A survey of intrusion detection techniques in Cloud
---
paper_title: On securing untrusted clouds with cryptography

paper_content:

In a recent interview, Whitfield Diffie argued that "the whole point of cloud computing is economy" and while it is possible in principle for "computation to be done on encrypted data, [...] current techniques would more than undo the economy gained by the outsourcing and show little sign of becoming practical". Here we explore whether this is truly the case and quantify just how expensive it is to secure computing in untrusted, potentially curious clouds. We start by looking at the economics of computing in general and clouds in particular. Specifically, we derive the end-to-end cost of a CPU cycle in various environments and show that its cost lies between 0.5 picocents in efficient clouds and nearly 27 picocents for small enterprises (1 picocent = $1 x 10-14), values validated against current pricing. We then explore the cost of common cryptography primitives as well as the viability of their deployment for cloud security purposes. We conclude that Diffie was correct. Securing outsourced data and computation against untrusted clouds is indeed costlier than the associated savings, with outsourcing mechanisms up to several orders of magnitudes costlier than their non-outsourced locally run alternatives.
---
paper_title: DKSM: Subverting Virtual Machine Introspection for Fun and Profit

paper_content:

Virtual machine (VM) introspection is a powerful technique for determining the specific aspects of guest VM execution from outside the VM. Unfortunately, existing introspection solutions share a common questionable assumption. This assumption is embodied in the expectation that original kernel data structures are respected by the untrusted guest and thus can be directly used to bridge the well-known semantic gap. In this paper, we assume the perspective of the attacker, and exploit this questionable assumption to subvert VM introspection. In particular, we present an attack called DKSM (Direct Kernel Structure Manipulation), and show that it can effectively foil existing VM introspection solutions into providing false information. By assuming this perspective, we hope to better understand the challenges and opportunities for the development of future reliable VM introspection solutions that are not vulnerable to the proposed attack.
---
paper_title: Distributed Intrusion Detection in Clouds Using Mobile Agents

paper_content:

Cloud Computing extends an enterprise ability to meet the computing demands of its everyday operations, while offering flexibility, mobility and scalability. However, the reason that Chief Information Officers (CIOs) and their colleagues hesitate to let their business workloads to move from private Cloud into public Cloud is security. This work tries to offer a line of defense by applying Mobile Agents technology to provide intrusion detection for Cloud applications regardless of their locations. Therefore, CIOs feel safer to use Cloud to extend their on-premise infrastructure by adding capacity on demand.
---
paper_title: A Cooperative Intrusion Detection System Framework for Cloud Computing Networks

paper_content:

Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To provide secure and reliable services in cloud computing environment is an important issue. One of the security issues is how to reduce the impact of denial-of-service (DoS) attack or distributed denial-of-service (DDoS) in this environment. To counter these kinds of attacks, a framework of cooperative intrusion detection system (IDS) is proposed. The proposed system could reduce the impact of these kinds of attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack.
---
paper_title: Securing cloud from ddos attacks using intrusion detection system in virtual machine

paper_content:

Cloud Computing is the newly emerged technology of Distributed Computing System. Cloud Computing user concentrate on API security & provide services to its consumers in multitenant environment into three layers namely, Software as a service, Platform as a service and Infrastructure as a service, with the help of web services. It provides service facilities to its consumers on demand . These service provided can easily invites attacker to attack by Saas ,Paas, Iaas. Since the resources are gathered at one place in data centers in cloud computing, the DDOS attacks such as HTTP & XML in this environment is dangerous & provides harmful effects and also all consumer will be affected at the same time. These attacks can be resolved & detected by a proposed methodology, “Securing cloud from DDOS attacks using intrusion detection system in virtual machine”.In this methodology, this problem can be overcome by using proposed system. The different kinds of vulnerabilities are detected in proposed system. The SOAP request makes the communication between the client and the service provider. Through the Service Oriented Traceback Architecture the SOAP request is send to the cloud. In this architecture service oriented trace back mark is present which contain proxy within it. The proxy that marks the incoming packets with source message identification to identify the real client. Then the SOAP message is travelled via XDetector. The XDetectors used to monitors and filters the DDoS attacks such as HTTP and XML DDoS attack. Finally the filtered real clinet message is transferred to the cloud service provider and the corresponding services is given to the client in secured manner .
---
paper_title: A Cooperative Intrusion Detection System Framework for Cloud Computing Networks

paper_content:

Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To provide secure and reliable services in cloud computing environment is an important issue. One of the security issues is how to reduce the impact of denial-of-service (DoS) attack or distributed denial-of-service (DDoS) in this environment. To counter these kinds of attacks, a framework of cooperative intrusion detection system (IDS) is proposed. The proposed system could reduce the impact of these kinds of attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack.
---
paper_title: An Intelligent Lightweight Intrusion Detection System with Forensics Technique

paper_content:

This paper presents an intelligent lightweight IDS, which used the forensics technique to profile the user behavior in order to automate the maintenance of user profile, data mining technique to find out the cooperative attack, and watermark technique to trace back the hackers or intruders. The goal of the system is to detect the intrusion real-time, effectively and efficiently.
---
paper_title: A Virtual Machine Introspection Based Architecture for Intrusion Detection

paper_content:

Today’s architectures for intrusion detection force the IDS designer to make a difficult choice. If the IDS resides on the host, it has an excellent view of what is happening in that host’s software, but is highly susceptible to attack. On the other hand, if the IDS resides in the network, it is more resistant to attack, but has a poor view of what is happening inside the host, making it more susceptible to evasion. In this paper we present an architecture that retains the visibility of a host-based IDS, but pulls the IDS outside of the host for greater attack resistance. We achieve this through the use of a virtual machine monitor. Using this approach allows us to isolate the IDS from the monitored host but still retain excellent visibility into the host’s state. The VMM also offers us the unique ability to completely mediate interactions between the host software and the underlying hardware. We present a detailed study of our architecture, including Livewire, a prototype implementation. We demonstrate Livewire by implementing a suite of simple intrusion detection policies and using them to detect real attacks.
---
paper_title: Distributed Intrusion Detection in Clouds Using Mobile Agents

paper_content:

Cloud Computing extends an enterprise ability to meet the computing demands of its everyday operations, while offering flexibility, mobility and scalability. However, the reason that Chief Information Officers (CIOs) and their colleagues hesitate to let their business workloads to move from private Cloud into public Cloud is security. This work tries to offer a line of defense by applying Mobile Agents technology to provide intrusion detection for Cloud applications regardless of their locations. Therefore, CIOs feel safer to use Cloud to extend their on-premise infrastructure by adding capacity on demand.
---
paper_title: A CP Intrusion Detection Strategy on Cloud Computing

paper_content:

Cloud Computing is a general concept of the computing service which is reliance on the Internet for satisfying the computing needs of the users. The providers and the users of the service will be benefit for the new organization pattern. In this paper, we propose a framework for the construction of a CP intrusion detection system in E-Government. The idea can help people construct a flexible security system based on a well organized strategy and statistical model. Index Terms—Cloud Computing; E-Government; Intrusion Detection
---
paper_title: Real-Time Intrusion Prevention and Anomaly Analyze System for Corporate Networks

paper_content:

This document represent intrusion prevention system for high speed corporate networks architecture and results of attack detection system memory consuming optimizations for high loaded networks.
---
paper_title: Application of neural networks in network control and information security

paper_content:

The increment of intrusions and bad uses in computer systems and internal networks of a great number of companies has caused an increase in concern for computer security. For some time one comes applying measures based on fire walls and in systems of intrusion detection (IDS). In this document we present an alternative to the problem of the IDS based on rules, using two different neural networks, a Multi-Layer perceptron, and a self organizative map. A series of experiments are carried out and the results are shown to be better than others found in the literature.
---
paper_title: Data Mining Concepts and Techniques

paper_content:

Understand the need for analyses of large, complex, information-rich data sets. Identify the goals and primary tasks of the data-mining process. Describe the roots of data-mining technology. Recognize the iterative character of a data-mining process and specify its basic steps. Explain the influence of data quality on a data-mining process. Establish the relation between data warehousing and data mining. Data mining is an iterative process within which progress is defined by discovery, through either automatic or manual methods. Data mining is most useful in an exploratory analysis scenario in which there are no predetermined notions about what will constitute an "interesting" outcome. Data mining is the search for new, valuable, and nontrivial information in large volumes of data. It is a cooperative effort of humans and computers. Best results are achieved by balancing the knowledge of human experts in describing problems and goals with the search capabilities of computers. In practice, the two primary goals of data mining tend to be prediction and description. Prediction involves using some variables or fields in the data set to predict unknown or future values of other variables of interest. Description, on the other hand, focuses on finding patterns describing the data that can be interpreted by humans. Therefore, it is possible to put data-mining activities into one of two categories: Predictive data mining, which produces the model of the system described by the given data set, or Descriptive data mining, which produces new, nontrivial information based on the available data set.
---
paper_title: Artificial Neural Networks for Misuse Detection

paper_content:

Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder. Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks. However, these techniques are less successful in identifying attacks which vary from expected patterns. Artificial neural networks provide the potential to identify and classify network activity based on limited, incomplete, and nonlinear data sources. We present an approach to the process of misuse detection that utilizes the analytical strengths of neural networks, and we provide the results from our preliminary analysis of this approach.
---
paper_title: Data Mining Concepts and Techniques

paper_content:

Understand the need for analyses of large, complex, information-rich data sets. Identify the goals and primary tasks of the data-mining process. Describe the roots of data-mining technology. Recognize the iterative character of a data-mining process and specify its basic steps. Explain the influence of data quality on a data-mining process. Establish the relation between data warehousing and data mining. Data mining is an iterative process within which progress is defined by discovery, through either automatic or manual methods. Data mining is most useful in an exploratory analysis scenario in which there are no predetermined notions about what will constitute an "interesting" outcome. Data mining is the search for new, valuable, and nontrivial information in large volumes of data. It is a cooperative effort of humans and computers. Best results are achieved by balancing the knowledge of human experts in describing problems and goals with the search capabilities of computers. In practice, the two primary goals of data mining tend to be prediction and description. Prediction involves using some variables or fields in the data set to predict unknown or future values of other variables of interest. Description, on the other hand, focuses on finding patterns describing the data that can be interpreted by humans. Therefore, it is possible to put data-mining activities into one of two categories: Predictive data mining, which produces the model of the system described by the given data set, or Descriptive data mining, which produces new, nontrivial information based on the available data set.
---
paper_title: A real-time network intrusion detection system for large-scale attacks based on an incremental mining approach

paper_content:

None of the previously proposed Network Intrusion Detection Systems (NIDSs), which are subject to fuzzy association rules, can meet real-time requirements because they all apply static mining approaches. This study proposed a real-time NIDS with incremental mining for fuzzy association rules. By consistently comparing the two rule sets, one mined from online packets and the other mined from training attack-free packets, the proposed system can render a decision every 2 seconds. Thus, compared with traditional static mining approaches, the proposed system can greatly improve efficiency from offline detection to real-time online detection. Since the proposed system derives features from packet headers only, like the previous works based on fuzzy association rules, large-scale attack types are focused. Many DoS attacks were experimented in this study. Experiments were performed to demonstrate the excellent effectiveness and efficiency of the proposed system. The system may not cause false alarms because normal programs supposedly would not generate enough mal-formatted packets, or packets that violate normal network protocols.
---
paper_title: Fuzzy Intrusion Detection System

paper_content:

A framework for intrusion detection system (IDS) over TCP/IP network is proposed. The key idea is to use soft computing for detecting intrusive behaviors and Denial of Service attacks (DoS). The basic intent of a DoS attack either overwhelms the resources allocated by a networked device to a particular service in order to prevent its use or crashes a target device or system. This will cause disaster in network environment. To protect the most valuable possession from these malicious attempts is so essential. Fuzzy rule-based system has been introduced to implement IDS in this framework. The experimental results reveal that the proposed framework yields better result of detection than traditional threshold-based detection.
---
paper_title: Adaptive neuro-fuzzy intrusion detection systems

paper_content:

The Intrusion Detection System architecture commonly used in commercial and research systems have a number of problems that limit their configurability, scalability or efficiency. In this paper, two machine-learning paradigms, Artificial Neural Networks and Fuzzy Inference System, are used to design an Intrusion Detection System. SNORT is used to perform real time traffic analysis and packet logging on IP network during the training phase of the system. Then a signature pattern database is constructed using protocol analysis and Neuro-Fuzzy learning method. Using 1998 DARPA Intrusion Detection Evaluation Data and TCP dump raw data, the experiments are deployed and discussed.
---
paper_title: A novel rule-based Intrusion Detection System using data mining

paper_content:

