Cloud Intrusion Research Articles

An Improved Design for a Cloud Intrusion Detection System Using Hybrid Features Selection Approach with ML Classifier

The rapid adoption of cloud computing has introduced new security concerns, particularly regarding data privacy and protection from sophisticated cyberattacks. Intrusion Detection Systems (IDSs) based on Machine Learning (ML) offer improved detection of malicious behaviour in network traffic. However, existing IDS solutions struggle with large-dimensional data and imbalanced datasets, resulting in higher false positive rates (FPR) and reduced detection rates (DR). In this paper, we propose an improved Cloud IDS leveraging a hybrid features selection approach using Information Gain (IG), Chi-square (CS), and Particle Swarm Optimization (PSO). To address the challenge of imbalanced datasets, the Synthetic Minority Over-sampling Technique (SMOTE) is employed. The Random Forest (RF) classifier is used to detect and classify attacks. The system is evaluated on the UNSW-NB15 and Kyoto datasets, achieving accuracies of over 98% and 99%, respectively, outperforming other methods in terms of detection accuracy.

Domain knowledge free cloud-IDS with lightweight embedding method

The expansion of the cloud computing market has provided a breakthrough in efficiently storing and managing data for individuals and companies. As personal and corporate data move to the cloud, diverse attacks targeting the cloud have also increased for heist beneficial information. Therefore, cloud service providers offer protective environments through diverse security solutions. However, security solutions are limited in preventing advanced attacks because it is challenging to reflect the environment of each user. This paper proposes a Cloud Intrusion Detection System (C-IDS) that adapts to each user’s cloud environment and performs real-time attack detection using Natural Language Processing (NLP). Notably, the C-IDS learns the deployed client environment logs and detects anomalies using the Seq2Seq model with BI-LSTM and Bahdanau attention. We used multiple domain datasets, Linux, Windows, Hadoop, OpenStack, Apache, OpenSSH, and CICIDS2018 to verify the performance of the C-IDS. C-IDS consists of a ‘recognition’ that identifies logs in the deployed environment and a ‘detection’ that discovers anomalies. The recognition results showed an average accuracy of 98.2% for multiple domain datasets. Moreover, the detection results based on the trained model exhibited an average accuracy of 94.2% for the Hadoop, OpenStack, Apache, and CICIDS2018 datasets.

A bizarre synthesized cascaded optimized predictor (BizSCOP) model for enhancing security in cloud systems

Due to growing network data dissemination in cloud, the elasticity, pay as you go options, globally accessible facilities, and security of networks have become increasingly important in today's world. Cloud service providers, including AWS, Azure, GCP, and others, facilitate worldwide expansion within minutes by offering decentralized communication network functions, hence providing security to cloud is still remains a challenging task. This paper aims to introduce and evaluate the Biz-SCOP model, a novel intrusion detection system developed for cloud security. The research addresses the pressing need for effective intrusion detection in cloud environments by combining hybrid optimization techniques and advanced deep learning methodologies. The study employs prominent intrusion datasets, including CSE-CIC-IDS 2018, CIC-IDS 2017, and a cloud intrusion dataset, to assess the proposed model's performance. The study's design involves implementing the Biz-SCOP model using Matlab 2019 software on a Windows 10 OS platform, utilizing 8 GB RAM and an Intel core i3 processor. The hybrid optimization approach, termed HyPSM, is employed for feature selection, enhancing the model's efficiency. Additionally, an intelligent deep learning model, C2AE, is introduced to discern friendly and hostile communication, contributing to accurate intrusion detection. Key findings indicate that the Biz-SCOP model outperforms existing intrusion detection systems, achieving notable accuracy (99.8%), precision (99.7%), F1-score (99.8%), and GEO (99.9%). The model excels in identifying various attack types, as demonstrated by robust ROC analysis. Interpretations and conclusions emphasize the significance of hybrid optimization and advanced deep learning techniques in enhancing intrusion detection system performance. The proposed model exhibits lower computational load, reduced false positives, ease of implementation, and improved accuracy, positioning it as a promising solution for cloud security.

