Correlation-based sequence alignment models for detecting masquerades in cloud computing

摘要

Despite the important benefits that cloud computing could offer, security remains one of the major concern that is hindering the development of this paradigm. Masquerades attacks and malicious insiders are often listed among the most dangerous challenges faced by cloud computing. The detection of masquerade attacks in cloud systems has to integrate host and network detection by correlating the user's behaviours in several virtual machines. The author has introduced two approaches that use sequences of events from the operating system and data from the network environment. Then, he integrated these approaches through a neural network that also considers information about the active session. Both approaches use his DDSGA method, a data-driven semi-global alignment approach for detecting masquerade attacks based on the alignment technique. He evaluated the efficiency and accuracy of the approaches through the Cloud Intrusion Detection Dataset. He also shows that the integrated approach results in the best accuracy and the proposed approaches outperform a recent masquerade detection framework that works in the cloud computing systems called the Sliding Window-based Anomaly Detection using Maximum Mean Discrepancy.