An Adaptive Distributed Intrusion Detection System for Cloud Computing Framework

Abstract

Cloud Computing is the recent buzz word in computing which has enormous potential to revolutionize the IT industry. Cloud opened up new computing scenarios coupled with many significant benefits, however they also turned to become new avenues of attacks and exploits. This paper proposes a unique Distributed Intrusion Detection System (DIDS) based on a novel combination of two variant trends in intrusion detection-the behavior based and knowledge based intrusion detection mechanisms. The behavior based approach facilitates improved detection in the dynamic cloud environment and the knowledge based approach supports the detection scheme with its definitive rule base. The functionality of both these approaches has been improved by the addition of an adaptive approach which helps to significantly assist in lowering the false positives. In addition to this, another novel and the striking advantage of the proposed detection scheme is the alert clustering and analyzing facility thereby helping all cooperating nodes in detecting false alarms from any malicious nodes. DOS attacks in one node can be sent as alerts to help other cooperating nodes in updating themselves about new attack patterns leading to early detection and prevention of attacks. This scheme collectively helps to make the underlying cloud infrastructure more immune to attacks and continue to provide services to users.