Network security is becoming an increasingly important issue, since the rapid development of the Internet. Network Intrusion Detection System (IDS), as the main security defending technique, is widely used against such malicious attacks. Data mining and machine learning technology has been extensively applied in network intrusion detection and prevention systems by discovering user behavior patterns from the network traffic data. Association rules and sequence rules are the main technique of data mining for intrusion detection. Considering the classical Apriori algorithm with bottleneck of frequent itemsets mining, we propose a Length-Decreasing Support to detect intrusion based on data mining, which is an improved Apriori algorithm. Experiment results indicate that the proposed method is efficient.
---
paper_title: Using data mining to discover signatures in network-based intrusion detection

paper_content:

In network-based intrusion detection, signatures discovery is an important issue, since the performance of an intrusion detection system heavily depends on accuracy and abundance of signatures. In most cases, we have to find these signatures manually. This is a time-consuming and error-prone work. We present a data mining method based on an approach to support signature discovery in a network-based intrusion detection system, which generates signatures for a misuse detection intrusion detection system (IDS) not only depending on associations of attributes of the transfer protocol, but also on the content of traffic. Until now, no paper has studied how to mine content of traffic to generate signatures for an IDS. Our work allows people to find signatures of an intrusion easily and provides a third party IDS (for example, Snort) with candidate signatures. In order to discover signatures, we present an algorithm called Signature Apriori. An experimental system named SigSniffer has been implemented to test the feasibility of the proposed approach.
---
paper_title: Data Mining Concepts and Techniques

paper_content:

Understand the need for analyses of large, complex, information-rich data sets. Identify the goals and primary tasks of the data-mining process. Describe the roots of data-mining technology. Recognize the iterative character of a data-mining process and specify its basic steps. Explain the influence of data quality on a data-mining process. Establish the relation between data warehousing and data mining. Data mining is an iterative process within which progress is defined by discovery, through either automatic or manual methods. Data mining is most useful in an exploratory analysis scenario in which there are no predetermined notions about what will constitute an "interesting" outcome. Data mining is the search for new, valuable, and nontrivial information in large volumes of data. It is a cooperative effort of humans and computers. Best results are achieved by balancing the knowledge of human experts in describing problems and goals with the search capabilities of computers. In practice, the two primary goals of data mining tend to be prediction and description. Prediction involves using some variables or fields in the data set to predict unknown or future values of other variables of interest. Description, on the other hand, focuses on finding patterns describing the data that can be interpreted by humans. Therefore, it is possible to put data-mining activities into one of two categories: Predictive data mining, which produces the model of the system described by the given data set, or Descriptive data mining, which produces new, nontrivial information based on the available data set.
---
paper_title: Application of SVM and ANN for intrusion detection

paper_content:

The popularization of shared networks and Internet usage demands increases attention on information system security, particularly on intrusion detection. Two data mining methodologies-Artificial Neural Networks (ANNs) and Support Vector Machine (SVM) and two encoding methods-simple frequency-based scheme and tfi?idf scheme are used to detect potential system intrusions in this study. Our results show that SVM with tfi?idf scheme achieved the best performance, while ANN with simple frequency-based scheme achieved the worst. The data used in experiments are BSM audit data from the DARPA 1998 Intrusion Detection Evaluation Program at MIT's Lincoln Labs.
---
paper_title: Intrusion Detection Using Data Mining Along Fuzzy Logic and Genetic Algorithms

paper_content:

Summary Intrusion Detection is one of the important area of research. Our work has explored the possibility of integrating the fuzzy logic with Data Mining methods using Genetic Algorithms for intrusion detection. The reasons for introducing fuzzy logic is two fold, the first being the involvement of many quantitative features where there is no separation between normal operations and anomalies. Thus fuzzy association rules can be mined to find the abstract correlation among different security features. We have proposed architecture for Intrusion Detection methods by using Data Mining algorithms to mine fuzzy association rules by extracting the best possible rules using Genetic Algorithms.
---
paper_title: Detecting new forms of network intrusion using genetic programming

paper_content:

