DESIGN AN ENHANCED INTRUSION DETECTION MODEL IN A CLOUD COMPUTING ENVIRONMENT. 

DESIGN AN ENHANCED INTRUSION DETECTION MODEL IN A CLOUD COMPUTING ENVIRONMENT

ABSTRACT

Cloud computing is a new type of service that provides large-scale computing resources to each customer. Cloud computing systems can be easily threatened by various cyberattacks because most cloud computing systems provide services to so many people who are not proven to be trustworthy. Therefore, a cloud computing system needs to contain some intrusion detection systems (IDSs) for protecting each virtual machine (VM) against threats. In this case, there exists a trade-off between the security level of the IDS and the system performance. If the IDS provides a stronger security service using more rules or patterns, then it needs much more computing resources in proportion to the strength of security. So the amount of resources allocating for customers decreases. Another problem in cloud computing is that the huge amount of logs makes it hard for system administrators to analyse them. In this project, we propose a method that enables a cloud computing system to achieve both effectiveness of using the system resource and strength of the security service without trade-off between them. The study focused on an intrusion detection system built on a hybrid cloud environment, addressing the issue of non-detection of attacks not interacting with the host and giving many false positives due to its ability to detect only known attacks, which necessitated the need to have the intrusion patterns measured through filtering of selected network protocols on the server using Wireshark. The implementation of an IDS model that is network and host-based to inspect all incoming and outgoing network activities using Snort and OSSEC and evaluation of the performance of the IDS using alert logs are the objectives of the study to improve the shortfall of the existing study. Rules were set on both the N-IDS and H-IDS to monitor connections and activities of the system. The research methodology follows the fundamentals of the waterfall process with the three components of measuring the pattern of intrusion, design and implementation of the model,, and evaluation of the performance of the system through the confusion matrix and the comparison between the metrics: accuracy, detection rate, and false alarm rate. The optimal performance shows that accuracy, detection rate, and false alarm rate have probabilities of 0.971, 0.941, and 0.002, given that their coefficients are less than 1.0. This shows that the main objective of the study is met with the the best performance. The system is deemed to be effective with its ability to identify attacks and send a real-time alert with a very low chance of reporting or logging false positives. The study recommended that the IDS system architecture could be designed to serve as both an intrusion detection system (IDS) and an intrusion prevention system (IPS).

DESIGN AN ENHANCED INTRUSION DETECTION MODEL IN A CLOUD COMPUTING ENVIRONMENT. 

Sharing is caring!