Intrusion Detection in the Cloud

Intrusion detection systems (IDS) have been used widely to detect malicious behaviors in network communication and hosts. IDS management is an important capability for distributed IDS solutions, which makes it possible to integrate and handle different types of sensors or collect and synthesize alerts generated from multiple hosts located in the distributed environment. Facing new application scenarios in cloud computing, the IDS approaches yield several problems since the operator of the IDS should be the user, not the administrator of the cloud infrastructure. Extensibility, efficient management, and compatibility to virtualization-based context need to be introduced into many existing IDS implementations.Additionally, the cloud providers need to enable possibilities to deploy and configure IDS for the user. Within this paper, we summarize several requirements for deploying IDS in the cloud and propose an extensible IDS architecture for being easily used in a distributed cloud infrastructure.