Review Paper on Cloud Intrusion Detection System

The study proposes an enhanced cloud intrusion detection system (IDS) that tackles security challenges in cloud computing, focusing on data imbalance and feature selection. By integrating SMOTE for data imbalance and a hybrid feature selection method, the system achieves exceptional accuracies exceeding 98% and 99% on two datasets. The use of fewer informative features enhances system efficiency, showcasing its practical applicability and effectiveness in real-world scenarios. Overall, the study contributes significantly to cloud security by offering a holistic approach to IDS enhancement

Hybrid one‐dimensional residual autoencoder and ensemble of gradient boosting for cloud IDS

SummaryThe distributed and decentralized architecture of cloud computing is important for a number of industries, including business, government, entertainment, education, and information technology. It facilitates a wide aspect of information technology, where the computing model is vulnerable to attacks or intrusion. For detecting malicious activities, a novel intrusion detection system (IDS) is required to be developed. In this paper, an enhanced synthetic minority oversampling technique (SMOTE) with a hybrid one‐dimensional residual auto encoder and the Ensemble of Gradient Boosting (1D‐RAE‐EGB) models are proposed for cloud intrusion detection. The proposed IDS resolves the class imbalance problem through enhanced SMOTE. In addition, noise reduction is accomplished with ID‐RAE, which minimizes the data dimension. Finally, the soft voting‐based ensemble classification model is used for attack detection. The ensemble gradient boosting model comprises categorical boosting (CatBoost), extreme gradient boosting (XGBoost), and light gradient boosting machine (LightGBM). The ensemble model is fine‐tuned by reducing the number of parameters under fitting conditions since it is not compulsory to re‐adjust the weight values in a backpropagation process. The proposed IDS is implemented in Python using the NSL‐KDD dataset. The accuracy, precision, recall, f1‐score, false positive rate (FPR), false negative rate (FNR), specificity, and Kappa measure obtained for the proposed IDS are 99.98%, 99.3%, 98.5%, 99.95%, 0.723, 0.46, 99.98%, and 99.97%, respectively.

Toward Generating a New Cloud-Based Distributed Denial of Service (DDoS) Dataset and Cloud Intrusion Traffic Characterization

The distributed denial of service attack poses a significant threat to network security. Despite the availability of various methods for detecting DDoS attacks, the challenge remains in creating real-time detectors with minimal computational overhead. Additionally, the effectiveness of new detection methods depends heavily on well-constructed datasets. This paper addresses the critical DDoS dataset creation and evaluation domain, focusing on the cloud network. After conducting an in-depth analysis of 16 publicly available datasets, this research identifies 15 shortcomings across various dimensions, emphasizing the need for a new approach to dataset creation. Building upon this understanding, this paper introduces a new public DDoS dataset named BCCC-cPacket-Cloud-DDoS-2024. This dataset is meticulously crafted, addressing challenges identified in previous datasets through a cloud infrastructure featuring over eight benign user activities and 17 DDoS attack scenarios. Also, a Benign User Profiler (BUP) tool has been designed and developed to generate benign user network traffic based on a normal user behavior profile. We manually label the dataset and extract over 300 features from the network and transport layers of the traffic flows using NTLFlowLyzer. The experimental phase involves identifying an optimal feature set using three distinct algorithms: ANOVA, information gain, and extra tree. Finally, this paper proposes a multi-layered DDoS detection model and evaluates its performance using the generated dataset to cover the main issues of the traditional approaches.

Deep self-taught learning framework for intrusion detection in cloud computing environment

<p>Cloud has become a target-rich environment for malicious attacks by cyber intruders. Security is a major concern and remains an obstacle to the adoption of cloud computing. The intrusion detection system (IDS) is regarded as defense-in-depth. Unfortunately, most machine learning approaches designed for cloud intrusion detection require large amounts of labeled attack samples, but in real practice, they are limited. Therefore, the key impetus of this work is to introduce self-taught learning (STL) combining stacked sparse autoencoder (SSAE) with long short-term memory (LSTM) as a candidate solution to learn the robust feature representation and efficiently improve the performance of IDS with respect to false alarm rate (FAR) and detection rate (DR). Accordingly, the proposed approach as a first step employs SSAE to achieve dimensional reduction by learning the discriminative features from network traffic. The approach adopts LSTM to recognize the intrusion with the features encoded by SSAE. To evaluate the detective performance of our model, a comprehensive set of experiments are conducted on NSL-KDD. Also, ablation experiments are conducted to show the contribution of each component of our approach. Further, the comparative analysis shows the efficacy of our approach against the existing approaches with an accuracy of 86.31%.</p>

