Security in cloud computing has become a major concern due to several factors such as layered cloud architectures, dynamic environments, and exposure to unseen or zero-day attacks. Moreover, intrusion detection systems (IDS) typically operate at specific layers and rely heavily on machine learning models, which often perform well in experimental settings but fail to sustain performance in real cloud deployments. In this work, we implement a confidence-aware multilevel intrusion detection system using reinforcement learning tailored for cloud environments. The system secures three distinct layers: network, host, and hypervisor. Machine learning models at each layer detect known attack patterns, while prediction confidence distinguishes reliable decisions from uncertain outcomes. Within the multi-gate flow, low-confidence events pass through a learned-threshold confidence gate (Gate-1), followed by a Chroma memory-matching gate (Gate-2), with unresolved events escalated to a large language model (LLM) for semantic analysis and explanation. Final attack promotion at Gate-3 uses calibrated LLM confidence or weighted-fusion fallback, while uncertain events are retained in a review bucket to avoid forced classification. Generated explanations and confirmed knowledge are stored in ChromaDB to support future analysis and retraining. The approach is first evaluated using static thresholds, establishing a baseline for comparison. Results show that the proposed system learns adaptive thresholds and reduces LLM escalation by 58.78%, lowering cost while maintaining strong performance (88.68% accuracy, 85.29% precision, 84.72% recall, 85.00% F1). The network and hypervisor layers achieve 98.02% and 97.08% accuracy, demonstrating a balanced and efficient detection system.

翻译：云计算安全已成为重大关切，这主要源于分层云架构、动态环境以及未知或零日攻击暴露等多重因素。此外，入侵检测系统通常在特定层级运作，且高度依赖机器学习模型，这些模型在实验场景中表现良好，但在实际云部署中难以维持性能。本文针对云环境实现了一种基于强化学习的置信感知多层次入侵检测系统。该系统对网络层、主机层和虚拟机监控层三个不同层级进行安全防护。每层的机器学习模型用于检测已知攻击模式，而预测置信度则用以区分可靠决策与不确定结果。在多门控流程中，低置信度事件依次通过基于学习阈值的置信门控（门控-1）和Chroma记忆匹配门控（门控-2），未决事件则升级至大语言模型进行语义分析与解释。在门控-3处，最终攻击判定采用经校准的LLM置信度或加权融合回退机制，同时将不确定事件保留于审查存储桶中，以避免强制分类。生成的解释与已确认知识存储至ChromaDB，以支撑后续分析与重训练。该方法首先通过静态阈值进行评估，建立比较基准。结果表明，所提系统能够学习自适应阈值，并将LLM升级量降低58.78%，在降低成本的同时保持强劲性能（准确率88.68%，精确率85.29%，召回率84.72%，F1值85.00%）。网络层与虚拟机监控层分别达到98.02%和97.08%的准确率，展现了均衡高效的检测系统。