Unified, Multi-level Intrusion Detection in Private Cloud Infrastructures

Traditional network firewalls and intrusion detection systems (IDSs) are typically relied upon as the primary defense against unauthorized access in private clouds. While certainly important, we argue traditional approaches to intrusion detection are insufficient for private clouds-by ignoring application-and cloud-specific mechanisms and network traffic, traditional IDSs can either notice too late or never at all a potentially-costly intrusion. This paper presents a unified, multi-level IDS architecture that supplements traditional approaches with safeguards and detection mechanisms that leverage knowledge of typical/correct private cloud operations, both at the cloud-application-level and as well as the cloud-control-level. We present our general framework and methodology, and describe its operation in detail via a specific case study of an intruder attempting to manipulate VM-level scheduling in an OpenStack-based private cloud. Our results show such a unified, multi-level, cloud-specific IDS can help greatly reduce the security issues prohibiting private cloud deployments.