Towards Self Adaptable Security Monitoring in IaaS Clouds

Abstract

Abstract-Traditional intrusion detection systems are not adaptive enough to cope with the dynamic characteristics of cloud-hosted virtual infrastructures. This makes them unable to address new cloud-oriented security issues. In this paper we introduce SAIDS, a self-adaptable intrusion detection system tailored for cloud environments. SAIDS is designed to reconfigure its components based on environmental changes. A prototype of SAIDS is described.

AL-SAFE: A Secure Self-Adaptable Application-Level Firewall for IaaS Clouds

“…AL-SAFE is a secure, introspection-based, twolevel, application level firewall. It is part of our self-adaptable security monitoring framework for IaaS clouds [12]. AL-SAFE rulesets are automatically reconfigured upon the occurrence of changes in two different levels: the cloud infrastructure (e.g.…”

“…If this is true it extracts the process name, the pid as well as source and destination port, IP and protocol. The time elapsed between two consecutive snapshots/introspections is defined by the tenant and can be dynamically adapted by the Adaptation Manager [12].…”

“…The Information Extraction Agent compares the list of processes that attempt to send/receive network packets with a white list of processes that are allowed to make connections. The Adaptation Manager [12] is responsible for sharing the white list with the Information Extraction Agent through a secure channel. The IEA allows the connection if it finds a match and blocks the connection otherwise.…”