Adaptive Cloud Intrusion Detection System Based on Pruned Exact Linear Time Technique  

作　　者：Widad Elbakri Maheyzah Md.Siraj Bander Ali Saleh Al-rimy Sultan Noman Qasem Tawfik Al-Hadhrami 

机构地区：[1]Faculty of Computing,Universiti Teknologi Malaysia,Johor Bahru,Johor,81310,Malaysia [2]Computer Science Department,College of Computer and Information Sciences,Imam Mohammad Ibn Saud Islamic University(IMSIU),Riyadh,11432,Saudi Arabia [3]School of Science and Technology,Nottingham Trent University,Nottingham,NG118NS,UK

出　　处：《Computers, Materials & Continua》2024年第6期3725-3756,共32页计算机、材料和连续体（英文）

基　　金：funded by the Deanship of Scientific Research at Imam Mohammad Ibn Saud Islamic University(IMSIU)through Research Partnership Program No.RP-21-07-09.

摘　　要：Cloud computing environments,characterized by dynamic scaling,distributed architectures,and complex work-loads,are increasingly targeted by malicious actors.These threats encompass unauthorized access,data breaches,denial-of-service attacks,and evolving malware variants.Traditional security solutions often struggle with the dynamic nature of cloud environments,highlighting the need for robust Adaptive Cloud Intrusion Detection Systems(CIDS).Existing adaptive CIDS solutions,while offering improved detection capabilities,often face limitations such as reliance on approximations for change point detection,hindering their precision in identifying anomalies.This can lead to missed attacks or an abundance of false alarms,impacting overall security effectiveness.To address these challenges,we propose ACIDS(Adaptive Cloud Intrusion Detection System)-PELT.This novel Adaptive CIDS framework leverages the Pruned Exact Linear Time(PELT)algorithm and a Support Vector Machine(SVM)for enhanced accuracy and efficiency.ACIDS-PELT comprises four key components:(1)Feature Selection:Utilizing a hybrid harmony search algorithm and the symmetrical uncertainty filter(HSO-SU)to identify the most relevant features that effectively differentiate between normal and anomalous network traffic in the cloud environment.(2)Surveillance:Employing the PELT algorithm to detect change points within the network traffic data,enabling the identification of anomalies and potential security threats with improved precision compared to existing approaches.(3)Training Set:Labeled network traffic data forms the training set used to train the SVM classifier to distinguish between normal and anomalous behaviour patterns.(4)Testing Set:The testing set evaluates ACIDS-PELT’s performance by measuring its accuracy,precision,and recall in detecting security threats within the cloud environment.We evaluate the performance of ACIDS-PELT using the NSL-KDD benchmark dataset.The results demonstrate that ACIDS-PELT outperforms existing cloud intrusion detection techni

关 键 词：Adaptive cloud IDS harmony search distributed denial of service(DDoS) PELT machine learning SVM ISOTCID NSL-KDD 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]