Reinforcement Learning Driven Self-Adaptation in Hypervisor-Based Cloud Intrusion Detection Systems (RLDAC-IDS)

Reinforcement Learning Driven Self-Adaptation in Hypervisor-Based Cloud Intrusion Detection Systems (RLDAC-IDS)

Adaptive Cloud Intrusion Detection System Based on Pruned Exact Linear Time Technique

Adaptive Cloud Intrusion Detection System Based on Pruned Exact Linear Time Technique

Optimized Blockchain-Based Deep Learning Model for Cloud Intrusion Detection

Optimized Blockchain-Based Deep Learning Model for Cloud Intrusion Detection

Enhancing Cloud Security through Intrusion Detection: A Comprehensive Study Using the ISOT-CID Dataset

Cloud computing has revolutionized data management, offering unparalleled scalability, flexibility, and efficiency. However, its open and multi-tenant nature introduces significant security vulnerabilities, making it an attractive target for cyber threats. Intrusion Detection Systems (IDS) tailored for cloud environments are essential in mitigating these risks. Despite various IDS models, benchmarking datasets representing realistic cloud environments is a substantial limitation. This study utilizes the ISOT Cloud Intrusion Detection Benchmark Dataset (ISOT-CID), a publicly available dataset featuring a range of network and application layer attacks collected from a real production cloud environment. The research explores the dataset's structure, analyzes attack patterns, and evaluates IDS models' performance to provide actionable insights for enhancing cloud security. This work contributes to the field by presenting a systematic analysis of ISOT-CID, identifying effective IDS models, and proposing improvements for future cloud intrusion detection research.

A feed forward deep neural network model using feature selection for cloud intrusion detection system

SummaryThe rapid advancement and growth of technology have rendered cloud computing services indispensable to our activities. Threats and intrusions have since multiplied exponentially across a range of industries. In such a scenario, the intrusion detection system, or simply the IDS, is deployed on the network to monitor and detect any attacks. The paper proposes a feed‐forward deep neural network (FFDNN) method based on deep learning methodology using a filter‐based feature selection model. The feature selection strategy aims to determine and select the most highly relevant subset of attributes from the feature importance score for training the deep learning model. Three benchmark data sets were used to assess the experiment: CIC‐IDS 2017, UNSW‐NB15, and NSL‐KDD. In order to justify the proposed technique, a comparison was done using other learning algorithms ranging from classical machine learning to ensemble learning methods that can detect various attacks. The experiments showed that the FFDNN model with reduced feature subsets gave the highest accuracy of 99.53% and 94.45% in the NSL‐KDD and UNSW‐NB15 data sets, while the ensemble‐based XGBoost model performed better in the CIC‐IDS 2017 data set. In addition, the results show that the overall accuracy, recall, and F1 score of the deep learning algorithm are generally better for all the data sets.

A Machine Learning based CIDS Model for Intrusion Detection to Ensure Security within Cloud Network

