SAH-IDA: A Unified Framework for Accurate, Explainable, and Cryptographically Secure Network Intrusion Detection in Cloud Environments

Intrusion detection systems (IDSs) used in cloud computing settings have to address three simultaneous structural problems, namely: (a) low classification efficiency for class-imbalance datasets; (b) absence of explanation of decisions at the inference level according to AI regulation requirements; (c) weak protection of results using modern cryptography algorithms. To solve this problem, this article introduces a novel SAH-IDA approach based on a combination of (i) heterogeneous stacking model with four base estimators (Gaussian Naive Bayes, K-Nearest Neighbors, Logistic Regression, and LDA) in logistic regression meta-model, which was trained with the help of fivefold cross-validation algorithm; (ii) decision-level explainability based on KernelSHAP that complies with requirements stated in Article 13 of EU AI Act and Article 22 of GDPR; (iii) neural synchronization technique called Tree Parity Machine combined with AES-128-CBC encryption and SHA-256 integrity check protocol. Tested on the NSL-KDD dataset, which included 125,973 training and 22,544 test observations, SAH-IDA demonstrated 98.41% accuracy and macro-average of F1 = 0.9840 against 98.09% for the most accurate standalone classifier (KNN) as determined using McNemar test (chi-square statistic equals 235.6, p