{"id":"https://openalex.org/W7117765776","doi":"https://doi.org/10.1109/tcc.2025.3649041","title":"D <sup>3</sup> -Guard: An Adaptive Decision Fusion Framework for Cloud-Native Threat Detection","display_name":"D <sup>3</sup> -Guard: An Adaptive Decision Fusion Framework for Cloud-Native Threat Detection","publication_year":2025,"publication_date":"2025-12-31","ids":{"openalex":"https://openalex.org/W7117765776","doi":"https://doi.org/10.1109/tcc.2025.3649041"},"language":null,"primary_location":{"id":"doi:10.1109/tcc.2025.3649041","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcc.2025.3649041","pdf_url":null,"source":{"id":"https://openalex.org/S2492498579","display_name":"IEEE Transactions on Cloud Computing","issn_l":"2168-7161","issn":["2168-7161","2372-0018"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Cloud Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5121638031","display_name":"Zihao Lin","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zihao Lin","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0007-1446-5166","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121691004","display_name":"Weiyong Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiyong Zhang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-1619-2612","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121649664","display_name":"Hao Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210140589","display_name":"China Huadian Corporation (China)","ror":"https://ror.org/03wj9h986","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210140589"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Liu","raw_affiliation_strings":["QiAnXin Technology Group Company, Ltd, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-3865-7559","affiliations":[{"raw_affiliation_string":"QiAnXin Technology Group Company, Ltd, Beijing, China","institution_ids":["https://openalex.org/I4210140589"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121640043","display_name":"Hui Lu","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hui Lu","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-4120-7716","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5119265864","display_name":"Zhihong Tian","orcid":null},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhihong Tian","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-9409-5359","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangdong Key Laboratory of Industrial Control System Security, and Huangpu Research School of Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.78383343,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":"1","first_page":"163","last_page":"176"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.260699987411499,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.260699987411499,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.210099995136261,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.20360000431537628,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sensor-fusion","display_name":"Sensor fusion","score":0.5703999996185303},{"id":"https://openalex.org/keywords/bayesian-probability","display_name":"Bayesian probability","score":0.553600013256073},{"id":"https://openalex.org/keywords/dynamic-bayesian-network","display_name":"Dynamic Bayesian network","score":0.536899983882904},{"id":"https://openalex.org/keywords/fusion","display_name":"Fusion","score":0.3905999958515167},{"id":"https://openalex.org/keywords/bayesian-network","display_name":"Bayesian network","score":0.3774999976158142},{"id":"https://openalex.org/keywords/signal","display_name":"SIGNAL (programming language)","score":0.35679998993873596},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.3549000024795532},{"id":"https://openalex.org/keywords/similarity","display_name":"Similarity (geometry)","score":0.34630000591278076},{"id":"https://openalex.org/keywords/decision-theory","display_name":"Decision theory","score":0.3296999931335449}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.742900013923645},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.5703999996185303},{"id":"https://openalex.org/C107673813","wikidata":"https://www.wikidata.org/wiki/Q812534","display_name":"Bayesian probability","level":2,"score":0.553600013256073},{"id":"https://openalex.org/C82142266","wikidata":"https://www.wikidata.org/wiki/Q3456604","display_name":"Dynamic Bayesian network","level":3,"score":0.536899983882904},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5239999890327454},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5019000172615051},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4984999895095825},{"id":"https://openalex.org/C158525013","wikidata":"https://www.wikidata.org/wiki/Q2593739","display_name":"Fusion","level":2,"score":0.3905999958515167},{"id":"https://openalex.org/C33724603","wikidata":"https://www.wikidata.org/wiki/Q812540","display_name":"Bayesian network","level":2,"score":0.3774999976158142},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.35679998993873596},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.3549000024795532},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.34630000591278076},{"id":"https://openalex.org/C28901747","wikidata":"https://www.wikidata.org/wiki/Q177571","display_name":"Decision theory","level":2,"score":0.3296999931335449},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.31779998540878296},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.31630000472068787},{"id":"https://openalex.org/C137270730","wikidata":"https://www.wikidata.org/wiki/Q120811","display_name":"Detection