Department of Computer Science Punjabi University, Patiala Intrusion Detection System on Cloud to Monitor Malicious Activities to Protect Cloud Department of Computer Science Punjabi University, Patiala Supervisor Name: Submitted By: Dr. Rajesh Kumar Bawa Shivani Arora Roll No. 120457069

Table of Contents Introduction Literature Survey Problem Definition Objectives Discussion & Summary Work to be carried out References

Introduction Prime disadvantage of cloud computing is security. Several common intrusions in cloud - Insider attack. Flooding attack. User to root attacks. Port Scanning, etc. Detecting and responding to these attacks is important for enhancing the security. Intrusion detection system (IDS) is a practical solution to resist these kinds of attacks.

Intrusion Detection System usually monitor, collect and analyze logs, network traffic and user action in a process to identifying suspicious behavior. capable of sending early alarm upon risks of exposure caused by any attack. Aim is to alert or notify the system that some malicious activities have taken place.. composed of several components- -sensor -console -central engine.

Intrusion Detection System(cont…) Types of IDS- Host Based IDS. Network Based IDS. Techniques used in IDS- Signature Based Detection. Variance Based Detection. Hybrid Detection.

Literature Survey C. Modi et. al. (2013) [1] surveyed different intrusions affecting availability, confidentiality and integrity of Cloud resources and services. They examined proposals incorporating Intrusion Detection Systems (IDS) in Cloud and discussed various types and techniques of IDS and Intrusion Prevention Systems (IPS), and recommended IDS/IPS positioning in Cloud architecture to achieve desired security in the next generation networks.

Literature Survey (cont…) P.K. Shelke et. al. (2012) [2] suggested that providing security in a distributed system requires more than user authentication with passwords or digital certificates and confidentiality in data transmission. Distributed model of cloud makes it vulnerable and prone to sophisticated distributed intrusion attacks like Distributed Denial of Service (DDOS) and Cross Site Scripting (XSS). To handle large scale network access traffic and administrative control of data and application in cloud, a new multi-threaded distributed cloud IDS model has been proposed. Their proposed cloud IDS handles large flow of data packets, analyze them and generate reports efficiently by integrating knowledge and behavior analysis to detect intrusions.

Literature Survey (cont…) C.L. Tsai et. al. (2011) [3] proposed a dynamic IDS for strengthening the security application of cloud computing. Here the number of intrusion detectors are dispatched on the whole topology of the networking system through multi-layers and multi stages deployment. Those information security issues related with the application and service of cloud computing will be experimented. The goal of the proposed mechanism is not only focused on finding out some solutions, but also focused on developing some feasible information security techniques or products for the application and service of cloud computing. Experimental results demonstrate that the proposed mechanism does provide good performance for intrusion detection

Literature Survey (cont…) C.C. Lo et. al. (2010) [5] have proposed a framework of cooperative intrusion detection system (IDS). The proposed system could reduce the impact of denial of-service (DoS) attack or distributed denial-of-service (DDoS) attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack.

Problem Definition In Cloud computing there are 3 security issues, which are confidentiality, integrity and availability (CIA). Intrusion Detection System (IDS) is used to resist these kinds of attacks. Intrusion detection functions include: -Monitoring and analyzing both user and system activities. -Analyzing system configurations and vulnerabilities. -Assessing system and file integrity. -Ability to recognize patterns typical of attacks. -Analysis of abnormal activity patterns. -Tracking user policy violations.

Objectives Create a mechanism to detect data loss or leakage in a cloud. Provide a solution to resist the data loss and leakage. Preparing a database to analyze the attacks on the system.

Discussion and Summary There are top seven security threats: 1. Misuse and Vicious Use of Cloud Computing 2. Insecure Application Programming Interfaces 3. Malicious Insiders. 4. Shared Technology Vulnerabilities. 5. Data Loss or Data Leakage. 6. Account Service and Traffic Hijacking. 7. Unknown Risk Profile We will concentrate on data loss or data leakage threat.

Work to be carried out Create a mechanism to detect data loss or leakage. Provide a solution to resist the data loss and leakage. A database is created of different attacks on a machine connected on LAN. Comparative study of our proposed system with the existing IDS systems.

References [1] C. Modi, D. Patel, H. Patel, B. Borisaniya, A. Patel, M. Rajarajan, “A survey of intrusion detection techniques in Cloud”, Centre for Cyber Security Sciences, City University London EC1V 0HB, 2013. [2] P. K. Shelke, S. Sontakke, A. D. Gawande, “Intrusion Detection System for Cloud Computing”, International Journal of Scientific & Technology Research Volume 1, Issue 4, May 2012. [3] C-L.Tsai, U-C. Lin, A.Y.Chang, C-J.Chen, “Information Security Issue of Enterprises Adopting the Application of Cloud Computing”, Department of Computer Science, Chinese Culture University. [4] S. Roschke, F.Cheng, C.Meinel, “Intrusion Detection in the Cloud”, Hasso Plattner Institute (HPI), University of Potsdam, 2009 Eighth IEEE International Conference on Dependable, Autonomic and Secure Computing.

References(cont…) [5] C-C. Lo, C-C.Huang, J.Ku, “A Cooperative Intrusion Detection System Framework for Cloud Computing Networks”, Institute of Information Management , National Chiao Tung University, 2010 39th International Conference on Parallel Processing Workshops. [6] R. Vanathi & S. Gunasekaran, “Comparison of Network Intrusion Detection Systems in Cloud Computing Environment, Department of Computer Science Coimbatore Institute of Engineering and Technology, 2012 International Conference on Computer Communication and Informatics (ICCCI -2012), Jan. 10 – 12, 2012, Coimbatore, INDIA. [7] P.Saxena, A.Singh, A.Srivastava, P. Kumar, “Analysis of security issues and Intrusion Detection System with preventive solutions in a cloud environment “,4th International conference,Confluence 2013. [8] W. Yassin, N.I. Udzir, Z. Muda, A. Abdullah and M.T. Abdullah, “A Cloud-Based Intrusion Detection Service Framework”, Faculty of Computer Science and Information Technology, Universiti Putra Malaysia.  

Thank You!!!