Machine learning-based cloud IDS: a systematic literature review and MITRE ATT&CK mapping

Cloud computing has become the backbone of modern digital transformation, enabling scalable, flexible, and cost-efficient resource provisioning across distributed infrastructures. However, the dynamic and shared environment in cloud computing is vulnerable and exposed to security threats and potential intrusions. An intrusion detection system (IDS) is a key defensive system that detects such attacks and allows them to be blocked. The advancement of machine learning (ML) has significantly transformed several domains, including IDS. To analyze how ML is reshaping cloud security, we conducted a systematic literature review (SLR) with an explicit focus on how attacks studied in the literature align with the MITRE ATT&CK Cloud Matrix. The SLR follows the guidelines of the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework to systematically screen and examine publications from 2020 to 2025. We synthesized and evaluated these technical contributions based on the proposed taxonomy by classifying the studies into three major perspectives to better analyze trends across IDS architectures: the Performance Optimization perspective, Learning and Adaptive perspective, and Environment Aware perspective. Moreover, to provide deeper insights into this evolving landscape in cloud environments, we mapped each attack addressed by existing studies to the state-of-the-art Tactics, Techniques, and Common Knowledge of the MITRE ATT&CK Cloud Matrix, showing that the majority of cloud-specific attack vectors remain largely unaddressed in current cloud-based IDS evaluations. These findings provide insights into the current state of ML-based cloud IDS research and help us identify critical gaps. This work serves as a comprehensive reference for researchers and practitioners aiming to understand the landscape of ML-based IDS in cloud environments.