Cloud computing has evolved rapidly in recent years, and security concerns have gained prominence. Cloud computing offers the incredible capacity to provide inexpensive, easy-to-manage, flexible, adaptive, and powerful assets on the move via the Internet. Through effective and shared utilization, cloud computing maximizes the potential of hardware resources. Many issues in cloud computing raise are concerned regarding data and service availability. Numerous security services are needed to enhance cloud security for both users and service providers. One of the most essential research to establish security within cloud to avoid load imbalance situation through robust Cloud Intrusion Detection Systems (CIDS). Denial of service, scanning, malware code injection, virus, worm, and password cracking is prevalent cloud security issues. These attacks might jeopardize the company's reputation and inflict financial damage if not identified in time. Protecting the cloud from these kinds of threats, early detection and true prediction of such threats is the key goal of our proposal through this paper. It has been observed from earlier research proposals that dimensionality reduction is applied in conjunction with Data Mining (DM) and ML approaches found more perfomant in order to create such a robust model to ensure cloud network, authors suggested an CIDS by selecting appropriate features utilizing pertinent feature reduction approaches, then feeding this subset of data through the ML tool. 
 The simulation of the suggested model through ‘Python’ using ‘Scikit-Learn’ tool. Outcome of simulation experimental has been measured using various performance evaluation metric such as Precision, Recall, F-Score, Detection Ratio, RoC-curve etc. using KDDcup99 dataset as a benchmark. Simulation results from our suggested methodology were found more effective and comparable to several other existing methodologies.
 It has observed that ML based proposed model found capable enough to protect the cloud-based information by uncovering suspicious user behaviour interns as an outcome, secure cloud network against the threat and also found more performant in true prediction and early intrusion detection resultant reduction of computational cost.

A novel hybrid framework for Cloud Intrusion Detection System using system call sequence analysis

A novel hybrid framework for Cloud Intrusion Detection System using system call sequence analysis

Intrusion detection in cloud computing based on time series anomalies utilizing machine learning

The growth of cloud computing is hindered by concerns about privacy and security. Despite the widespread use of network intrusion detection systems (NIDS), the issue of false positives remains prevalent. Furthermore, few studies have approached the intrusion detection problem as a time series issue, requiring time series modeling. In this study, we propose a novel technique for the early detection of intrusions in cloud computing using time series data. Our approach involves a method for Feature Selection (FS) and a prediction model based on the Facebook Prophet model to assess its efficiency. The FS method we propose is a collaborative feature selection model that integrates time series analysis techniques with anomaly detection, stationary, and causality tests. This approach specifically addresses the challenge of misleading connections between time series anomalies and attacks. Our results demonstrate a significant reduction in predictors employed in our prediction model, from 70 to 10 predictors, while improving performance metrics such as Mean Absolute Error (MAE), Mean Squared Error (MSE), Root Mean Squared Error (RMSE), Mean Absolute Percentage Error (MAPE), Median Absolute Percentage Error (MdAPE), and Dynamic Time Warping (DTW). Furthermore, our approach has resulted in reduced training, prediction, and cross-validation times of approximately 85%, 15%, and 97%, respectively. Although memory consumption remains similar, the utilization time has been significantly reduced, resulting in substantial resource usage reduction. Overall, our study presents a comprehensive methodology for effective early detection of intrusions in cloud computing based on time series anomalies, employing a collaborative feature selection model and the Facebook Prophet prediction model. Our findings highlight the efficiency and performance improvements achieved through our approach, contributing to the advancement of intrusion detection techniques in the context of cloud computing security.

Cloud Intrusion Detection System Based on SVM

The demand for better intrusion detection and prevention solutions has elevated due to the current global uptick in hacking and computer network attacks. The Intrusion Detection System (IDS) is essential for spotting network attacks and anomalies, which have increased in size and scope. A detection system has become an effective security method that monitors and investigates security in cloud computing. However, several existing methods have faced issues such as low classification accuracy, high false positive rates, and low true positive rates. To solve these problems, a detection system based on Support Vector Machine (SVM) is proposed in this paper. In this method, the SVM classifier is utilized for network data classification into normal and abnormal behaviors. The Cloud Intrusion Detection Dataset is used to test the effectiveness of the suggested system. The experimental results show which the suggested system can detect abnormal behaviors with high accuracy.

