Distributed and cooperative intrusion detection in cloud networks

Ghribi, Saadia

doi:10.1145/3009925.3009932

Cited by 6 publications

(6 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The proposed approach allows the exchange of security information between interconnected clouds. Ghribi [26] proposes a middleware IDS. The approach allows a cooperation between three layers: Hypervisor-based, Network-based, and VM-based IDS.…”

Section: Related Workmentioning

confidence: 99%

An SVM-based framework for detecting DoS attacks in virtualized clouds under changing environment

2018

View full text Add to dashboard Cite

Cloud Computing enables providers to rent out space on their virtual and physical infrastructures. Denial of Service (DoS) attacks threaten the ability of the cloud to respond to clients requests, which results in considerable economic losses. The existing detection approaches are still not mature enough to satisfy a cloud-based detection systems requirements since they overlook the changing/dynamic environment, that characterises the cloud as a result of its inherent characteristics. Indeed, the patterns extracted and used by the existing detection models to identify attacks, are limited to the current VMs infrastructure but do not necessarily hold after performing new adjustments according to the pay-as-you-go business model. Therefore, the accuracy of detection will be negatively affected. Motivated by this fact, we present a new approach for detecting DoS attacks in a virtualized cloud under changing environment. The proposed model enables monitoring and quantifying the effect of resources adjustments on the collected data. This helps filter out the effect of adjustments from the collected data and thus enhance the detection accuracy in dynamic environments. Our solution correlates as well VMs application metrics with the actual resources load, which enables the hypervisor to distinguish between benignant high load and DoS attacks. It helps also the hypervisor identify the compromised VMs that try to needlessly consume more resources. Experimental results show that our model is able to enhance the detection accuracy under changing environments.

show abstract

Section: Related Workmentioning

confidence: 99%

An SVM-based framework for detecting DoS attacks in virtualized clouds under changing environment

2018

View full text Add to dashboard Cite

show abstract

“…In the rest of this paper, we detail our proposed approach that extends our other works. 2,3 We discuss then the extension of the C-DIDS for fog/cloud computing environment in terms of full architecture, implementation environment and performance comparison.…”

Section: Fog-cloud Intrusion Detection Based Approachmentioning

confidence: 99%

“…This proposed approach is an extension of our other works. 2,3 With the integration of fog computing, in the proposed C-DIDS, there are two kinds of intrusion detection cooperation: cooperation between fog nodes and cooperation between fog computing and cloud computing technologies. It is evaluated in terms of false positive rate and detection delay and how the proposed C-DIDS contributes to secure the cloud environment.…”

Section: Introductionmentioning

confidence: 99%

Fog‐cloud distributed intrusion detection and cooperation

Ghribi

Meddeb-Makhlouf

Zarai

et al. 2019

Trans Emerging Tel Tech

Self Cite

View full text Add to dashboard Cite

Cloud computing is becoming a promoted technology. Over the recent years, it has rapidly grown and its adoption is more and more increasing. Many enterprizes and organizations have immigrated their data to the cloud. However, the security of this technology is considered a serious barrier to guarantee the organizations' trust on it. Therefore, intrusion detection has been set as the best solution to secure the cloud platform. Thus, many research studies have been developed for the aim to create an effective and performing intrusion detection system suitable for the cloud environment. In this paper, we propose a new approach for cloud environment–based multilevel cooperation in terms of intrusion detection. It is based on the cooperation and the correlation between fog nodes at the beginning and then between fog and cloud technology. We also evaluate the performance and the efficiency of this proposed prototype in terms of detection rates and detection response to make real‐time detection in the whole cloud platform. The results show that the proposed architecture introduces low false positive rate compared to the existing hybrid intrusion detection approach in cloud computing (HIDCC) framework.

show abstract

“…In addition, they enable the exchange of knowledge between interconnected clouds. Ghribi [6] proposed a middleware IDS. The approach enables a cooperation between cloud IDS layers: Hypervisorbased IDS, Network-based IDS and VM-based IDS.…”

Section: Related Workmentioning

confidence: 99%

“…The main limitation of existing cloud-based cooperative IDS (e.g. [4] [5] [6] [7] [8] [9]) is that they work under the assumption that all IDSs are trustable, which lets their collaboration systems vulnerable to untrusted (malicious or not) insiders.…”

Section: Introductionmentioning

confidence: 99%

A trust-based game theoretical model for cooperative intrusion detection in multi-cloud environments

Abusitta

Bellaïche

Dagenais

2018

2018 21st Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN)

View full text Add to dashboard Cite

Cloud systems are becoming more complex and vulnerable to attacks. Cyber attacks are also becoming more sophisticated and harder to detect. Therefore, it is increasingly difficult for a single cloud-based intrusion detection system (IDS) to detect all attacks, because of limited and incomplete knowledge about attacks. The recent researches in cyber-security have shown that a cooperation among IDSs can bring higher detection accuracy in such complex computer systems. Through collaboration, a cloud-based IDS can consult other IDSs about suspicious intrusions and increase the decision accuracy. The problem of existing cooperative IDS approaches is that they overlook having untrusted (malicious or not) IDSs that may negatively effect the decision about suspicious intrusions in the cloud. Moreover, they rely on a centralized architecture in which a central agent regulates the cooperation, which contradicts the distributed nature of the cloud. In this paper, we propose a framework that enables IDSs to distributively form trustworthy IDSs communities. We devise a novel decentralized algorithm, based on coalitional game theory, that allows a set of cloud-based IDSs to cooperatively set up their coalition in such a way to make their individual detection accuracy increase, even in the presence of untrusted IDSs.

show abstract

Distributed and cooperative intrusion detection in cloud networks

Cited by 6 publications

References 4 publications

An SVM-based framework for detecting DoS attacks in virtualized clouds under changing environment

An SVM-based framework for detecting DoS attacks in virtualized clouds under changing environment

Fog‐cloud distributed intrusion detection and cooperation

A trust-based game theoretical model for cooperative intrusion detection in multi-cloud environments

Contact Info

Product

Resources

About