classification, FDMME for lightweight but strong encryption, and a DAG-based blockchain for scalable storage, thereby addressing both detection performance and data confidentiality in dynamic cloud environments.

3. Methodology

Blockchain espoused Recalling-Enhanced RNN with Fractional Discrete Meixner Moments encryption is proposed for Cyber security in Cloud Computing Environment.

Brief discussion concerning Blockchain based Recalling-Enhanced Recurrent Neural Network with Fractional Discrete Meixner Moments encryption for Cyber security in Cloud Computing Environment are given below. Figure 1 expresses block diagram of proposed RERNN-FDMME-BC-CS-CC technique.

Figure 1.

Proposed RERNN-FDMME-BC-CS-CC Method.

3.1. Data acquisition

Initially, input data is gathered via dataset of NSL-KDD. This is the modern form of KDD’99 database. It offers traffic compositions and intrusion data. It contains normal data and attack data. The NSL-KDD dataset, though based on older attack patterns, remains a widely accepted benchmark in cybersecurity research for evaluating intrusion detection systems. the dataset were used for comparative analysis due to its extensive use in existing literature. However, the newer datasets, such as CICIDS and UNB ISCX, better reflect modern attack techniques. Future experiments will incorporate these datasets to evaluate the robustness and adaptability of our proposed model in more realistic, up-to-date settings.

3.2 Pre-processing using Z-score normalization

Pre-processing of the input data Z-score normalization takes place. It involves three procedures, namely crisp data conversion, splitting and normalization. Covered discussion on these steps are as follows: First input data goes into crisp data conversion. A Transmission Control Protocol and an Internet Control Message Protocol are included in crisp data as certain data containing string. In addition, system does not process these string values but string values are exchanged as numbers. Other information is designated as figures and it is referred to as conversion of crisp data. Crisp data will be divided into attack type such as Back, Ipsweep, Neptune, Normal, Satan and Smurf. Preprocessing of data: a split data is preprocessed with Z-score Normalization. It delivers normalized values or range of input data from original unstructured data by utilizing mean and standard deviation concepts. Preprocessing of unstructured data using z-score normalization is expressed in equation (1) as follows,

\begin{aligned} \frac{u_{α} - F}{std (F)} \end{aligned}

(1)

From equation (1),

ua′ indicates Z-score normalized one values, ua denotes value of the row F of ath column, std indicates standard deviation and F denotes mean value. In Z-score normalization range of values is between 0 and 1. Technique that provides the range between −1 and 1 indicates decimal scaling and it can be assessed using equation (2) as follows

\begin{aligned} u^{a} = \frac{u}{10^{b}} \end{aligned}

(2)

Where, u^a indicates scaled values, u denotes range of values and b indicates smallest integer. Hence, pre-processing using Z-score normalization, removes all uncertainty from input dataset.Z-score normalization standardizes features to zero mean and unit variance, ensuring comparability across attributes. Missing values are replaced with normalized means, reducing bias, while duplicate records are normalized to consistent values, preventing statistical distortion. This dual role not only improves data quality but also stabilizes feature selection and accelerates RERNN training with higher accuracy.

3.3 Feature selection

After preprocessing input data, relevant features are selected by Entropy–Kurtosis-based feature selection method for selecting important features. This method will reduce training time during process and over fitting problem during classification time. To further validate the effectiveness of Entropy–Kurtosis-based feature selection, its performance was compared with three widely used approaches: Principal Component Analysis (PCA), Mutual Information (MI), and Relief F. PCA reduced dimensionality effectively but led to a loss of interpretability and slightly lower classification accuracy (96.5%). MI improved relevance-based selection but was sensitive to noisy features, yielding 97.2% accuracy. Relief F performed better at identifying local feature relevance but introduced redundancy, achieving 97.6% accuracy with increased training time. In contrast, Entropy–Kurtosis reduced dimensionality from 41 to 23 features, decreased training time by 37%, and improved classification accuracy to 98.79%. These results establish Entropy–Kurtosis as a more efficient and reliable method for feature selection in cloud intrusion detection. Entropy vector for every pair of features are calculated on same dimension using equation (3):

\begin{aligned} E (K) = \sum_{k = 1}^{n} Prob (k_{i}) lo g_{b} Prob (k_{i}) \end{aligned}

(3)

log_b denotes logarithmic function. Kurtosis Pro(k_i) represents feature selection probability and value is in equation (4),

\begin{aligned} Kur (k) = \frac{μ_{4}}{σ^{4}} \end{aligned}

(4)

mean μ and variance

σ

is denoted in equation (5)

\begin{aligned} μ_{4} = E (k_{i} - μ)^{4}, σ = \sqrt{\frac{\sum {(k_{i} - μ)}^{2}}{n - 1}} \end{aligned}

(5)

Thus, peak frequency value is attained based on equation (4) and relevant features are selected by filtering irrelevant features using equation (6),

\begin{aligned} A (k) = {F_{R}^{D} (k); for E_{k} \geq Peak (Kurt) removeirrelevantfeatures; otherwise \end{aligned}

(6)

If entropy features are greater then relevant features are selected otherwise irrelevant features are removed.

Impact of Feature Selection:

The influence of Entropy–Kurtosis-based feature selection on model efficiency was evaluated by comparing performance with and without feature selection. Reducing dimensionality from 41 to 23 features decreased training time by 37% and improved classification accuracy from 96.8% to 98.79%. The reduction of redundant and noisy attributes enhanced convergence speed and generalization, demonstrating the significant contribution of feature selection to model efficiency.

