HA-CIDS: A Hierarchical and Autonomous IDS for Cloud Systems

Cloud computing is an attractive model that provides the delivery of on-demand computing resources over the Internet and on a pay-for-use basis. However, while intruders may exploit clouds for their advantage, most IDS solutions are not suitable for cloud environments. This paper presents a hierarchical and autonomous cloud based intrusion detection system, HA-CIDS. The framework continuously monitors and analyzes system events and computes the security and risk parameters. An autonomous controller receives security parameters computed by the framework and selects the most appropriate response to protect the cloud against detected attacks, as well as recover any corrupted data or affected services. Beside autonomous response to detected attacks, HA-CIDS has several autonomous capabilities to provide self-resilience and fault tolerance. We developed a testbed to evaluate the performance and accuracy of the framework. The architecture, design, and deployment of HACIDS are given in this paper.