DACS: a learning-assisted expert decision framework for adaptive cryptographic selection in cloud data-at-rest workflows

Cloud storage systems handle files that vary widely in format, size, and sensitivity, yet most encryption pipelines still rely on a single fixed cipher for every file. This mismatch motivates DACS, a learning-assisted expert decision framework for adaptive cipher selection in cloud data-at-rest workflows. The framework rests on an explicit policy that scores candidate ciphers using effective security suitability, estimated data sensitivity, normalized execution cost, and an adaptive security-performance coefficient. A policy-guided inference step ranks the candidates and produces a traceable decision for each file, while a supervised surrogate is trained to reproduce these decisions directly from pre-encryption metadata and statistical descriptors, avoiding repeated policy evaluation at runtime. Across 77,262 labeled instances and 44 retained features, the best-performing ensemble reaches 97.51% accuracy, 95.71% balanced accuracy, and 99.91% macro ROC-AUC on a grouped held-out test set, though cross-domain tests reveal uneven transfer to previously unseen application types. A Kubernetes prototype combining Redis, MinIO, and distributed workers further shows that the decision layer adds only limited latency within the broader encryption pipeline. Rather than proposing a universally optimal cipher, DACS offers a transparent, auditable mechanism for context-aware cryptographic selection in heterogeneous cloud environments.