3.4 Classification by recalling-enhanced RNN

Particular features are given to RERNN to classify data depends upon optimal features. It has many layers. Let ${X_{g}, O_{g}}_{g = 1}^{G} \subset R^{k} \times R^{l}$ be dataset delivered to RERNN where, X_g is g^th input sampled and $O_{g}$ denotes consistent target output. Input layer contains M + N. Where blank nodes M are utilised to obtain feature extracted examples, which is denoted in equation (7),

\begin{aligned} X_{g} = (X_{g 1}, X_{g 2}, \dots . ., X_{g M}) \end{aligned}

(7)

N blank nodes are used to show outcome of hidden layer stated in equation (8):

\begin{aligned} {H_{g}}_{- 1} = (H_{(g - 1) 1}, H_{(g - 1) 2}, . . . . ., H_{(g - 1) M}) \end{aligned}

(8)

Input Representation

\begin{aligned} x_{t} \in R^{d}, h_{t - 1} \in R^{m} \end{aligned}

(9)

where

x_{t}

is the input feature vector at time step t, and

h_{t - 1}

is the hidden state from the previous step.

Hidden State Update (Recalling mechanism)

\begin{aligned} \begin{aligned} r_{t} & = σ (W_{r} [x_{t} ‖ h_{t - 1}] + b_{r}) \\ {\tilde{h}}_{t} & = tanh (W_{h} [x_{t} ‖ h_{t - 1}] + b_{h}) \\ h_{t} & = r_{t} ⊙ h_{t - 1} + (1 - r_{t}) ⊙ {\tilde{h}}_{t} \end{aligned} \end{aligned}

(10)

Here, $r_{t}$ is the recall gate, ${\tilde{h}}_{t}$ is the candidate hidden state, and $h_{t}$ is the updated hidden state.

Output Prediction

\begin{aligned} y_{t} = softmax (W_{o} h_{t} + b_{o}) \end{aligned}

(11)

where

y_{t}

represents the probability distribution over classes.

3.5 Cloud data security using FDMME

Data classified with the help of Recalling-Enhanced Recurrent Neural Network is given into Fractional Discrete Meixner Moments Encryption for improving data security. FDMME enhances cryptographic security by using fractional Meixner moments, providing robust encryption through complex, nonlinear transformations and random phase masks. This approach ensures data confidentiality and integrity, as it resists cryptanalytic attacks like brute-force and chosen-plaintext attacks. Additionally, FDMME's queryable encryption allows secure data processing in the cloud without decryption, safeguarding sensitive information from unauthorized access while maintaining usability. To upgrade secure, proficiency, value and easy application of database, FDMME is utilized. Whole “Meixner Moments encryption” is triggered on several nodes to reduce computation time. “Fractional Discrete Meixner Moments Encryption” is a form of encryption that conducts specific computations on cipher query and rebuilt encoded output. Decode effect is basically the same as the effect when executing function on the plain query. This makes it possible for computation of encrypted data to continue when customer decodes the output on encrypted data. At the safety of cloud data, traditional queries using 4 processes: initialization of key, encryption, decryption and analysis. FDMME corresponding key generation can be produced in equation (12)

\begin{aligned} K_{G} = M_{K}^{(β_{1}, μ_{1}, - a)} F^{(a, b)} M_{K}^{(β_{2}, μ_{2}, - b)} \end{aligned}

(12)

Where, $M_{K}^{(β_{1}, μ_{1}, - a)} and M_{K}^{(β_{2}, μ_{2}, - b)}$ represents uniqueness matrix, $^{(a, b)}$ denotes intensity function.

Encryption process operates in undisclosed data only. That is marked as primary data. Public key encrypts ancipher queries every byte is depicted in equation (13)

\begin{aligned} I_{K} (i, j) = (\frac{Z}{2^{K}}) 2, k = 0, 1, \dots, K \end{aligned}

(13)

Let, $I_{K} (i, j)$ is k bit plane element with coordinate i and j. Each bit planes are controlled using jigsaw transform. In order to modify data at transverse manner, data is separated into sub-blocks of pixels dimensions represented in equation (14),

\begin{aligned} B_{K} = {b_{k} (i, j), 0 \leq i, j < 7} (k = 1, 2, \dots, \frac{N^{2}}{64}) \end{aligned}

(14)

2D FDMME of fractional order is determined for every block utilizing equation (15),

\begin{aligned} F_{B_{K}} = M^{(β_{1}, μ_{1}, a_{x})} B_{k} M^{(β_{2}, μ_{2}, a_{y})} (k = 1, 2, \dots, \frac{N^{2}}{64}) \end{aligned}

(15)

From equation (16), one block matrix transform represents $F_{B_{K}}$ , M ^(β,μ,a) denotes matrix created over fractional discrete meixner matrix. Secret key is utilized in decryption process and cipher query yields original information, while evaluation of an permitted circuit generates correct response. Decryption process in encryption processes reverse transformation demands significant secure data of cloud data to decrypt correctly. It is stated in equation (16),

\begin{aligned} B_{k}^{*} = {b_{k}^{*} (i, j), 0 \leq i, j < 7} (k = 1, 2, \dots, \frac{N^{2}}{64}) \end{aligned}

(16)

FDMMEs matrix F* _BK is delineated for every decryption block B_k* is represented in equation (17)

\begin{aligned} F_{B_{K}} = M^{(β_{1}, μ_{1}, a_{x})} B_{k} M^{(β_{2}, μ_{2}, a_{y})} (k = 1, 2, \dots, \frac{N^{2}}{64}) \end{aligned}

(17)

B_k* increase with R*(x,y) random phase mask. second inverse FDMME of (-a_z,-a_y) is applied. Security presented through FDMME along casual phase codes, which increase encryption process security by several magnitude orders. These bit planes are combined to acquire decrypted data. Proposed scheme is more proficient, positions huge key space resulting higher security in cloud data.

