Multi-Tenant Intrusion Detection Framework as a Service for SaaS

Information technology (IT) service providers are nowadays moving toward cloud computing. Software-as-a-service (SaaS) refers to cloud service-oriented web applications. As a result of computation outsourcing, a customer (tenant) can subscribe to a self-service SaaS and use it on a pay-per-use basis. To reduce resource costs, a single instance of SaaS serves multiple tenants (multi-tenancy). However, outsourcing and multi-tenancy bring about new security issues. Indeed, tenants lose control over the source code, databases and infrastructure and cannot deploy their own intrusion detection system (IDS). In this context, the provider must not only integrate their preferred IDS into a public cloud, but also protect the tenants according to their individual security requirements. We put forth a multi-tenant intrusion detection framework as a service for SaaS (MTIDaaS) to allow the provider to undertake such integration. Our MTIDaaS has been integrated and tested in a real public cloud environment. It provides security-as-a-service (SecaaS) for both provider and tenant with high levels of portability, flexibility and cost-effectiveness. The experimental results demonstrate that our MTIDaaS offers easy integration of IDS with little virtualization overhead and insignificant impact on HTTP response time.