Arguments Against Using the 1998 DARPA Dataset for Cloud IDS Design and Evaluation and Some Alternative

Abstract

Due to the lack of adequate public datasets, the proponents of many existing cloud intrusion detection systems (IDS) have relied on the DARPA dataset to design and evaluate their models. In the current paper, we show empirically that the DARPA dataset by failing to meet important statistical characteristics of real world cloud traffic data center is inadequate for evaluating cloud IDS. We present, as alternative, a new public dataset collected through a cooperation between our lab and a non-profit cloud service provider, which contains benign data and a wide variety of attack data. We present a new hypervisor-based cloud IDS using instanceoriented feature model and supervised machine learning techniques. We investigate 3 different classifiers: Logistic Regression (LR), Random Forest (RF), and Support Vector Machine (SVM) algorithms. Experimental evaluation on a diversified dataset yields a detection rate of 92.08% and a false positive rate of 1.49% for random forest, the best performing of the three classifiers.

A Systematic Review on Anomaly Detection for Cloud Computing Environments

“…References Time series analysis [162], [161], [76], [198], [83], [71], [210], [70] Bayesian learning [118], [85], [14], [103], [159], [50], [35], [128], [105], [157] Principal component analysis [195], [5], [18], [113], [108] Regression analysis [205], [54], [25], [89], [156] Logistic regression [131], [115], [26], [207] Hidden Markov model [79], [78], [11], [170] Markov chain [167], [52], [41] Gaussian mixture models [106], [13] Statistical tests [173], [114] Restricted Boltzmann machine [110], [ [201], [200], [63], Wavelet transform…”