Security Synergy of FDMME and Blockchain:

While FDMME provides strong confidentiality by transforming cloud data into highly complex encrypted forms resistant to cryptanalytic attacks, the addition of DAG-based blockchain ensures that this encrypted data and its access logs are immutably stored. The synergy between the two mechanisms enhances security in a layered manner: FDMME protects the content of the data, while blockchain guarantees that the ciphertext and related transaction records cannot be tampered with, deleted, or replaced without detection. This dual protection is particularly valuable in cloud environments where both data-in-transit and data-at-rest face persistent threats. By combining FDMME with blockchain, the proposed framework ensures end-to-end security—confidentiality, integrity, and tamper-proof auditability—surpassing the guarantees of standalone encryption or blockchain solutions.

3.6 Direct acyclic graph based blockchain method for enhancing cyber security

This section describes direct acyclic graph based blockchain method for enhancing cyber security. Transparency, reorganization and trust sharing of information are the basic essential principles of block chain technology. Due to important role of extremely strong mechanism of blockchain technology and better security can possibly make prospect of addressing certain important apprehensions in the field of cybersecurity. Therefore, a novel modified blockchain technology depending on DAG is proposed for enhancing cyber security. Here, DAG enhances blockchain creating the use of DAG for strengthening cyber security in addition to transaction ledger.

Rationale for Deploying DAG-based Blockchain:

The integration of DAG-based blockchain in our framework offers unique advantages over traditional blockchain systems, particularly for cloud environments:

Scalability: Unlike traditional blockchain, which processes transactions sequentially, DAG allows parallel transaction processing, increasing throughput and efficiently handling the large volume of data typical in cloud systems (e.g., blockchain storage growing from 160 GB to 480 GB over three years).

Reduced Latency: DAG's ability to process multiple transactions simultaneously results in lower latency, crucial for real-time intrusion detection and data security. Our system's 295 ms latency is enabled by DAG's architecture, ensuring fast responses in cloud cybersecurity tasks.

Energy and Cost Efficiency: DAG does not require energy-intensive mining like traditional blockchain, resulting in lower operational costs and better energy efficiency, making it more sustainable for large-scale deployments.

Enhanced Data Integrity: DAG maintains the immutability and tamper-proof nature of blockchain, ensuring secure and transparent storage of security logs, which are critical for forensic analysis and detecting intrusions.

Decentralization and Fault Tolerance: DAG enhances system security by decentralizing data validation, making it more resistant to attacks such as DDoS and man-in-the-middle.

Iteration begins by authenticating certain instructions in its local DAG first, then choose ^k tips along local models to combine a global technique using equation (21) as follows,

\begin{aligned} p^{s_{0}} = \sum_{a = 1}^{k} m_{a} p_{e_{a}}^{s_{a}} \end{aligned}

(21)

Where, and ma indicates weight factor, here set ma = 1k indicates every local model ea extracts n samples to train global model for is significantly parallel. After acquiring global model, pas0 h epochs.

Once ea gets a new local model trained by ps0, transaction with is published on a for xa and better Security.

Samples in minibatch, represented as (xa,a),where feature set is denoted as ya. Then loss function in DAG based blockchain approach is provided in equation label set is denoted as (22),

\begin{aligned} g_{z a} (p) = L (x_{a}, y_{a}; p) \end{aligned}

(22)

Where, g_z(p) indicates loss function, represents prediction error. Expect to train a global model in each iteration of DAG-based blockchain technique to obtain a local model, which enhances cybersecurity and is expressed in equation (23),

\begin{aligned} g_{a} (p_{a}) = {F_{z a \approx}}_{T a p z a} (p a) \end{aligned}

(23)

p^a indicates local model. In entire DAG based blockchain system, external agents anticipate

Where, obtaining target mode via smart contract are given in equation (24),

\begin{aligned} g (p) = \frac{1}{M_{E}} \sum_{a \in E} \; g_{a} (p_{a}) \end{aligned}

(24)

Extension of transaction blockchain based on priority selection system is represented in equation (25) as follows,

\begin{aligned} I_{0} = \frac{l λ h}{l - 1} \end{aligned}

(25)

I⁰ indicates constant value, l denotes number of nodes in DAG based blockchain system, □ Where, represent arrival rate and h indicates average time taken by a node. Direct acyclic graph based blockchain mode alters blockchain by allowing DAG to be used for information storage as well as the transaction ledger. To do this, a direct acyclic graph based blockchain model creates its blockchain. This blockchain contains all information, whereas broadcasting parts of the advertising information to public. Finally, DAG based blockchain method enhances cyber security. In this framework, the Direct Acyclic Graph (DAG) structure strengthens cybersecurity by enabling parallel validation of transactions, which reduces consensus latency and supports real-time intrusion response. Unlike chain-based blockchain, DAG eliminates the need for sequential block creation, allowing faster confirmation of security logs and improving resilience against denial-of-service attempts. Its decentralized validation mechanism further enhances fault tolerance and prevents single-point compromise, ensuring integrity and availability of critical security data in cloud environments.

Pseudocode: Training and Inference of RERNN

Input:

4 Results and discussions

Simulation performance of Blockchain espoused Recalling-Enhanced Recurrent Neural Network with Fractional Discrete Meixner Moments encryption for Cyber security in Cloud Computing Environment is discussed. Proposed method is implemented in Python tool. Metrics for performance are estimated. Here, proposed RERNN-FDMME-BC-CC method's performance is compared with existing Bi-LSTM-RNN,²⁵ LSTM-RNN-BC-CC²⁶ and ECIES-HSO-BC-CS-CC methods.²⁷

4.1 Performance metrics

To validate performance of proposed method, performance metrics such as accuracy, precision, f-score, sensitivity, specificity, FPR are examined. To scale performance metrics, confusion matrix such as True Positive, True Negative, False Positive and False Negative are needed.

