Embedding a Distributed Auditing Mechanism in the Service Cloud

The Cloud Security Alliance identified the "notorious nine" threats for cloud computing. The range of these threats across the cloud indicates that centralized prevention and detection would be highly inefficient, potentially reporting incidents to tenants well after they occur and are difficult to mitigate. This paper presents an auditing framework for the service cloud that distributes logging, monitoring, and reporting at the local service level, at the application or session level that can involve multiple tenant services, and at the cloud level where corroboration and verification of threats takes place. To verify the forensic coverage of the framework, a set of CAPEC attack patterns are investigated to match attack evidence gathering and mitigation techniques with the proposed distributed detection and mitigation levels of the framework.

I. Introduction

Cloud computing is radically changing how computing services are created, delivered, accessed and managed. Thus, it provides new avenues for cybercrimes requiring updated prevention and detection methods. Cloud forensic investigation can increase the robustness and reliability of clouds. NIST [1] divides the forensic investigation process into three steps: data collection, examination, and analysis. These three steps should preserve the integrity of the collected data. Currently, the area of cloud forensics requires significant research efforts to design forensic architectures, craft novel investigative approaches, and define legislative policies and mechanisms for cloud systems [2] [3] [4].