SDN-enabled adaptive security framework for multi-cloud infrastructures using deep learning-based threat detection and policy management

Abstract

Background: Organizations achieve agility, scalability, and enhanced resource utilization in multi-cloud environments, but face challenges in ensuring uniform and robust security across diverse cloud platforms. Variations in configuration and security mechanisms among providers hinder consistent policy enforcement and expose systems to data breaches and evasive threats. Additionally, the dynamic and distributed nature of multi-cloud operations broadens the attack surface, making real-time threat mitigation more complex. Methods: To address these challenges, we introduced a groundbreaking software-defined networking (SDN)-enabled framework that incorporates deep learning for attack detection and adaptive security policy management. The framework consists of two primary components: the Software-Defined Multicloud Defense Controller (SDMDC), which enables centralized, real-time security policy enforcement (control plane), and the Multicloud Intrusion Detection System Gateways (MCIDS-G), which facilitate distributed threat detection across cloud platforms (data plane). The SDMDC’s integrated IDS is built using the Cross-Cloud Threat Transformer (CCTT) model, while the MCIDS-G’s regional IDS is based on the Long Short-Term Memory (LSTM) model. Additionally, the Lemurs Optimizer (LO) is employed in the SDMDC for cost-efficient policy management. SDMDC enforces security standards across all cloud environments where applications operate. Results: The proposed solution addresses long-standing cloud security issues by combining coordinated global security strategies with automated threat detection and centralized policy management. SDMDC ensures consistent policy enforcement across cloud environments and manages ingress/egress and east-west traffic between cloud domains, including Amazon Web Service (AWS) and other service providers. The architecture supports dynamic resource orchestration and horizontal scalability, enabling adaptive performance under varying load conditions. The system also enables automatic policy implementation across platforms and facilitates real-time threat response to maintain consistent security. Conclusion: The presented framework represents a significant advancement over existing multi-cloud protection solutions. It introduces new research directions, particularly in traffic management, firewall integration, and fully qualified domain name (FQDN) policy enforcement with proxy management.