Multi-VMs Intrusion Detection for Cloud Security Using Dempster-shafer Theory

摘要

Cloud computing provides easy and on-demand access to computing resources in a configurable pool.The flexibility of the cloud environment attracts more and more network services to be deployed on the cloud using groups of virtual machines(VMs),instead of being restricted on a single physical server.When more and more network services are deployed on the cloud,the detection of the intrusion likes Distributed Denialof-Service(DDoS)attack becomes much more challenging than that on the traditional servers because even a single network service now is possibly provided by groups of VMs across the cloud system.In this paper,we propose a cloud-based intrusion detection system(IDS)which inspects the features of data flow between neighboring VMs,analyzes the probability of being attacked on each pair of VMs and then regards it as independent evidence using Dempster-Shafer theory,and eventually combines the evidence among all pairs of VMs using the method of evidence fusion.Unlike the traditional IDS that focus on analyzing the entire network service externally,our proposed algorithm makes full use of the internal interactions between VMs,and the experiment proved that it can provide more accurate results than the traditional algorithm.