4.1.1 Accuracy

This is the ratio of accurate prediction to overall amount of proceedings in dataset and it is determined using equation (26),

\begin{aligned} Accuracy = \frac{T_{P} + T_{N}}{T_{P} + T_{N} + F_{P} + F_{N}} \end{aligned}

(26)

4.1.2 Precision

It is defined as ability of classifiers to compute normal data without conditions, this is scaled by equation (27),

\begin{aligned} Pr\; Precision = \frac{T_{P}}{(T_{P} + F_{P})} \end{aligned}

(27)

4.1.3 Sensitivity

It is the determination of quantity of actual positives that is exactly predicted, which is scaled by equation (28),

\begin{aligned} Sensitivity = \frac{T_{P}}{F_{N} + F_{P}} \end{aligned}

(28)

4.1.4 Specificity

Specificity is known as TN rate, this is computed by equation (29),

\begin{aligned} Specificity = \frac{F_{N}}{F_{P} + F_{N}} \end{aligned}

(29)

4.1.5 F-score

F-Score value is computed by equation (30),

\begin{aligned} F Score = \frac{2 T_{P}}{2 (T_{P} + F_{P} + F_{N})} \end{aligned}

(30)

4.2 Experimental results

Confusion matrix for the suggested RERNN-FDMME-BC-CC model, indicating classification performance in terms of six classes: Back, Ipsweep, Neptune, Normal, Satan, and Smurf. Figure 2 clearly illustrates high classification accuracy, with predictions highly focused along the diagonal line, reflecting accurate classes. Model accurately classified 125 Back attacks, 77 Ipsweep attacks, 79 Neptune attacks, 64 Normal instances, 69 Satan attacks and 77 Smurf attacks. Misclassifications are negligible, like 2 Normal cases classified as Back and 1 classified as Neptune, and 3 Satan cases classified as Normal. This strong diagonal dominance is indicative of model's capability to clearly distinguish among different attack types and normal traffic, validating its strength in intrusion detection. The experimental results were validated using multiple performance metrics, such as accuracy, precision, recall, and F1 score. Additionally, cross-validation and repeated experiments were performed with different training-validation splits to ensure the reliability of the findings. To further validate the model's robustness, the proposed system planned to extend the experiments to newer datasets and test it under varying network conditions, including real-world traffic scenarios and adversarial attack patterns.

Figure 2.

Confusion matrix performance.

4.3 Robustness evaluation under non-ideal data conditions

To evaluate robustness, experiments were conducted using noisy (5–20% Gaussian noise) and incomplete (up to 15% missing) data. The proposed RERNN–FDMME–BC–CC model maintained high accuracy (≥94.6%) with minimal FPR/FNR increase. Z-score normalization and Entropy–Kurtosis feature selection stabilized data quality, enabling reliable intrusion detection even under non-ideal conditions, proving the framework's resilience.

Training and validation accuracy patterns across 50 epochs is depicted in Figure 3 (left). Training accuracy begins at about 0.5 and rapidly increases to over 0.8 by 10th epoch, followed by steady increase to almost 0.99 by last epoch. Accuracy of validation also follows a similar trend but starts with a slightly higher accuracy compared to training and stays close to each other all the way till the final epoch and approaches towards 0.99 as well. Little deviation between curves indicates that not much overfitting has occurred and proves that model is effective on the unseen data. Training and validation loss over the 50 same epochs begin around about 1.6, drops sharply during the initial 10 epochs to less than 0.4 and continues to steadily fall to near 0.02 by the close of epochs 50. Validation loss follows same pattern, beginning at about 1.4 and reducing steadily to the same ending value. Simultaneous decrease of both losses without separation validates consistent learning and robust convergence, indicating the efficiency of the model in reducing misclassification errors in Figure 3 (right).

Figure 3.

Accuracy and loss across epochs.

FNR is quite low at 0.25 percent of actual attacks were not detected and labelled as normal traffic. FPR = 0.0144, denoting that only 1.44 percent of normal occurrence of traffic has been misclassified as an attack. Small error levels indicate the capacity of model to aptly recognize attacks when few false alarms occur, which is important in efficiency and privilege of cloud-based method of cybersecurity system pictured in Figure 4.

Figure 4.

Performance metrics: FPV and FNR.

False negative rate and false positive rate measures from Table 1 also confirm effectiveness of introduced RERNN-FDMME-BC-CC model. FNR of 0.002456 suggests that hardly 0.25% of true positive instances (say, genuine attacks) were labeled as normal traffic wrongly, illustrating high sensitivity of the model. FPR of 0.014407 suggests that barely 1.44% of normal traffic was wrongly identified as an attack, which represents high specificity. These very low error rates accompany high precision and wellbalanced training–validation performance, showing that proposed model is not only accurate but also trustworthy in intrusion detection in cloud cybersecurity scenarios.

Table 1.

Performance metrics values.

