Distributed Intrusion Detection in Clouds Using Mobile Agents

Dastjerdi, Amir Vahid; Bakar, Kamalrulnizam Abu; Tabatabaei, Sayed Gholam Hassan

doi:10.1109/advcomp.2009.34

Cited by 84 publications

(45 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In more detail, we denote µ to be the mean vector of the resulting snapshot IMFs matrix Y (t) 5 for each feature column f (t) in a V M (t). Having µ for every f (t) we now have a newly composed matrix X(t) = [µ 1 , µ 2 , · · · , µ n ] that provides a summarizing IMF description for each VM snapshot.…”

Section: B Anomaly Detection Methods 1) General Notationmentioning

confidence: 99%

“…Similarly with the first steps in the construction of the normal behaviour, every tested VM snapshot has to firstly be transformed by the E-EMD algorithm 5 Due to the fact that some features were shown to be decomposed by a lesser or one more IMFs than others we had to empirically refine our initial measurement matrix and work on subset matrices that had the same dimensions. After computing the summarizing statistics we could then aggregate all of them together and reconstruct the initial measurement matrix.…”

Section: B Anomaly Detection Methods 1) General Notationmentioning

confidence: 99%

“…A significant portion of studies that attempted to formulate security mechanisms (e.g. [4], [5]) aimed to adjust the performance of traditional Intrusion Detection Systems (IDS) under signature rule-based strategies that employ Deep Packet Inspection (DPI) on network packets. In parallel, work in [6], [7] managed to monitor system-related features on the Virtual Machine (VM) level by employing Virtual Machine Introspection (VMI) methods in order to analyse and detect threats on the VM Operating System (OS).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Marnerides

Spachos

Chatzimisios

et al. 2015

2015 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

Abstract-Cloud networks underpin most of todays' socioeconomical Information Communication Technology (ICT) environments due to their intrinsic capabilities such as elasticity and service transparency. Undoubtedly, this increased dependence of numerous always-on services with the cloud is also subject to a number of security threats. An emerging critical aspect is related with the adequate identification and detection of malware.In the majority of cases, malware is the first building block for larger security threats such as distributed denial of service attacks (e.g. DDoS); thus its immediate detection is of crucial importance. In this paper we introduce a malware detection technique based on Ensemble Empirical Mode Decomposition (E-EMD) which is performed on the hypervisor level and jointly considers system and network information from every Virtual Machine (VM). Under two pragmatic cloud-specific scenarios instrumented in our controlled experimental testbed we show that our proposed technique can reach detection accuracy rates over 90% for a range of malware samples. In parallel we demonstrate the superiority of the introduced approach after comparison with a covariance-based anomaly detection technique that has been broadly used in previous studies. Consequently, we argue that our presented scheme provides a promising foundation towards the efficient detection of malware in modern virtualized cloud environments.

show abstract

Section: B Anomaly Detection Methods 1) General Notationmentioning

confidence: 99%

Section: B Anomaly Detection Methods 1) General Notationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Marnerides

Spachos

Chatzimisios

et al. 2015

2015 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

show abstract

“…The IDS instance that collects data is often known as a probe or sensor. An exemplary solution following this approach is described in [25], where authors proposed that IDS instances located in different regions of the provider's network are able independently to detect attacks and "warn" proper network devices operating in other regions.…”

Section: Intrusion Detection In Cloud Systemsmentioning

confidence: 99%

A distributed IDS architecture model for Smart Home systems

et al. 2017

View full text Add to dashboard Cite

The common use of smart devices encourages potential attackers to violate privacy. Sometimes taking control of one device allows the attacker to obtain secret data (such as password for home WiFi network) or tools to carry out DoS attack, and this, despite the limited resources of such devices. One of the solutions for gaining users' confidence is to assign responsibility for detecting attacks to the service provider, particularly Internet Service Provider (ISP). It is possible, since ISP often provides also the Home Gateway (HG)-device that has multiple roles: residential router, entertainment center, and home's "command and control" center which allows to manage the Smart Home entities. The ISP may extend this set of functionalities by implementing an intrusion detection software in HG provisioned to their customers. In this article we propose an Intrusion Detection System (IDS) distributed between devices residing at user's and ISP's premises. The Home Gateway IDS and the ISP's IDS constitute together a distributed structure which allows spreading computations related to attacks against Smart Home ecosystem. On the other hand, it also leverages the operator's knowledge of security incidents across the customer premises. This distributed structure is supported by the ISP's expert system that helps to detect distributed attacks i.e., using botnets.

show abstract

“…In [16] the VMs are attached to MA, which collects evidences of an attack from all the attacked VMs for further analysis and auditing. Then, they have to correlate and aggregate that data to detect distributed attacks.…”

Section: Relevant Work and Limitationsmentioning

confidence: 99%

Use Trust Management Framework to Achieve Effective Security Mechanisms in Cloud Environment

Toumi¹,

Marzak²,

Talea³

et al. 2017

IJIMAI

View full text Add to dashboard Cite

-Cloud Computing is an Internet based Computing where virtual shared servers provide software, infrastructure, platform and other resources to the customer on pay-as-you-use basis. Cloud Computing is increasingly becoming popular as many enterprise applications and data are moving into cloud platforms. However, with the enormous use of Cloud, the probability of occurring intrusion also increases. There is a major need of bringing security, transparency and reliability in cloud model for client satisfaction. One of the security issues is how to reduce the impact of any type of intrusion in this environment. To address this issue, a security solution is proposed in this paper. We provide a collaborative framework between our Hybrid Intrusion Detection System (Hy-IDS) based on Mobile Agents and virtual firewalls. Therefore, our hybrid intrusion detection system consists of three types of IDS namely IDS-C, IDS-Cr and IDS-M, which are dispatched over three layer of cloud computing. In the first layer, we use IDS-C over our framework to collect, analyze and detect malicious data using Mobile Agents. In case of attack, we collect at the level of the second layer all the malicious data detected in the first layer for the generation of new signatures using IDS-Cr, which is based on a Signature Generation Algorithm (SGA) and network intrusion detection system (NIDS). Finally, through an IDS-M placed in the third layer, the new signatures will be used to update the database NIDS belonging to IDS-Cr, then the database to NIDS belonging of IDS-Cr the cluster neighboring and also their IDS-C. Hardware firewall is unable to control communication between virtual machines on the same hypervisor. Moreover, they are blind to virtual traffic. Mostly, they are deployed at Virtual Machine Monitor-level (VMM) under Cloud provider's control. Equally, the mobile agents play an important role in this collaboration. They are used in our framework for investigation of hosts, transfer data malicious and transfer update of a database of neighboring IDS in the cloud. With this technique, the neighboring IDS will use these new signatures to protect their area of control against the same type of attack. By this type of close-loop control, the collaborative network security management framework can identify and address new distributed attacks more quickly and effectively.

show abstract

Distributed Intrusion Detection in Clouds Using Mobile Agents

Cited by 84 publications

References 7 publications

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

A distributed IDS architecture model for Smart Home systems

Use Trust Management Framework to Achieve Effective Security Mechanisms in Cloud Environment

Contact Info

Product

Resources

About