DCDIDP: A Distributed, Collaborative, and Data-driven Intrusion Detection and Prevention Framework for Cloud Computing Environments

Abstract

Abstract-With the growing popularity of cloud computing, the exploitation of possible vulnerabilities grows at the same pace; the distributed nature of the cloud makes it an attractive target for potential intruders. Despite security issues delaying its adoption, cloud computing has already become an unstoppable force; thus, security mechanisms to ensure its secure adoption are an immediate need. Here, we focus on intrusion detection and prevention systems (IDPSs) to defend against the intruders. In this paper, we propose a Distributed, Collaborative, and Datadriven Intrusion Detection and Prevention system (DCDIDP). Its goal is to make use of the resources in the cloud and provide a holistic IDPS for all cloud service providers which collaborate with other peers in a distributed manner at different architectural levels to respond to attacks. We present the DCDIDP framework, whose infrastructure level is composed of three logical layers: network, host, and global as well as platform and software levels. Then, we review its components and discuss some existing approaches to be used for the modules in our proposed framework. Furthermore, we discuss developing a comprehensive trust management framework to support the establishment and evolution of trust among different cloud service providers.

Distributed Denial-of-Service (DDoS) Attacks and Defense Mechanisms in Various Web-Enabled Computing Platforms

“…3. The extent of collaborative environments like cloud computing (Bhushan & Gupta, 2018;Joshi et al, 2012;Mishra et al, 2021;Xiao & Xiao, 2012; and IoT (Chui et al, 2019;Cvitić et al, 2021;Evans, 2011;Kolias et al, 2017;Marr, 2021;Munshi et al, 2020;Sambandam et al, 2018;Zargar et al, 2011) present more and more new avenues for attackers to exploit, like the IoT botnets that include dedicated systems as well as mobile devices, simple home appliances, and IoV-based automotive, etc. DDoS-for-hire services have also increased due to such simple targets since these devices lack significantly in terms of security.…”

Towards Novel Security Architectures for Network Functions Virtualization

“…V. RELATED WORK Some basic concepts about remote detection, context sharing, and agent-based cyber-security frameworks were already explored in the past [6]- [8]. In many cases, legacy security appliances are used and their output is correlated; the duplication at the local and global level introduces redundancy and also communication overhead.…”

A Distributed Monitoring Approach for Trust Assessment Based on Formal Testing

“…The complete scenario is revealed when relationships are created from different network traces. Several works like [16,14] using different approaches have exposed intrusion detection systems (IDS) that are collaborative or distributed as a solution to detect possible attacks (such as, to detect a distributed denial of service (DDoS)). Collaborative or distributed IDSs can observe that different hosts located at different networks are sending network packets to the final common target.…”