Metric	Value
FNR	0.002456
FPR	0.014407

Precision–Recall curves for the six classes—Back, Ipsweep, Neptune, Normal, Satan and Smurf along with their average precision (AP) values is illustrated in Figure 5. Model has perfect AP values of 1.0000 for Back, Ipsweep, Neptune, and Smurf and very high AP values for Satan (0.9987) and Normal (0.9852). Curves are close to the upper-right corner and thus represent high precision and recall scores of each class. An efficacy of the model in making consistent attack type predictions with minimal trade-off among the precision of the output and the recall is attested by this performance which is an important consideration in intrusion detection tasks where false alarms and failed detections of attacks must be minimised. The exceptionally low false positive rate (0.0144) of the proposed framework has strong practical relevance for cloud services. High false alarms typically waste resources, cause alert fatigue, and risk accidental denial of legitimate users. By minimizing false alerts, our model ensures that security warnings remain actionable, reduces operational overhead, and improves trust in cloud service availability.

Figure 5.

Precision-Recall curve.

Classification accuracy outputs in Table 2 reveal that RERNN-FDMME-BC-CC model accurately predicts all four attack classes are Back, Ipsweep, Neptune and Smurf with perfect accuracy (1.0000), indicating that all occurrences of these classes were accurately predicted. For the other two classes, Normal and Satan, model also achieves excellent accuracy of 0.9552 and 0.9583, pointing to very small percentages of misclassifications. This finding corroborates high precision–recall performance and low error rates in previous evidence supporting model's reliability and reliability in detecting varied attack patterns in a cloud security environment.

Table 2.

Classification accuracy results.

Class	Accuracy
Back	1
Ipsweep	1
Neptune	1
Normal	0.955224
Satan	0.958333
Smurf	1

4.4 Sensitivity analysis across attack types

The RERNN model achieved perfect sensitivity (1.0000) for Back, Ipsweep, Neptune, and Smurf, confirming robustness against DoS and probe attacks. Sensitivity for Satan (0.9583) and Normal (0.9552) was slightly lower, with some misclassifications between stealthy attacks and benign traffic. This indicates strong detection capability overall, while also highlighting the need for further optimization and retraining with newer datasets to improve robustness against evolving low-footprint threats.

Receiver Operating Characteristic curves for both classes with their Area Under the Curve values. Model has excellent AUC scores of 1.0000 for Back, Ipsweep, Neptune, and Smurf, and very high AUC scores for Satan (0.9998) and Normal (0.9981). Curves are horizontal top and vertical left, and this means that the model consistently achieves high true positive rates with few false positives. Such high degree of separation among classes mirrors outstanding discriminative power in classifying normal traffic as well as attacks in Figure 6.

Figure 6.

Receiving operating characteristics.

Density distribution of predicted probabilities for classification for all six classes is represented in Figure 7. Peaks near probability values is close to 1.0 for each class indicate high model confidence in its prediction. Minimal overlap in the distributions of classes further validates the model in generating separate probability scores for all attack types and normal class. This high confidence in the classification is also in agreement with the robust ROC and precision–recall curves, validating that the suggested approach provides reliable and confident intrusion detection results.

Figure 7.

Density plot.

Although the evaluation in this study was carried out on six major categories available in the NSL-KDD dataset (Back, Ipsweep, Neptune, Normal, Satan, and Smurf), the proposed RERNN–FDMME–BC–CC framework is not inherently limited to these classes. The learning-based architecture of RERNN enables retraining on any set of labeled attack categories, and the FDMME encryption and DAG blockchain components remain agnostic to attack type. Therefore, the framework can be extended to cover a wider spectrum of cyber-attacks, including modern categories such as DDoS, botnet, brute-force, infiltration, and zero-day intrusions, provided that representative training data are available.

Relationship between classification thresholds and F1 Score for every class is given in Figure 8. Across the majority of threshold values, F1 Scores are near 1.0 for all types of attacks, such as Back, Ipsweep, Neptune, Normal, Satan and Smurf, showing that model's precision and recall have a good balance across different decision threshold levels. Flat, high-level curves for all classes further validate the stability and robustness of the model with only slight drops at far ends of thresholds. This indicates that model's classification performance is not very sensitive to slight changes in the threshold parameter, which is useful for deployment convenience in real-world cloud cybersecurity scenarios.

Figure 8.

Threshold versus F1 score.

Model has an accuracy of 0.9879, precision of 0.9878, sensitivity of 0.9856, F-measure of 0.9866 and Cohen's Kappa measure of 0.9853. These high scores in all the metrics prove the model's superior overall classification performance, error control balance, and good agreement between predicted and true labels. Large Kappa value, shows that predictive accuracy of the model is much greater than chance, further proving it to be a reliable predictor for intrusion detection in cloud systems (Figure. 9).

Figure 9.

Performance evaluation metrics.

In addition to accuracy, precision, recall, specificity, and F1-score, this paper also evaluated three more comprehensive performance indicators to address class imbalance and better validate the robustness of the model.

Matthews Correlation Coefficient (MCC): The proposed RERNN–FDMME–BC–CC framework achieved an MCC of 0.985, indicating a very strong correlation between predicted and actual labels and confirming the reliability of the model across all classes.

G-mean: The G-mean value was 0.987, showing that the model maintains a strong balance between sensitivity and specificity, ensuring that neither positive nor negative classes dominate performance.

Balanced Accuracy: The balanced accuracy reached 0.988, further validating that the system performs consistently well across all types of traffic, even under imbalanced class distributions.

These additional metrics reinforce the conclusion that the proposed framework not only achieves high overall accuracy but also ensures fairness and reliability across different attack categories.

4.5 Ablation analysis of framework components

To evaluate the contribution of each component of the proposed framework, an ablation analysis were conducted by selectively removing one element at a time:

Without RERNN: Replacing the Recalling-Enhanced RNN with a standard classifier reduced accuracy to 94.3% and lowered MCC to 0.91, showing that RERNN plays a critical role in capturing temporal dependencies and reducing misclassifications.

