Differentially Private Optimal Transport for Multi-Cloud Intrusion Detection: A Privacy-Preserving Federated Domain Adaptation Framework

Multi-cloud deployments create critical domain adaptation challenges, where intrusion detection systems trained on one cloud provider must generalize to heterogeneous environments without sharing sensitive security data. Although optimal transport theory provides principled methods for distribution alignment, it has not been applied to network intrusion detection with formal privacy guarantees. This study introduces a comprehensive framework that combines differentially private optimal transport with federated multi-cloud security. We address three fundamental problems: computational intractability through entropic regularization with Sinkhorn divergence achieving O(n 2) complexity versus O(n 3) for exact methods; privacy preservation through (ϵ, δ)-differential privacy with calibrated Gaussian noise maintaining ϵ < 1 while achieving 94.2% detection accuracy; and adversarial robustness through spectral normalization providing certified Lipschitz bounds. Our Privacy-Preserving Federated Optimal Transport Intrusion Detection System (PPFOT-IDS) achieves 94.2% accuracy in cross-cloud scenarios versus 78.3% for standard federated learning baselines, with 15-23× computational speedup through adaptive Sinkhorn scheduling. Extensive evaluation of Integrated Cloud Security 3Datasets (ICS3D) spanning container security, IoT/IIoT environments, and enterprise security operations demonstrates robust performance under Byzantine attacks (maintaining 87.1% accuracy with 40% malicious nodes), strong privacy guarantees (ϵ = 0.85, δ = 5 × 10 −4), and effective handling of distribution shifts between cloud providers. The framework enables secure threat intelligence sharing across organizational boundaries while meeting real-time detection requirements with sub-100 ms latency, providing a novel federated, differentially private optimal transport solution for multi-cloud intrusion detection.