theory","level":3,"score":0.30379998683929443},{"id":"https://openalex.org/C2982962833","wikidata":"https://www.wikidata.org/wiki/Q17092450","display_name":"Information fusion","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C160234255","wikidata":"https://www.wikidata.org/wiki/Q812535","display_name":"Bayesian inference","level":3,"score":0.2849999964237213},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2676999866962433},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.2635999917984009},{"id":"https://openalex.org/C2778868856","wikidata":"https://www.wikidata.org/wiki/Q18394273","display_name":"Threat assessment","level":2,"score":0.2621000111103058},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.25760000944137573},{"id":"https://openalex.org/C107327155","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision support system","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C2986909951","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision system","level":2,"score":0.25540000200271606},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.25209999084472656},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.25209999084472656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tcc.2025.3649041","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcc.2025.3649041","pdf_url":null,"source":{"id":"https://openalex.org/S2492498579","display_name":"IEEE Transactions on Cloud Computing","issn_l":"2168-7161","issn":["2168-7161","2372-0018"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Cloud Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6064493666","display_name":null,"funder_award_id":"U2436208","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8812891240","display_name":null,"funder_award_id":"62372129","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W2008060027","https://openalex.org/W2150847526","https://openalex.org/W2295598076","https://openalex.org/W2296719434","https://openalex.org/W2335999708","https://openalex.org/W2762776925","https://openalex.org/W2797283471","https://openalex.org/W2807786182","https://openalex.org/W2890507837","https://openalex.org/W2903893305","https://openalex.org/W2921453769","https://openalex.org/W2936268283","https://openalex.org/W2958285686","https://openalex.org/W2964113583","https://openalex.org/W2971076825","https://openalex.org/W3013075373","https://openalex.org/W3013197899","https://openalex.org/W3036656584","https://openalex.org/W3047091610","https://openalex.org/W3085865982","https://openalex.org/W3119704812","https://openalex.org/W3128846634","https://openalex.org/W3197914403","https://openalex.org/W3202565128","https://openalex.org/W4205270295","https://openalex.org/W4225165893","https://openalex.org/W4239510810","https://openalex.org/W4244657151","https://openalex.org/W4324007053","https://openalex.org/W4367663550","https://openalex.org/W4383889282","https://openalex.org/W4400238886","https://openalex.org/W4400762160","https://openalex.org/W4400768321","https://openalex.org/W4404849322","https://openalex.org/W4405235808","https://openalex.org/W4411948870"],"related_works":[],"abstract_inverted_index":{"Traditional":[0],"threat":[1],"detection":[2,21],"systems":[3],"fail":[4],"in":[5,40,47,134,168,172],"dynamic":[6,42,79],"cloud-native":[7],"environments,":[8],"primarily":[9],"due":[10],"to":[11,14,60,81,113,181,187],"their":[12],"inability":[13],"resolve":[15],"the":[16,68,84,124,158,175],"inherent":[17],"trade-off":[18],"between":[19],"high-precision":[20,92],"of":[22,28,86,119,161],"known":[23,95],"attacks":[24],"and":[25,97,121,127],"high-recall":[26,99],"discovery":[27],"unknown":[29,103],"threats.":[30,104],"We":[31],"proposeD3-Guard,":[32],"a":[33,41,54,63,78,91,98,135,151,169],"novel":[34],"framework":[35],"whose":[36],"core":[37],"innovation":[38],"lies":[39],"decision":[43],"fusion":[44,163],"engine":[45,52],"grounded":[46],"Bayesian":[48,69],"decision-theoretic":[49],"principles.":[50],"The":[51],"computes":[53],"similarity":[55],"score":[56],"from":[57,179],"incoming":[58],"requests":[59],"serve":[61],"as":[62,77],"real-time":[64],"contextual":[65],"signal":[66,75],"for":[67,94,102],"framework.":[70],"It":[71],"then":[72],"uses":[73],"this":[74,145],"directly":[76],"weight":[80],"adaptively":[82],"integrate":[83],"outputs":[85],"two":[87],"complementary":[88],"expert":[89],"models:":[90],"LSTM-Attention":[93],"patterns":[96],"Isolation":[100],"Forest":[101],"This":[105],"synergy,":[106],"reinforced":[107],"by":[108],"an":[109],"adaptive":[110],"update":[111],"layer":[112],"mitigate":[114],"concept":[115],"drift,":[116],"achieves":[117],"F1-scores":[118],"99.39%":[120],"96.97%":[122,180],"on":[123,174],"CSIC":[125],"2010":[126],"ATRDF":[128,176],"2023":[129,177],"datasets,":[130],"respectively.":[131],"Performance":[132],"tests":[133],"production-like":[136],"environment":[137],"further":[138],"validate":[139],"its":[140,184],"practical":[141],"viability,":[142],"demonstrating":[143,183],"that":[144],"high":[146],"accuracy":[147],"is":[148],"achieved":[149],"with":[150],"justifiable":[152],"overhead.":[153],"An":[154],"ablation":[155],"study":[156],"highlights":[157],"pivotal":[159],"role":[160],"our":[162],"engine:":[164],"disabling":[165],"it":[166],"results":[167],"sharp":[170],"decline":[171],"F1-score":[173],"dataset,":[178],"11.47%,":[182],"critical":[185],"contribution":[186],"robust,":[188],"dual-model":[189],"collaboration.":[190]},"counts_by_year":[],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-12-31T00:00:00"}