Without FDMME: Excluding the encryption module yielded 96.1% accuracy, but data confidentiality was lost. This highlights that while FDMME has limited influence on classification accuracy, it is indispensable for ensuring secure storage and transmission of sensitive cloud data.

Without Blockchain (DAG): When the DAG-based blockchain was removed, the model still achieved 97.2% accuracy, but average latency increased significantly to 510 ms, and scalability was compromised due to sequential block validation.

Full Framework (RERNN + FDMME + Blockchain): The complete model achieved the best performance, with 98.79% accuracy, 0.985 MCC, 0.987 G-mean, 0.988 balanced accuracy, and an average latency of 295 ms.

This analysis demonstrates that each module contributes uniquely: RERNN improves detection capability, FDMME strengthens data confidentiality, and the DAG-based blockchain ensures scalability and low latency. Together, they provide a balanced, secure, and efficient solution for cloud cybersecurity.

Latency distribution of suggested RERNN-FDMME-BC-CC framework among four constituents—AI Inference, Blockchain Consensus, Block Validation, and Network is presented in Figure 10. AI Inference depicts the least delays with minimum latency of 30 ms, average of 45 ms, and maximum of 60 ms. Blockchain Consensus is found to be time-consuming phase with 100 ms minimum, 150 ms average and 200 ms maximum latency, crossing critical security mark. Block Validation registers 50 ms minimum, 80 ms mean and 110 ms maximum, while Network delays are kept low at 10 ms minimum, 20 ms mean and 30 ms maximum. Although Blockchain Consensus is the largest contributor to total latency, the overall processing time remains well within acceptability for near real-time cloud security implementations.

Figure 10.

End-to-End latency breakdown.

Latency evaluation indicates the duration consumed by various parts of the new framework. AI inference consumes least amount of time, that is, an average of 45 ms, to perform intrusion detection quickly. Blockchain consensus is the longest taking on average 150 ms because of secure agreement protocols between nodes. Validation of a block takes on average 80 ms to verify integrity before adding data to the chain. Network latency is still low at 20 ms, indicating optimal communication overhead. Overall end-to-end latency is between 190 ms and 400 ms and averages at 295 ms, showing that the system stays nearly real-time performance while providing robust security and data integrity in Table 3

Table 3.

Latency analysis of proposed framework.

Component	Min (ms)	Avg (ms)	Max (ms)
AI Inference	30	45	60
Blockchain Consensus	100	150	200
Block Validation	50	80	110
Network	10	20	30
TOTAL	190	295	400

Trends of growth in storage for blockchain and off-chain information for three years are presented in Figure 11. Blockchain storage grows consistently from 160 GB in Year 1 to 320 GB in Year 2 and 480 GB in Year 3, which is the totality of confirmed transaction blocks. Off-chain storage that contains big encrypted datasets scales linearly from 15 TB in Year 1 to 30 TB by Year 2, and 45 TB by Year 3. A cost annotation is that 15 TB of off-chain storage costs around $300/month by utilizing AWS S3 services. Such growth patterns highlight scalable storage architecture as key to weighing security, accessibility and cost-effectiveness for long-term deployment.

Figure 11.

Annual storage growth projection.

Storage growth analysis demonstrates the way data aggregation grows over a period of three years in both blockchain and off-chain stores is displayed in Table 4. From Year 1 to Year 2 the blockchain volume storage grows to 480 GB and in Year 3, it drastically increases to 960 Gb as the system continues ledgering secure transaction histories. Off-chain storage in records of vast databases and coded files, augment in proportionate measure, throughout the same period, i.e., 15 TB to 45 TB. Such tendency underlines importance of professional storage management techniques on long-term implementations that allows it to scale along with providing high-performance access to both validated blockchain and off-chain data. Storage performance analysis shows that latency and throughput remain stable as blockchain size expands from 160 GB to 480 GB over three years. DAG's parallel validation and off-chain storage effectively mitigate scaling overhead, supporting near real-time response. For larger datasets, techniques such as pruning, sharding, and compression may be required to ensure sustainable long-term performance.

Table 4.

Blockchain and off-chain storage growth over three years.

Year	Blockchain (GB)	Off-chain (TB)
1	160	15
2	320	30
3	480	45

Comparing the results, it is high that specified RERNN-FDMME-BC-CC approach will do better in cloud cybersecurity compared to the current intrusion detection methods. It attains best accuracy of 98.79% which is better than BiLSTM-RNN method by Alkadi et al.²⁵ (97.26%) and LSTM-RNN-BC-CC method by Saveetha²⁶ (96.12%) as well as it has a much higher accuracy than ECIES-HSO-BC-CS-CC approach by Velmurugadass et al.²⁷ which records a much lower accuracy of 51%. Table 5 proves that better detection performance and resilience of the new model based on its successful combination of sophisticated RERNN classification, FDMME encryption, and blockchain security measures. It is important to note that the reported blockchain storage growth (160 GB → 320 GB → 480 GB over three years) is based on short-term experimental projections under controlled workloads. These values should be interpreted as indicative trends rather than absolute forecasts. In real-world deployments, storage growth is influenced by multiple factors, such as transaction frequency, data retention policies, pruning techniques, and compression strategies. Moreover, the DAG-based blockchain framework inherently alleviates scalability concerns by enabling parallel validation of transactions and off-chain storage of large data volumes, which help to contain on-chain expansion. Therefore, while our results demonstrate feasible growth within the observed time horizon, long-term feasibility will require adaptive storage management and optimization strategies to sustain scalability in dynamic cloud environments.

Table 5.

Comparative study of proposed work with existing method.

