This paper presents a modular and scalable intrusion detection framework that combines graph-based feature extraction, Transformer-based autoencoding, and contrastive learning to improve detection accuracy in cloud environments. Network flows are modeled as graphs to capture relational patterns among IP addresses and services, and a Graph Neural Network (GNN) is used to extract structured embeddings. These embeddings are refined through a Transformer-based autoencoder to preserve contextual information, while contrastive learning enforces clear class separation during classification. The system is evaluated on NSL-KDD and CIC-IDS2018 datasets under both binary and multi-class scenarios. Experimental results show an average accuracy of 99.97%, with high precision and recall across all attack types, including minority classes such as U2R and R2L. The model achieves low false-positive rates and demonstrates real-time inference performance with modest resource requirements. Key contributions include an interpretable pipeline using SHAP for feature attribution, a strategy for mitigating class imbalance, and validation across datasets with detailed security and generalizability analyses. These results support the practical applicability of the proposed approach in high-throughput, cloud-based network environments.

The cloud-fog computing paradigm has transformed the field of distributed computing and at the same time brought about unparalleled security risks to the critical infrastructure systems. Conventional security models are limited in real-time threat identification and this leads to high false positive vulnerabilities, as well as poor response mechanisms. This paper presents a new AI-supported security architecture, called SecureRiskNet, which is a synergistic system of advanced deep learning architectural frameworks and smart risk quantification algorithms that are used to detect all threats in heterogeneous cloud-fog networks. Our approach methodology uses hybrid detection mechanism as a combination of Isolation Forest to detect anomalies without supervision, and Long Short-Term Memory (LSTM) networks to identify temporal patterns, detecting both known and zero-day attacks. The framework views the multi-layered feature fusion techniques as the correlation of network traffic patterns to cloud resource utilization metrics and generates better cross-domain anomaly detection. SecureRiskNet achieves 96.2% accuracy, 0.95 precision, 0.96 recall, and 0.967 AUC, while maintaining sub-1.5 ms inference latency across fog deployments, demonstrating superior performance and real-time suitability for resource-constrained environments. The offered entropy-weighted dynamic risk scoring with the Principal Component Analysis (PCA) optimization facilitates prioritized threat management in real-time and allows the deployment on distributed infrastructures.