A Hybrid Intrusion Detection System for Cloud Computing Environments

This article presents a model to protect the cloud by providing a hybrid solution based on the distribution of intrusion detectors and the centralization of alerts for management purposes. The purpose of our approach is to protect the most important layers of the cloud using intrusion detection systems. Each layer (e.g network layer, application layer,...) has its properties that makes it different from other layers. This leads us to use specific intrusion detectors for each layer. The proposed detection model is segmented to two zones. The first zone is equipped with signature-based detectors, and the second zone is equipped with anomaly-based detectors. In the first zone we target previously known attacks, in the second zone we seek to discover previously unknown malicious events on the application layer. This article shows that it is possible to fully protect the cloud by using both signature and anomaly based detection using open source software, and provides the cloud service provider with a complete model to protect, monitor and manage the cloud by visualizing and correlating logs and alerts.