How to find and detect novel or unknown network attacks is one of the most important objectives in current intrusion detection systems. In this paper, a rule evolution approach based on genetic programming (GP) for detecting novel attacks on network is presented and four genetic operators namely reproduction, mutation, crossover and dropping condition operators are used to evolve new rules. New rules are used to detect novel or known network attacks. A training and testing dataset proposed by DARPA is used to evolve and evaluate these new rules. The proof of concept implementation shows that the rule generated by GP has a low false positive rate (FPR), a low false negative rate (FNR) and a high rate of detecting unknown attacks. Moreover, the rule base composed of new rules has high detection rate (DR) with low false alarm rate (FAR).
---
paper_title: A software implementation of a genetic algorithm based approach to network intrusion detection

paper_content:

With the rapid expansion of Internet in recent years, computer systems are facing increased number of security threats. Despite numerous technological innovations for information assurance, it is still very difficult to protect computer systems. Therefore, unwanted intrusions take place when the actual software systems are running. Different soft computing based approaches have been proposed to detect computer network attacks. This paper presents a genetic algorithm (GA) based approach to network intrusion detection, and the software implementation of the approach. The genetic algorithm is employed to derive a set of classification rules from network audit data, and the support-confidence framework is utilized as fitness function to judge the quality of each rule. The generated rules are then used to detect or classify network intrusions in a real-time environment. Unlike most existing GA-based approaches, because of the simple representation of rules and the effective fitness function, the proposed method is easier to implement while providing the flexibility to either generally detect network intrusions or precisely classify the types of attacks. Experimental results show the achievement of acceptable detection rates based on benchmark DARPA data sets on intrusions, while no other complementary techniques or relevant heuristics are applied.
---
paper_title: An efficient network intrusion detection method based on information theory and genetic algorithm

paper_content:

The Internet has been growing at an amazing rate and concurrent with the growth, the vulnerability of the Internet is also increasing. Though the Internet has been designed to withstand various forms of failure, the intrusion tools and attacks are becoming increasingly sophisticated, exposing the Internet to new threats. To make networked systems reliable and robust it becomes highly essential to develop on-line monitoring, analysis and quantification of the behavior of networks under a wide range of attacks and to recover from these attacks. In this paper, we present a hybrid method based on information theory and genetic algorithm to detect network attacks. Our approach uses information theory to filter the traffic data and thus reduce the complexity. We use a linear structure rule to classify the network behaviors into normal and abnormal behaviors. We apply our approach to the kdd99 benchmark dataset and obtain high detection rate of 99.25% as well as low false alarm rate of 1.66%.
---
paper_title: A CP Intrusion Detection Strategy on Cloud Computing

paper_content:

Cloud Computing is a general concept of the computing service which is reliance on the Internet for satisfying the computing needs of the users. The providers and the users of the service will be benefit for the new organization pattern. In this paper, we propose a framework for the construction of a CP intrusion detection system in E-Government. The idea can help people construct a flexible security system based on a well organized strategy and statistical model. Index Terms—Cloud Computing; E-Government; Intrusion Detection
---
paper_title: Self-similarity based lightweight intrusion detection method for cloud computing

paper_content:

Information security is the key success factor to provide safe cloud computing services. Despite its usefulness and cost-effectiveness, public cloud computing service is hard to accept because there are many security concerns such as data leakage, unauthorized access from outside the system and abnormal activities from inside the system. ::: ::: To detect these abnormal activities, intrusion detection system (IDS) require a learning process that can cause system performance degradation. However, providing high performance computing environment to the subscribers is very important, so a lightweight anomaly detection method is highly desired. ::: ::: In this paper, we propose a lightweight IDS with self-similarity measures to resolve these problems. Normally, a regular and periodic self-similarity can be observed in a cloud system's internal activities such as system calls and process status. On the other hand, outliers occur when an anomalous attack happens, and then the system's self-similarity cannot be maintained. So monitoring a system's self-similarity can be used to detect the system's anomalies. We developed a new measure based on cosine similarity and found the optimal time interval for estimating the self-similarity of a given system. As a result, we can detect abnormal activities using only a few resources.
---
paper_title: An Abstract Model for Integrated Intrusion Detection and Severity Analysis for Clouds

paper_content:

Cloud computing is an emerging computing paradigm which introduces novel opportunities to establish large scale, flexible computing infrastructures. However, security underpins extensive adoption of Cloud computing. This paper presents efforts to address one of the significant issues with respect to security of Clouds i.e. intrusion detection and severity analysis. An abstract model for integrated intrusion detection and severity analysis for Clouds is proposed to facilitate minimal intrusion response time while preserving the overall security of the Cloud infrastructures. In order to assess the effectiveness of the proposed model, detailed architectural evaluation using Architectural Trade-off Analysis Model ATAM is used. A set of recommendations which can be used as a set of best practice guidelines while implementing the proposed architecture is discussed.
---
paper_title: The utilization of Artificial Intelligence in a Hybrid Intrusion Detection System

paper_content:

Computer security, and intrusion detection in particular, have become increasingly important in today's business environment, to ensure safe and trusted commerce between business partners as well as effective organisational functioning. Various approaches to intrusion detection are currently being utilized, but unfortunately in practice these approaches are relatively ineffective and inefficient. New means and ways that will minimize these shortcomings must, therefore, continuously be researched and defined. This paper will propose a proactive and dynamic model, based on trend analysis, fuzzy logic and neural networks that could be utilized to minimise and control intrusion in an organisation's computer system.
---
paper_title: An Extensible and Virtualization-Compatible IDS Management Architecture

paper_content:

Efficient Intrusion Detection System (IDS) management is a prominent capability for distributed IDS solutions, which makes it possible to integrate and handle different types of sensors or collect and synthesize alerts generated from multiple hosts located in a loosely coupled environment. Extensibility is the main requirement for most of IDS management systems. The concept of virtualization has been introduced into many popular IDS implementations due to the advantage on isolation and fast recovery in case of being compromised. Advanced capability for combining these newly emerged Virtual Machine (VM) based IDS approaches is another requirement for IDS management. This paper proposes an extensible IDS management architecture based on a new design of Event Gatherer component. By using the known IDS standard IDMEF and a plug-in concept, the Event Gatherer ensures flexibility and compatibility.Experiments are carried out to demonstrate the extensibility and virtualization-compatibility of the proposed IDS management architecture.
---
paper_title: Towards more sophisticated ARP Spoofing detection/prevention systems in LAN networks

paper_content:

The Address Resolution Protocol (ARP) is used by computers to map network addresses (IP) to physical addresses [MAC] and we can't imagine a communications between networks without the support of ARP protocol. However, ARP had been misused by many malicious hosts for illegitimate penetration; ARP Spoofing is one example for such illegal access. ARP Spoofing can enable malicious hosts to perform Man-in-the-Middle attacks [MiM] as well as a Denial of Service attacks [DoS]. Unfortunately, ARP Spoofing has not been focused by security experts or solutions, e.g. Intrusion Detection Systems or Intrusion Protection Systems [IDS/IPS]. In this research we evaluate the most famous & expensive detection and prevention [IDS/IPS] systems for detecting all types of ARP spoofing attacks and introduce an algorithm which can be implemented in IDS/IPS systems to enhance it's security.
---
paper_title: Economic Denial of Sustainability (EDoS) in Cloud Services using HTTP and XML based DDoS Attacks

paper_content:

“Cloud Computing”, a new wave in the Internet revolution, transforms the kind of services provided over the Internet. The Cloud Services can be viewed from two perspectives, one as Cloud Service Provider and the other as Cloud Service Consumer. Assurance of security in the Cloud Service is a major challenge for the Providers, as it’s the biggest concern for the Consumers to opt for the service, which in turn decides the prospects of the business in Cloud Service. The Security can be administered in the Cloud at various levels and for several types of attacks. The threats and the attacks on the Cloud service can be common prevailing attacks in the internet or can be cloud specific. This paper deals about the threats and the counter measures of the prevailing DDoS attacks on the Cloud Environment as well as the Cloud Specific Vulnerabilities to these attacks. In specific, HTTP and XMLbased DDoS attacks on the cloud service are experimented under proposed security framework for EDoS Protection. A Cloud Service was hosted on Amazon EC2. The Service was targeted by HTTP, XML DDoS attacks from several nodes, which lead to the scaling of the service by consuming more Amazon EC2 resources, which in turn lead to Economic Denial of Sustainability to the Cloud Service under attack. Thus this paper explores the transformation of traditional Distributed denial-of-service (DDoS) attack into cloud specific Economic Denial of Sustainability (EDoS) attack.
---
paper_title: Computer System Intrusion Detection : A Survey

paper_content:

The ability to detect intruders in computer systems increases in importance as computers are increasingly integrated into the systems that we rely on for the correct functioning of society. This paper reviews the history of research in intrusion detection as performed in software in the context of operating systems for a single computer, a distributed system, or a network of computers. There are two basic approaches: anomaly detection and misuse detection. Both have been practiced since the 1980s. Both have naturally scaled to use in distributed systems and networks.
---
paper_title: Distributed Intrusion Detection in Clouds Using Mobile Agents

paper_content:

Cloud Computing extends an enterprise ability to meet the computing demands of its everyday operations, while offering flexibility, mobility and scalability. However, the reason that Chief Information Officers (CIOs) and their colleagues hesitate to let their business workloads to move from private Cloud into public Cloud is security. This work tries to offer a line of defense by applying Mobile Agents technology to provide intrusion detection for Cloud applications regardless of their locations. Therefore, CIOs feel safer to use Cloud to extend their on-premise infrastructure by adding capacity on demand.
---
paper_title: A Cooperative Intrusion Detection System Framework for Cloud Computing Networks

paper_content:

Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To provide secure and reliable services in cloud computing environment is an important issue. One of the security issues is how to reduce the impact of denial-of-service (DoS) attack or distributed denial-of-service (DDoS) in this environment. To counter these kinds of attacks, a framework of cooperative intrusion detection system (IDS) is proposed. The proposed system could reduce the impact of these kinds of attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack.
---
paper_title: A Virtual Machine Introspection Based Architecture for Intrusion Detection

paper_content:

Today’s architectures for intrusion detection force the IDS designer to make a difficult choice. If the IDS resides on the host, it has an excellent view of what is happening in that host’s software, but is highly susceptible to attack. On the other hand, if the IDS resides in the network, it is more resistant to attack, but has a poor view of what is happening inside the host, making it more susceptible to evasion. In this paper we present an architecture that retains the visibility of a host-based IDS, but pulls the IDS outside of the host for greater attack resistance. We achieve this through the use of a virtual machine monitor. Using this approach allows us to isolate the IDS from the monitored host but still retain excellent visibility into the host’s state. The VMM also offers us the unique ability to completely mediate interactions between the host software and the underlying hardware. We present a detailed study of our architecture, including Livewire, a prototype implementation. We demonstrate Livewire by implementing a suite of simple intrusion detection policies and using them to detect real attacks.
---
paper_title: NIDS: A Network Based Approach to Intrusion Detection and Prevention

paper_content:

Computer networks have added new dimensions to the global communication. But intrusions and misuses have always threatened the secured data communication over networks. Consequently, network security has come into issue. Now-a-days intrusion detection systems play an important role in security infrastructures. Intrusions typically start with intruders infiltrating a network through a vulnerable host and after that approaching for further malicious attacks. The techniques used for intrusion detection have their particular limitations. Any of the Intrusion Detection Systems proposed so far is not completely flawless. The host based systems as well as the network based systems have their own limitations. So, the quest for betterment continues. In this progression, here we present NIDS: a complete intrusion detection system which reduces some significant problems contained by the previous systems such as trust issues and message spreading problems. In the proposed IDS we don’t need to install the system for every host. That reduces the system overhead to a reasonable extent. This system generates steady responses against intrusions and stops the intruder to proceed for further attacks.
---
paper_title: The Research and Design of Intelligent IPS Model Based on Dynamic Cloud Firewall Linkage

paper_content:

The cloud security is a new technology and developing trend in the field of internet and network security. On the basis of summarizing the cloud security’s characteristics, superiority and core technologies, this paper proposes a new method to design and realize intelligent IPS model with dynamic cloud firewall linkage based on cloud security and analyzes the model’s structure and features. This model has important practical significance for the research and development of advanced technologies of the network security.
---
paper_title: Economic Denial of Sustainability (EDoS) in Cloud Services using HTTP and XML based DDoS Attacks

paper_content:

“Cloud Computing”, a new wave in the Internet revolution, transforms the kind of services provided over the Internet. The Cloud Services can be viewed from two perspectives, one as Cloud Service Provider and the other as Cloud Service Consumer. Assurance of security in the Cloud Service is a major challenge for the Providers, as it’s the biggest concern for the Consumers to opt for the service, which in turn decides the prospects of the business in Cloud Service. The Security can be administered in the Cloud at various levels and for several types of attacks. The threats and the attacks on the Cloud service can be common prevailing attacks in the internet or can be cloud specific. This paper deals about the threats and the counter measures of the prevailing DDoS attacks on the Cloud Environment as well as the Cloud Specific Vulnerabilities to these attacks. In specific, HTTP and XMLbased DDoS attacks on the cloud service are experimented under proposed security framework for EDoS Protection. A Cloud Service was hosted on Amazon EC2. The Service was targeted by HTTP, XML DDoS attacks from several nodes, which lead to the scaling of the service by consuming more Amazon EC2 resources, which in turn lead to Economic Denial of Sustainability to the Cloud Service under attack. Thus this paper explores the transformation of traditional Distributed denial-of-service (DDoS) attack into cloud specific Economic Denial of Sustainability (EDoS) attack.
---

Title: A Survey of Intrusion Detection Techniques in Cloud
Section 1: Introduction
Description 1: This section introduces cloud computing, its services, and highlights the significance of security within cloud environments. It also discusses the key security challenges intrinsic to cloud computing and underscores the importance of efficient intrusion detection systems (IDS) and intrusion prevention systems (IPS).

Section 2: Intrusions to Cloud Systems
Description 2: This section details various types of intrusions that threaten cloud services, including insider attacks, flooding attacks, user to root attacks, port scanning, attacks on virtual machines (VM) or hypervisors, and backdoor channel attacks.

Section 3: Firewalls: Common Solution to Intrusions
Description 3: This section briefly discusses the role of firewalls as a primary defense mechanism against certain types of intrusions in cloud environments and explains their limitations.

Section 4: IDS and IPS Techniques: Evolution
Description 4: This section delves into the evolution and different techniques used for intrusion detection and prevention, including traditional IDS/IPS methods such as signature-based detection, anomaly detection, and artificial intelligence (AI) based detection.

Section 5: Signature Based Detection
Description 5: This section provides an in-depth analysis of signature-based intrusion detection, its functionality, advantages, and limitations in the context of cloud environments.

Section 6: Anomaly Detection
Description 6: This section describes the anomaly detection technique, its methodologies, advantages in detecting unknown attacks, and its applicability in cloud environments.

Section 7: Artificial Neural Network (ANN) Based IDS
Description 7: This section discusses the use of Artificial Neural Networks (ANN) in intrusion detection systems, highlighting types of ANN, their implementation, and performance in detecting intrusions.

Section 8: Fuzzy Logic Based IDS
Description 8: This section explains how fuzzy logic is used in intrusion detection systems to handle inexact descriptions of intrusions, highlighting techniques and their effectiveness.

Section 9: Association Rule Based IDS
Description 9: This section reviews the use of association rules for intrusion detection, explaining how it helps in detecting attacks related to known patterns and its limitations.

Section 10: Support Vector Machine (SVM) Based IDS
Description 10: This section covers the application of Support Vector Machines (SVM) in intrusion detection systems, their accuracy, and how they handle data with high dimensionality in cloud environments.

Section 11: Genetic Algorithm (GA) Based IDS
Description 11: This section discusses Genetic Algorithms (GA) for feature selection in IDS, their optimization capabilities, and how they enhance detection accuracy.

Section 12: Hybrid Techniques
Description 12: This section explores hybrid intrusion detection techniques that combine multiple methodologies to improve effectiveness and efficiency in detecting intrusions.

Section 13: Various Types of IDS/IPS Used in Cloud Computing
Description 13: This section categorizes and describes different types of IDS and IPS used in cloud computing, such as Host-based IDS, Network-based IDS, Hypervisor-based IDS, and Distributed IDS.

Section 14: Intrusion Prevention System (IPS)
Description 14: This section explains the role of intrusion prevention systems, their configurations, and how they dynamically respond to intrusions to safeguard cloud environments.

Section 15: Intrusion Detection and Prevention System (IDPS)
Description 15: This section discusses the integration of IDS and IPS into comprehensive IDPS, their deployment, benefits, and configuration strategies in cloud environments.

Section 16: Conclusions
Description 16: This section concludes the paper by summarizing the intrusion techniques, defense mechanisms discussed, and highlights the need for research on improving cloud security through advanced IDS/IPS solutions.