A Review of Intrusion Detection Systems in Cloud Computing

The rapid growth of digital communications and extensive data exchange have made computer networks integral to organizational operations. However, this increased connectivity has also expanded the attack surface, introducing significant security risks. This paper provides a comprehensive review of Intrusion Detection System (IDS) technologies for network security, examining both traditional methods and recent advancements. The review covers IDS architectures and types, key detection techniques, datasets and test environments, and implementations in modern network environments such as cloud computing, virtualized networks, Internet of Things (IoT), and industrial control systems. It also addresses current challenges, including scalability, performance, and the reduction of false positives and negatives. Special attention is given to the integration of advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML), and the potential of distributed technologies such as blockchain. By maintaining a broad-spectrum analysis, this review aims to offer a holistic view of the state-of-the-art in IDSs, support a diverse audience, and identify future research and development directions in this critical area of cybersecurity.

A Review of Intrusion Detection System in Cloud Computing

Cloud computing has gained an extreme importance nowadays. Every organization is getting attracted toward the Cloud computing due to its attractive features like cost saving, adaptability, etc. Although it offers the attractive features but still Cloud threats need great consideration. The insider threat is critically challenging in the Cloud-based environments. In order to mitigate from insider attacks in Clouds, the use of Intrusion detection system (IDS) is quite challenging. Every type of IDS has different methods of attack detection. So, single IDS cannot guarantee the protection from all types of attacks. Thus, in this paper, we have studied the various types of IDS and their features which made them either suitable or unsuitable for cloud computing. Also on the basis of review, required features for the Cloud-based IDS are identified.

Cybersecurity has become a priority concern of the digital society. Many attacks are becoming more sophisticated, requiring strengthening the strategies of identification, analysis, and management of vulnerability to stop threats. Intrusion Detection/Prevention Systems are first security devices to protect systems. This paper presents a survey of several aspects to consider in machine learning-based intrusion detection systems. This survey presents the Intrusion Detection Systems taxonomy, the types of attacks they face, as well as the organizational infrastructure to respond to security incidents. The survey also describes several investigations to detect intrusions using Machine Learning, describing in detail the databases used. Moreover, the most accepted metrics to measure the performance of algorithms are presented. Finally, the challenges are discussed motivating future research.KeywordsIntrusion detection systemsMachine learningCyber security

Cloud computing is a recent innovation in the IT industry that is expanding quickly. Furthermore, this technology is widely used to provide computation, data storage, and other resources remotely through the web on a pay-per-usage basis. It is now the favored option for any IT firm since it increases its capacity to satisfy the computing requirements of its everyday operations through scalability, mobility, and flexibility at a low price. But there are two key problems with cloud computing. The biggest issue is storage-related, and Google has addressed it by adding a new layer to the cloud dubbed “Big data as a service (BDaaS).” The second problem is security and privacy. The Intrusion Detection System (IDS) has become the most widely utilized component of computer systems, security, and compliance processes, safeguarding network-accessible Cloud resources and services from various threats and assaults. This study examines IDS approaches in Cloud Computing and big data sets. To identify anomalous data in BDaaS, we also suggested a sensible intrusion detection system (SIDS) based on the autonomic system. The agent contributes the most to introducing more proprieties, particularly the autonomy element.

Cloud computing based services represents a major development in the way of providing IT services. However, the security challenges remains serious threat for such services. Therefore, intrusion detection systems (IDSs) are receiving more attention; this includes IDS methods and applications. This review paper intensively explain characteristics and limitation of the most IDS techniques used in cloud computing environment.

Smartphones are phones with advanced capabilities like those of personal computers (PCs). Smartphone technology is more and more becoming the predominant communication tool for people across the world. People use their smartphones to keep their contact data, to browse the internet, to exchange messages, to keep notes, carry their personal files and documents, etc. Users while browsing are also capable of shopping online, thus provoking a need to type their credit card numbers and security codes. As the smartphones are becoming widespread, it's also becoming a popular target for security threats and attack. Since smartphones use the same software architecture as in PCs, they are vulnerable to be exposed to similar threats such as in PCs. Recent news and articles indicate huge increase in malware and viruses for operating systems employed on smartphones (primarily Android and iOS). Major limitations of smartphone technology are its processing power and its scarce energy source since smartphones rely on battery usage. The smartphones have less storage and computational power to put into effect highly complex algorithms for intrusion detection and implementing signature based attack detection. Now in this paper, we propose a cloud based Intrusion Detection System for smartphones to overcome the issues of smartphone resource constraints and to detect any misbehavior or anomalous activity effectively.

This research study intends to explore the benefits, drawbacks, and synergies existing between the edge and cloud-based intrusion detection systems. While edge-based IDS detects threats instantly in applications relying on latency, cloud-based IDS does centralized management to handle large data repositories that help to counter wide-scale attacks. Hybrid IDS architectures bring together local responsiveness with global intelligence by tying together both edge and cloud components. It comprehensively reviews edge-based and cloud-based security breach finding methods and lays the foundation for further cybersecurity research and applications.