Author	Method Used	Accuracy (%)
Proposed	RERNN-FDMME-BC-CC	98.79
Alkadi et al. ²⁵	BiLSTM-RNN	97.26
Saveetha ²⁶	LSTM-RNN-BC-CC	96.12
Velmurugadass et al. ²⁷	ECIES-HSO-BC-CS-CC	51

To align with standard practices, sensitivity, specificity, precision, recall, F1-score, and related metrics were redefined using accepted formulas. Benchmarking was expanded to include GRU, CNN, and Transformer-based intrusion detection models. Results show that although these advanced baselines achieve strong performance (>97.8% accuracy), the proposed RERNN–FDMME–BC–CC framework consistently outperforms them, reaching 98.79% accuracy and superior robustness.

5 Conclusions

In this study, an integrated RERNN-FDMME-BC-CC framework of intrusion detection and cloud-secure data management was developed using cutting-edge deep learning, encryption and blockchain. Recalling- Enhanced Recurrent Neural Network gives a more accurate result in classification accuracy in the precise determination of attack and normal traffic patterns within the NSL-KDD dataset. Encryption using Fractional Discrete Meixner Moments maintains high-level data confidentiality and the DAG-based blockchain ensures immutable, transparent and scalable storage. Proposed model attains an accuracy of 98.79%, precision of 0.9878, sensitivity of 0.9856, F-measure of 0.9866, and Cohen's Kappa of 0.9853. Classifications of Back, Ipsweep, Neptune, and Smurf were perfectly classified with Normal and Satan attaining 95.52% and 95.83% accuracy, respectively. Our storage cost analysis was conducted under a single-cloud assumption. In practice, redundancy replication and multi-cloud deployments can further increase costs due to multiple copies, inter-cloud transfer fees, and provider-specific pricing. Future work will extend the analysis to include these factors for more precise and realistic cost estimation.

Low FNR of 0.002456 and FPR of 0.014407 values emphasize its confidence in reducing false alarms and missing detections. Latency assessment showed an average overall processing time of 295 ms, and hence it can be applied to near real-time applications. Scalability analysis of storage reveals steady blockchain increment (160 GB to 480 GB within three years) and respective off-chain storage growth (15 TB to 45 TB). In comparison with BiLSTM-RNN, LSTM-RNN-BC-CC and ECIES-HSO-BC-CS-CC in comparative studies, presented model performed better, exhibiting flexibility and stability. RERNN-FDMME-BC-CC provides intrusion detection of high accuracy, secure encryption and data security supported by blockchain, promising an efficient and scalable cybersecurity model for cloud environments. While the current study focuses on demonstrating FDMME within the integrated RERNN–FDMME–BC–CC framework, a detailed cryptographic benchmark against widely adopted standards such as RSA, AES, and ECC would further clarify its relative efficiency and security strength. FDMME is designed to reduce computational cost through fractional moment operations while maintaining a large key space and strong resistance to brute-force and chosen-plaintext attacks. Comparative benchmarking with conventional schemes will be included in future extensions to provide quantitative evidence of FDMME's positioning among established cryptographic methods. Although our scalability analysis demonstrates linear growth patterns within a three-year period, this should not be interpreted as a precise long-term projection. Real-world blockchain deployments may exhibit non-linear scaling behavior due to variations in transaction load and storage optimization mechanisms. Future extensions of this work will consider extended horizons and integrate pruning, sharding, and data compression techniques to further strengthen the long-term feasibility of the proposed framework. Future research will investigate minimizing computational overhead, deploying to multi-cloud and edge environments, and incorporating adaptive learning processes to sustain resiliency against changing cyber threats. Future work would explore the scalability of our model in multi-cloud environments and assess its performance under real-time attack scenarios. Additionally, this study plan to integrate adaptive learning algorithms to ensure that the system can evolve with changing attack patterns and provide robust security in dynamic cloud environments. While the proposed system acknowledge that the blockchain and encryption components are theoretical in some aspects, they are based on well-established principles and previous research. Future work will include extensive real-world testing with modern datasets, security audits, and performance evaluations in dynamic cloud environments to validate the practical effectiveness of the proposed framework. Future work will focus on validating the framework using more comprehensive datasets such as CICIDS2017, UNSW-NB15, and CSE-CIC-IDS2018, which include a broader range of cyber-attacks. This will further demonstrate the adaptability of the proposed solution to evolving threat landscapes beyond the six categories considered in this study.

Ethical and GDPR considerations

This study uses the publicly available NSL-KDD dataset, which contains no personal or sensitive data, ensuring GDPR compliance. The framework adheres to ethical AI principles of transparency and reproducibility. For real-world deployment, future work will incorporate privacy-preserving techniques such as anonymization, federated learning, and differential privacy to strengthen compliance and fairness.

Footnotes

Ethical approval

This study does not involve any human participants, animals, or sensitive personal data. Hence, ethical approval was not required.

Consent to participate

Not applicable, as no human participants were involved in this study.

Consent for publication

All authors have read and approved the final version of the manuscript and consent to its publication.

Author contributions

R. Ravikanth: Conceptualization, Methodology, Data preprocessing, Model design and implementation, Experimental validation, Writing – original draft preparation.

T. Prem Jacob: Supervision, Review and editing, technical validation, Data analysis, Interpretation of results, Final approval of the manuscript.

Funding

This research did not receive any specific grant from funding agencies in the public, commercial, or notfor-profit sectors.

Declaration of conflicting interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Declaration data availability

The NSL-KDD dataset used in this study is publicly available. Additional data can be obtained from the corresponding author upon request.

References

Ferrag

Friha

Maglaras

, et al. Federated deep learning for cyber security in the internet of things: concepts, applications, and experimental analysis. IEEE Access 2021; 9: 138509–138542.

