Abstract

The rapid adoption of cloud computing and virtualized infrastructures has intensified the need for intrusion detection systems (IDS) that are not only accurate but also deployable under real-world operational constraints. Many existing Deep Learning–based IDS achieve high accuracy in offline evaluations by relying on flow-complete or non-causal features that are unavailable during live network monitoring, limiting their practical usability. This paper proposes a near real-time network intrusion detection framework specifically designed for virtualized environments, emphasizing deployability, causal feature availability, and bounded inference latency. The proposed system operates on streaming packet-level data and employs a hybrid CNN–LSTM model to capture both localized feature correlations and temporal traffic patterns. The detection model is trained exclusively on features that can be extracted in real time from packet captures, ensuring compatibility with continuous monitoring scenarios. Experimental evaluation conducted in a controlled virtualized environment demonstrates that the proposed approach achieves high detection performance while maintaining low false positive rates and bounded inference latency below 25 ms per detection window. The results highlight the trade-off between detection accuracy and feature causality, and demonstrate that effective intrusion detection can be achieved without relying on unrealistic offline assumptions, providing a practical pathway for deploying deep learning–based IDS in cloud and virtualized infrastructures.