Cloud computing (CC) is an internet-enabled environment that provides computing services such as networking, databases, and servers to clients and organizations in a cost-effective manner. Despite the benefits rendered by CC, its security remains a prominent concern to overcome. An intrusion detection system (IDS) is generally used to detect both normal and anomalous behavior in networks. The design of IDS using a machine learning (ML) technique comprises a series of methods that can learn patterns from data and forecast the outcomes consequently. In this background, the current study designs a novel multi-objective seagull optimization algorithm with a deep learning-enabled vulnerability detection (MOSOA-DLVD) technique to secure the cloud platform. The MOSOA-DLVD technique uses the feature selection (FS) method and hyperparameter tuning strategy to identify the presence of vulnerabilities or attacks in the cloud infrastructure. Primarily, the FS method is implemented using the MOSOA technique. Furthermore, the MOSOA-DLVD technique uses a deep belief network (DBN) method for intrusion detection and its classification. In order to improve the detection outcomes of the DBN algorithm, the sooty tern optimization algorithm (STOA) is applied for the hyperparameter tuning process. The performance of the proposed MOSOA-DLVD system was validated with extensive simulations upon a benchmark IDS dataset. The improved intrusion detection results of the MOSOA-DLVD approach with a maximum accuracy of 99.34% establish the proficiency of the model compared with recent methods.

Intruders and thieves are important threats to most business and large organizations. These threats and unwanted materials create many disturbances in storing of the data on large scale especially in cloud computing. So maintaining security against these threats is important in any organizations. Security could be of different types like hardware security, software security, malicious behavior of attackers, and many others besides security; many organizations try to introduce many methods which will provide malicious behaviors of attackers so that an alert message will propagate throughout the whole system so that even if some attacker tries to break down the security an alert message is generated. Such a model is the intrusion detection system. An intrusion detection system (IDS) is a hardware device or software application that monitors network and/or system or host activities for malicious activities’ policy violations, creates and sends reports to a management station or system administrator which decides whether to take an action on the intrusion or it was only a false alarm. In this paper, we introduce a model or system called snort which is an intrusion detection system based upon rules detection and has the ability to control traffic and matching data with the original database and allows only data to flow which matches with the original database.

The study examined the detection of attacks against computer networks, which is becoming a harder problem to solve in the field of Network security. A problem with current intrusion detection systems is that they have many false positive and false negative events. Most of the existing Intrusion detection systems implemented depend on rule-based expert systems where new attacks are not detectable. In this study, optimization algorithms were added to intrusion detection system to make them more efficient. Self Organizing Migrating Genetic Algorithm (SOMGA) was integrated into intrusion detection system to obtain a more efficient intrusion detection system called ID-SOMGA. This study provides an equally efficient method to implement an intrusion detection system that returns very low false positives. Due to the complexities involved in security issues, and the implementation of the work, selected values of the network log was used to implement the system in order to reduce some of these complexities. The Self Organizing Migrating Genetic Algorithm – Intrusion Detection System was tested and values of the result were compared with that of an IDS with Genetic Algorithm Intrusion Detection System. In terms of detection rates, ID-SOMGA was found to be slower than an IDS with GA, the false positives in ID-SOMGA was lower than what obtains with genetic algorithm. Both schemes were able to identify new patterns almost in the same way. The ID-SOMGA system that was developed improved the security of systems in networked settings allowing for confidentiality, integrity and availability of system resources.

Internet of things intrusion detection model and algorithm based on cloud computing and multi-feature extraction extreme learning machine

The capacity to identify breaches and malicious activity inside the Internet of Things (IoT) networks is important for network infrastructure resilience as the dependence on IoT devices and services grows. Intrusion detection systems (IDS) are basic components of network security. IDSs monitor and analyze the activity of a system in a network to identify intrusions. Existing intrusion detection systems (IDS) gather and utilize large amounts of data with irrelevant, unnecessary, and unsuitable characteristics, resulting in long detection times and low accuracy. In this paper, we present an IDS model based on a Random Forest (RF) classifier. NSL-KDD dataset is used to test the performance of the model and the satisfying performance is obtained in terms of accuracy, detection rate, and false alarm rate. The proposed model has attained an average accuracy of 99.3% and 98% for binary classification and multiclass classification, respectively. To demonstrate the efficacy of the suggested model, its accuracy was compared with some existing approaches that utilize other models such as AIDS, ELM and PCA, MapReduce-based hybrid architecture, and DRNN.

Cloud computing relies on sharing computing resources. With high availability and accessibility of resources, cloud computing is under the threat of major cyber-attacks. To detect attacks and preserve security in cloud environment, having an efficient intrusion detection system (IDS) is required. In this article, an effective and efficient IDS is proposed to maintain high level security of data in cloud. The authors have incorporated Reinforcement Learning Automata with their proposed IDS while detecting and classifying attacks. Using learning automata an effective rule set is generated with the proposed algorithm from vast training set to improve the learning process at reduced computation cost and time. After which, the proposed reinforcement learning algorithm helps in classification of attacks accurately using the reinforcement signal. This proposed model was experimented with NSL-KDD as well as KDD 10% dataset and have proved its robustness by detecting attacks more accurately being an IDS.

Computer security is one of the main challenges of today's technological infrastructures, whereas intrusion detection systems are one of the most widely used technologies to secure computer systems. The intrusion detection systems use a variety of information sources, one of the most important sources are the applications' system calls. The intrusion detection systems use many different detection techniques, e.g. system calls sequences, text classification techniques and system calls graphs. However, existing techniques obtain poor results in the detection of complex attack patterns, so it is necessary to improve the detection results. This paper presents an intrusion detection system model that integrates multiple detection techniques into a single system with the goal of modeling the global behavior of the applications. In addition, the paper proposes a new modified system calls graph to integrate and represent the information of the different techniques in a single data structure. The system uses a deep neural network to combine the results of the different detection techniques used in the global model. The result of the study shows the improvement obtained in the detection results with respect to the use of individual techniques, the proposed model achieves higher detection rates and lower false positives. The proposal has been validated onto three datasets with different levels of complexity.