Abstract

We require high accuracy, low latency and minimal false positive rate (FPR) in cloud DLP models when placed directly in the traffic path. Existing deep learning models exceed the 1ms per packet latency constraint, while fast and simple models cause high false positive rates, causing alert fatigue in Security Operation Centers (SOCs). We propose a soft-voting hybrid ensemble combining Light Gradient Boosting Machine (LightGBM) and eXtreme Gradient Boosting (XGBoost). The architecture uses LightGBM’s Gradient-based One-Side Sampling (GOSS) for sub-millisecond feature filtration and XGBoost’s L2 regularization to reduce false alarms. Evaluated on the CICIDS2017 dataset within a Google Cloud environment, the proposed model achieved both fast speed and high accuracy together. The model achieved an inference latency of 0.1098 ms per packet and kept the FPR down to 0.02%, while maintaining 97.80% accuracy and a 97.90% F1-score. These results confirm that the system works fast enough for cloud packet inspection without overloading security analysts.