A better and fast cloud intrusion detection system using improved squirrel search algorithm and modified deep belief network

A better and fast cloud intrusion detection system using improved squirrel search algorithm and modified deep belief network

Efficient Intrusion Detection System in the Cloud Using Fusion Feature Selection Approaches and an Ensemble Classifier

The application of cloud computing has increased tremendously in both public and private organizations. However, attacks on cloud computing pose a serious threat to confidentiality and data integrity. Therefore, there is a need for a proper mechanism for detecting cloud intrusions. In this paper, we have proposed a cloud intrusion detection system (IDS) that is focused on boosting the classification accuracy by improving feature selection and weighing the ensemble model with the crow search algorithm (CSA). The feature selection is handled by combining both filter and automated models to obtain improved feature sets. The ensemble classifier is made up of machine and deep learning models such as long short-term memory (LSTM), support vector machine (SVM), XGBoost, and a fast learning network (FLN). The proposed ensemble model’s weights are generated with the CSA to obtain better prediction results. Experiments are executed on the NSL-KDD, Kyoto, and CSE-CIC-IDS-2018 datasets. The simulation shows that the suggested system attained more satisfactory results in terms of accuracy, recall, precision, and F-measure than conventional approaches. The detection rate and false alarm rate (FAR) of different attack types was more efficient for each dataset. The classifiers’ performances were also compared individually to the ensemble model in terms of the false positive rate (FPR) and false negative rate (FNR) to demonstrate the ensemble model’s robustness.

Enhancement of an IoT hybrid intrusion detection system based on fog-to-cloud computing

Nowadays, with the proliferation of internet of things-connected devices, the scope of cyber-attacks on the internet of things has grown exponentially. So, it makes it a necessity to develop an efficient and accurate intrusion detection system that should be fast, dynamic, and scalable in an internet of things environment. On the other hand, Fog computing is a decentralized platform that extends Cloud computing to deal with the inherent issues of the Cloud computing. As well, maintaining a high level of security is critical in order to ensure secure and reliable communication between Fog nodes and internet of things devices. To address this issue, we present an intrusion detection method based on artificial neural networks and genetic algorithms to efficiently detect various types of network intrusions on local Fog nodes. Through this approach, we applied genetic algorithms to optimize the interconnecting weights of the network and the biases associated with each neuron. Therefore, it can quickly and effectively establish a back-propagation neural network model. Moreover, the distributed architecture of fog computing enables the distribution of the intrusion detection system over local Fog nodes with a centralized Cloud, which achieves faster attack detection than the Cloud intrusion detection mechanism. A set of experiments were conducted on the Raspberry Pi4 as a Fog node, based on the UNSW-NB15 and ToN_IoT data sets for binary-class classification, which showed that the optimized weights and biases achieved better performance than those who used the neural network without optimization. The optimized model showed interoperability, flexibility, and scalability. Furthermore, achieving a higher intrusion detection rate through decreasing the neural network error rate and increasing the true positive rate is also possible. According to the experiments, the suggested approach produces better outcomes in terms of detection accuracy and processing time. In this case, the proposed approach achieved an 16.35% and 37.07% reduction in execution time for both data sets, respectively, compared to other state-of-the-art methods, which enhanced the acceleration of the convergence process and saved processing power.

Deep Generative Learning Models for Cloud Intrusion Detection Systems.

Intrusion detection (ID) on the cloud environment has received paramount interest over the last few years. Among the latest approaches, machine learning-based ID methods allow us to discover unknown attacks. However, due to the lack of malicious samples and the rapid evolution of diverse attacks, constructing a cloud ID system (IDS) that is robust to a wide range of unknown attacks remains challenging. In this article, we propose a novel solution to enable robust cloud IDSs using deep neural networks. Specifically, we develop two deep generative models to synthesize malicious samples on the cloud systems. The first model, conditional denoising adversarial autoencoder (CDAAE), is used to generate specific types of malicious samples. The second model (CDAEE-KNN) is a hybrid of CDAAE and the K -nearest neighbor algorithm to generate malicious borderline samples that further improve the accuracy of a cloud IDS. The synthesized samples are merged with the original samples to form the augmented datasets. Three machine learning algorithms are trained on the augmented datasets and their effectiveness is analyzed. The experiments conducted on four popular IDS datasets show that our proposed techniques significantly improve the accuracy of the cloud IDSs compared with the baseline technique and the state-of-the-art approaches. Moreover, our models also enhance the accuracy of machine learning algorithms in detecting some currently challenging distributed denial of service (DDoS) attacks, including low-rate DDoS attacks and application layer DDoS attacks.