cl-CIDPS: A Cloud Computing Based Cooperative Intrusion Detection and Prevention System Framework

Abstract

Abstract. Cloud Computing is one of today's most promising technologies due to its cost-efficiency, flexibility and scalability for computing processes. However, the complex architecture of cloud infrastructure and the different levels of users lead to special requirements especially in security area. The Cloud provider is responsible for providing secure, reliable and trustful services to its consumers. Network intrusion detection system and network intrusion prevention system (IDPS), is a pioneer active security-defensive mechanism that is ideal to be used in cloud computing. Collaborative or cooperative IDS had been a hot topic for the last few years. However, there were some limitations in previous techniques indicating that they are not sufficient to cover all security threats in clouds. The main objective is to propose a cloud based cooperative intrusion detection and prevention system (cl-CIDPS). The system adds several contributions to the area of IDPS in clouds by proposing an integrated design that considers detection, prevention and logging capabilities applying both signature and anomaly detection mechanisms. cl-CIDPS was evaluated using a powerful network security simulator tool (Nessi2) that is capable of testing detection units and communication schemas. NeSSi2 was extended for a cloudbased IDPS presenting a valuable simulation background that can be used by future researches to evaluate similar proposed techniques for cloud computing infrastructure.

Intrusion detection systems in the cloud computing: A comprehensive and deep literature review

“…Also, a cloud-oriented accommodating ID and stoppage mechanism was presented by Al-Mousa and Nasir. 89 The system adds some contributions to the cloud by suggesting a unified scheme for spotting, stoppage, and logging abilities using signature and anomaly spotting systems. A simulator was used to evaluate and test the spotting units and communication diagrams.…”

Assessing Risks and Cloud Readiness in PaaS Environments

“…Security threats can be categorized as external attacks, theft related attacks, system malfunction, service interruption and human errors. The impact ratings and likelihood of high level threats are identified, analyzed and mitigated [21].The cloud oriented cooperative intrusion detection systems using signature mechanisms are used with Nessi2 as a simulator tool for cloud security [22]. Fuzzy Self organizing maps are used in past for improving the networking capabilities of cloud [23].System privacy risks are mitigated by a PIA(privacy assessment tool) which informs decision makers to decide how the project will proceed [24].One more methodology supports behavior engineering for model based process improvement and assessment in cloud computing.…”

<strong>A Network Intrusion Based Detection System for Cloud Computing Environment</strong>

“…The proposed C-NIDS detects network intrusion in cloud environment, handle rigid traffic in cloud without packet loss/drop. In the paper authors [16] explained placement and integration of NIDS in various ways using front end ,back end and on virtual machine. It was detected that if we positioned and integrate NIDS on front end then network intrusion on external network will be easily identified and if NIDS is integrated on virtual machine then the user will detect intrusion on his own virtual machine very efficiently.…”

“…The proposed framework was integrated at each cluster and bully election algorithm is used to elect best cluster for integration of Collaborative Unit(CU). A decision tree classifier and SVM is used to improve detection accuracy and efficiency of cloud system and for detection of intruder [16]. A nonconventional method was proposed by authors [17] to secure cloud environment from malicious attackers with use of network profiling.…”