MULTI-LEVEL INTRUSION DETECTION AND LOG MANAGEMENT SYSTEM IN CLOUD COMPUTING

1.0 Introduction

As Green IT has been issued, many companies have started to find ways to decrease IT cost and overcome economic recession. Cloud Computing service is a new computing paradigm in which people only need to pay for use of services without cost of purchasing physical hardware. For this reason, Cloud Computing has been rapidly developed along with the trend of IT services. It is efficient and cost economical for consumers to use computing resources as much as they need or use services they want from Cloud Computing provider. Especially, Cloud Computing has been recently more spotlighted than other computing services because of its capacity of providing unlimited amount of resources. Moreover, consumers can use the services wherever Internet access is possible, so Cloud Computing is excellent in the aspect of accessibility. Cloud Computing systems have a lot of resources and private information, therefore they are easily threatened by attackers. Especially, System administrators potentially can become attackers. Therefore, Cloud Computing providers must protect the systems safely against both insiders and outsiders. IDSs are one of the most popular devices for protecting Cloud Computing systems from various types of attack. Because an IDS observes the traffic from each VM and generates alert logs, it can manage Cloud Computing globally. Another important problem is log management. Cloud Computing systems are used by many people, therefore, they generate huge amount of logs. So, system administrators should decide to which log should be analysed first.

Cloud Computing is a fused-type computing paradigm which includes Virtualization, Grid Computing, UtilityComputing, Server Based Computing(SBC), and Network Computing, rather than an entirely new type of computing technique. Cloud computing has evolved through a number of implementations. Moving data into the cloud provides great convenience to users. Cloud computing is a collection of all resources to enable resource sharing in terms of scalable infrastructures, middle ware and application development platforms, and value-added business applications. The characteristics of cloud computing includes: virtual, scalable, efficient, and flexible. In cloud computing, three kinds of services are provided: Software as a Service (SaaS) systems, Infrastructure as a Service (IaaS) providers, and Platform as a Service (PaaS). In SaaS, systems offer complete online applications that can be directly executed by their users; In IaaS, providers allow their customers to have access to entire virtual machines; and in SaaS, it offers development and deployment tools, languages and APIs used to build, deploy and run applications in the cloud.

A cloud is subject to several accidental and intentional security threats, including threats to the integrity, confidentiality and availability of its resources, data and infrastructure. Also, when a cloud with large computing power and storage capacity is misused by an ill-intentioned party for malicious purposes, the cloud itself is a threat against society. Intentional threats are imposed by insiders and external intruders. Insiders are legitimate cloud users who abuse their privileges by using the cloud for unintended purposes and we consider this intrusive behaviour to be detected. An intrusion consists of an attack exploiting a security flaw and a consequent breach which is the resulting violation of the explicit or implicit security policy of the system. Although an intrusion connotes a successful attack, IDSs also try to identify attacks that don’t lead to compromises. Attacks and intrusions”– are commonly considered synonyms in the intrusion detection context. The underlying network infrastructure of a cloud, being an important component of the computing environment, can be the object of an attack. Grid and cloud applications running on compromised hosts are also a security concern. We consider attacks against any network or host participating in a cloud as attacks against that, since they may directly or indirectly affect its security aspects. Cloud systems are susceptible to all typical network and computer security attacks, plus specific means of attack because of their new protocols and services.

IDSs are software or hardware systems that automate the process of monitoring the events occurring in a computer system or network, analysing them for signs of security problems. IDSs are one of widely used security technologies. An IDS alerts to system administrators, generate log about attack when it detects signature of accident according to host or network security policy. IDS can be installed in a host or a network according to purpose. Thus, the aim of the IDS is to alert or notify the system that some malicious activities have taken place and try to eliminate it.
According to the method of the collection of intrusion data, all the intrusion detection systems can be classified into two types: host-based and network-based IDSs. Host based intrusion detection systems (HIDSs) analyse audit data collected by an operating system about the actions performed by users and applications; while network-based intrusion detection systems (NIDSs) analyse data collected from network packets.

IDSs analyse one or more events gotten from the collected data. According to analysis techniques, ID Ssystem is classified into two different parts: misuse detection and anomaly detection. Misuse detection systems use signature patterns of exited well-known attacks of the system to match and identify known intrusions. Misuse detection techniques, in general, are not effective against the latest attacks that have no matched rules or pattern yet.Anomaly detection systems identify those activities which deviate significantly from the established normal behaviours as anomalies. These anomalies are most likely regarded as intrusions. Anomaly detection techniques can be effective against unknown or the latest attacks. However, anomaly detection systems tend to generate more false alarms than misuse detection systems because an anomaly may be a new normal behaviour or an ordinary activity.While IDS detects an intrusion attempt, IDS should report to the system administrator.
There are three ways to report the detection results. They are notification, manual response, and automatic response. In notification response system, IDS only generates reports and alerts. In manual response system, IDS provides additional capability for the system administrator to initiate a manual response. In automatic response system, IDS immediately respond to an intrusion through auto response system.

1.1 Problem Statement

The fully distributed and open structure of cloud computing and services becomes an even more attractive target for potential intruders. It involves multi-mesh distributed and service oriented paradigms, multi-tenancies, multi-domains, and multi-user autonomous administrative infrastructures which are more vulnerable and prone to security risks. Cloud computing service architecture combines three layers of inter-dependent infrastructure, platform and application; each layer may suffer from certain vulnerabilities which are introduced by different programming or configuration errors of the user or the service provider. A cloud computing system can be exposed to several threats including threats to the integrity, confidentiality and availability of its resources, data and the virtualized infrastructure which can be used as a launching pad for new attacks. The problem becomes even more critical when a cloud with massive computing power and storage capacity is abused by an insider intruder as an ill-intention party which makes cloud computing a threat against itself.

1.2 Significance Of The Study

The significance of this study includes the following:

1. It helps in economic cost reduction in running a particular application.
2. It provides humans with effective resource management.
3. It will help organizations in focusing on core business in the sense that you only concentrate on what means most to you. Since your applications will be run over the internet, you do not have to worry about technical problems and other inconveniences associated with physical unified storage solution spaces.
4. It increases performance and support by updating the fact that all your software and applications automatically.
5. It provides security and compliance.
6. It provides anytime anywhere access to information.

1.3 Objective of the study

1. To increase resource availability of Cloud Computing system.
2. To handle the potential threats by deploying Multi-level IDS and managing user logs per group according to anomaly level.
3. To develop an address book application that will be launch as a cloud application.

1.4 Limitations of the Study

The problems encountered during the course of carrying out this research work include:
Fund: There was limited fund to take care of the research properly especially when test running the application.
Research Material: Lack of access to research materials on the topic in the school library and even public libraries were also a major constraint in the cause of this project.

1.5 Scope Of The Study

Multi-level intrusion detection and log management in cloud computing is an embracing topic in the determinant of how applications are developed and installed on a server, intrusion detection systems which acts as an antivirus is also installed to fight againstcyber-attacks. For the purpose of this research work, the researcher shall be limited to developing an address book application which will be installed on a server for us to be able to test the strength of multilevel intrusion and log management in cloud computing.