Abstract

Cloud computing infrastructures are increasingly targeted by sophisticated and continuously evolving cyberattacks, making robust Intrusion Detection Systems (IDS) essential. A large amount of recent work follows detection accuracy through deep learning or metaheuristic optimization. These methods are, however, very compute-intensive and cannot be practically used in resource-poor cloud nodes. We propose a lightweight IDS framework based on an Extreme Gradient Boosting (XGBoost) classifier, and compare it with a baseline Random Forest, a LightGBM model, and a three-member soft-voting ensemble (Random Forest + Logistic Regression + Histogram Gradient Boosting). All models are assessed on the NSL-KDD benchmark and independently validated on the modern CICIDS2017 dataset, using ten random seeds per model with reported means, standard deviations, and paired significance tests. We additionally report training time, inference time, memory footprint, and CPU time, together with an ablation study and per-attack-class analysis. The results show that the gradient-boosted tree attains the highest accuracy and F1-score on both datasets while training in roughly one-sixth of the time and using roughly half the memory of the voting ensemble, indicating that a single boosted-tree model is a more favourable accuracy–cost operating point than the heavier alternatives for cloud-based intrusion detection.