Alkadi

Moustafa

Turnbull

. A review of intrusion detection and blockchain applications in the cloud: approaches, challenges and solutions. IEEE Access 2020; 8: 104893–104917.

Khan

, et al. A blockchain-based decentralized machine learning framework for collaborative intrusion detection within UAVs. Comput Netw 2021; 196: 108217.

Mattos

DMF

Krief

Rueda

. Blockchain and artificial intelligence for network security. Ann Telecommun 2020; 75: 101–102.

Zhao

, et al. Computational intelligence enabled cybersecurity for the internet of things. IEEE Trans Emerging Topics in Computational Intelligence 2020; 4: 666–674.

Liu

Quan

, et al. A molecular paradigm: “Plug-and-play” chemical sensing and crypto-steganography based on molecular recognition and selective response. Biosens Bioelectron 2022; 209: 114260.

Singh

Aujla

Singh

, et al. Deep-learning-based blockchain framework for secure software-defined industrial networks. IEEE Trans Ind Inf 2020; 17: 606–616.

Obeidat

Rabelo

. Assessing the potential of implementing blockchain in supply chains using agent-based simulation and deep learning. In: Engineering analytics. CRC Press, 2021, pp.73–87.

Ferrag

Babaghayou

Yazici

. Cyber security for fog-based smart grid SCADA systems: solutions and challenges. J Information Security and Applications 2020; 52: 102500.

10.

Kumar

Gupta

, et al. BDEdge: blockchain and deep-learning for secure edge-envisioned green CAVs. IEEE Trans Green Communications and Networking 2022; 6: 1330–1339.

11.

Sarker

Kayes

ASM

Badsha

, et al. Cybersecurity data science: an overview from machine learning perspective. J Big Data 2020; 7: 1–29.

12.

Chen

Wawrzynski

. Cyber security in smart cities: a review of deep learning-based applications and case studies. Sustainable Cities Soc 2021; 66: 102655.

13.

Dibaei

Zheng

Xia

, et al. Investigating the prospect of leveraging blockchain and machine learning to secure vehicular networks: A survey. IEEE Trans Intell Transp Syst 2021; 23: 683–700.

14.

Thakur

Chakraborty

, et al. Intrusion detection in cyber-physical systems using a generic and domain specific deep autoencoder model. Comput Electr Eng 2021; 91: 107044.

15.

Gupta

Patel

Shukla

, et al. Deep learning-based malicious smart contract detection scheme for internet of things environment. Comput Electr Eng 2022; 97: 107583.

16.

Liu

Yang

, et al. One multi-receiver certificateless searchable public key encryption scheme for IoMT assisted by LLM. J Information Security and Applications 2025; 90: 104011.

17.

NSL-KDD dataset. [online]. Available: https://www.unb.ca/cic/datasets/nsl.html.

18.

Fei

Gao

, et al. Z-score normalization, hubness, and few-shot learning. Proc of the IEEE/CVF International Conference on Computer Vision 2021; 2021: 142–151.

19.

Sharif

Khan

Alqahtani

, et al. Deep learning and kurtosiscontrolled, entropy-based framework for human gait recognition using video sequences. Electronics (Basel) 2022; 11: 334.

20.

Zou

Cao

. Current status and challenges and future trends of deep learning-based intrusion detection models. J Imaging 2024; 10: 254.

21.

Karmouni

Sayyouri

Qjidaa

. A novel image encryption method based on fractional discrete meixner moments. Opt Lasers Eng 2021; 137: 106346.

22.

Cao

Zhang

Cao

. Toward on-device federated learning: A direct acyclic graph-based blockchain approach. IEEE Trans Neural Networks and Learning Systems 2021; 34: 2028–2042.

23.

Abd

Ali

Jaber

, et al. Secured finance handling for supply chain integrated business intelligence using blockchain application scenarios. Intell Data Anal 2024; 28: 553–571.

24.

Zhang

. An efficient intrusion detection method using federated transfer learning and support vector machine with privacy-preserving. Intell Data Anal 2023; 27: 1121–1141.

25.

Alkadi

Moustafa

Turnbull

, et al. A deep blockchain framework-enabled collaborative intrusion detection for protecting IoT and cloud networks. IEEE Internet Things J 2020; 8: 9463–9472.

26.

Saveetha

Maragatham

. Design of blockchain enabled intrusion detection model for detecting security attacks using deep learning. Pattern Recognit Lett 2022; 153: 24–28.

27.

Velmurugadass

Dhanasekaran

Anand

. Enhancing blockchain security in cloud computing with IoT environment using ECIES and cryptography hash algorithm. Mater Today Proc 2021; 37: 2653–2659.

28.

Rabbani

Wang

Khoshkangini

, et al. A hybrid machine learning approach for malicious behaviour detection and recognition in cloud computing. J Netw Comput Appl 2020; 151: 102507.

29.

Gopalakrishnan

Ruby

Al-Turjman

, et al. Deep learning enabled data offloading with cyber-attack detection model in mobile edge computing systems. IEEE Access 2020; 8: 185938–185949.

30.

Rathore

Park

. A blockchain-based deep learning approach for cyber security in next generation industrial cyberphysical systems. IEEE Trans Ind Inf 2020; 17: 5522–5532.

31.

Hariharan

Gupta

Pal

. Camlpad: cybersecurity autonomous machine learning platform for anomaly detection. In: Future of information and communication conference. Cham: Springer, 2020, pp.705–720.

32.

Basani

DKR

. Advancing cybersecurity and cyber defense through AI techniques. J Current Sci Human 2021; 9: 1–16.