Keywords

1 Introduction

Internet is the driving force behind various technologies but one of the discussed among all of them is cloud computing. It is still an advancing innovation technology that exchanges current innovating technology and figuring thoughts into utility like arrangements. The relocation diminishes time and cost of creation and offers better execution and unwavering quality [1]. Cloud computing is well defined as the convenient, on demand, and network access to the pool of resources like network servers, storage devices, and services that can quickly provisioned and released with nominal management effort [2]. The advantages of distributed computing incorporate diminishing the equipment and support cost, accessibility around globe, adaptability, and to a great degree mechanized process. It conveys unfathomable advantages to both individuals and ventures by decreasing the requirement for client association by concealing specialized points of interest, for example, updates, licenses, and support from its clients. Cloud can like wises provide improved safety over single-server arrangements and subsequently cloud totals resources and permits licensed security individual while as the typical organizations are restricted with system and network admin who will not be well learned about cybersecurity issues. Cloud computing can be stronger in distributive denial of service attacks in view of the availability of assets and flexibility of design.

2 Related Work

Analysts research on perceiving cloud issues, shortcomings, threats, and other security and protection matters to give countermeasures as plans, approaches, and architectures [3,4,5]. Various case studies [6,7,8,9] have led research on security in cloud computing and matters concerning single property, for example, information reconciliation, confirmation, shortcomings, and reviewing. Different scientists offer reviews [10,11,12] that cover the different zones and different security issues and resolutions. The joining of mobiles with cloud computing because of the utilization of cell phones has another security challenge identified with those that are related to ad hoc and sensor networks [13, 14]. The authors presented reviews on cloud security necessities like privacy, integrity, transparency, accessibility, and accountability.

3 Issues and Categories

This paper classifies the issues in the following categories (Tables 1 and 2).

Table 1 Cloud computing security categories
Full size table
Table 2 Cloud computing security issues and classifications
Full size table

4 Attacks and Countermeasures

We have evaluated some of the known attacks in cloud computing and tried to find possible countermeasures to these known attacks.

4.1 Theft of Service

The theft of service attack [15] exploits the weaknesses in the scheduler of some hypervisor. This attack is recognized when scheduling mechanism is invoked by the hypervisor that fails to identify the account. The hacker guarantees that the process is certainly not scheduled. The common events of this attack are by means of cloud computing sources like human resources for a lengthy time and keeping it secreted from a dealer and using cloud computing means like storage or operating system platform for extended time without repeating it in billing cycle.

The countermeasures to this issue are given by Zhou et al. in [16] by altering the scheduling and changing the scheduling processes as well as checking policies and time intervals by means of exact scheduling, uniform scheduling, passion scheduling, and Bernoulli scheduling.

4.2 Denial of Service Attack

Out of the grave issues in the cloud security, denial of service attack is the most serious one. The attacks are at ease to perform and problematic for security professionals to deal with DDoS attacks that are more damaging than DoS attacks because there is no deterrence mechanism to avoid them.

Karnwal et al. [17] give a plan called cloud defender which deals with sensor filtering, hop count filtering, ip divergence filtering, puzzle resolving, and double signature filtering, yet the issue is that it needs an evidence and particle proof and is built on supposition.

4.3 Malware Injection

The malware injection issue accounts to a deployed replica of victims service instance uploaded by hacker; thus, the service requirements are processed within malicious instance. The hacker exports its private access to attack service security domain and acquires access to the customer data. The challenge is not only to identify malware injection but also ability to define the specific node on which hacker has loaded for malicious purpose [18].

The countermeasure is given by Oberheide et al. in [19] called Cloud Av which provides two features antivirus as a service and N-version defense. The authors prove the efficiency of Cloud Av by validating in cloud environment which provides improved detection of malicious software, improved forensic capabilities, and novel threat discovery approach.

4.4 Phishing Attacks

It is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack, or the revealing of sensitive information.

Cloud service alliance stated that CSP does not maintain adequate control over system in order to escape such attacks but CSA offers some precautionary measures such as registration procedure, security identity check technique, and improved monitoring skills [20].

4.5 Botnet Attacks

In this type of attack, the attackers do not reveal their identities to decrease the chance of discovery and traceback. This is accomplished by targeting victim by sequence of other hosts named stepping stone which is recruited through illegal botnets.

The countermeasures of stepping stone and botnet are by recognizing a specific host which is a stepping stone. The finding work is built on the hypothesis of relationship between licensing and outbound traffic of likely stepping stone host.

4.6 Audio Steganography Attacks

Audio steganography attacks are one of the grave attacks to cloud storage system. Audio steganography benefits customers to hide their top-secret information with normal audio records. The user communicates secret info via transferring media files which seem to be regular media records. Attackers are able to trick the present security mechanism by hiding their malicious cipher in sound records and direct it to target’s server [21].

Liu et al. in [22] performed an investigation of audio steganography attacks on cloud storage system. The key is to investigate the hiding place of audio records beneath storage system by grayscale steganalysis technique.

4.7 VM Rollback Attacks

The VM part in cloud computing is most susceptible to issues. In VM rollback attack, an attacker takes benefit of prior snaps and run it without taking client into account and then erases history and again runs the similar or changed snap. The hacker launches brute force attack to give login and password for virtual machine and even if the guest operating system has restrictions on the amount of efforts such as blockade as user [22].

Szefer et al. [23] provided a design named hyperwall to cope with the hypervision susceptibilities. The hyperwall disables the suspended rescue functions of the hypervision.

5 Discussion

Out of the lots of challenges faced by cloud computing, security is still one of the biggest challenges introducing security resolutions like IDs, firewalls, contract out the personality supervision framework, and introducing antivirus, and so forth are costly and influence execution. The significant security research work lies in giving good security techniques in doing as such with minimal resources and without decline performance [23, 24].

This helps in providing the complete study of attacks in cloud, forming dependencies, and co-relating vulnerabilities across various cloud companies. It helps us to deliver protective measures as well as protection tools. This paper identifies few parts that are still not given attention in cloud computing such as checking and relocation of data from cloud to other. Security procedures must be dynamic and autonomous and should be implanted in cloud architecture for better results.

6 Conclusion

The adaption of clouds is rising day by day. With the gigantic evolution of cloud computing, the security of cloud remains still a big challenge and has not been addressed completely. In this work, we identified the security issues and tried to provide countermeasures and comparative analysis of effectiveness of the prepared solutions. We identified the areas that are still unattended such as auditing and migration. We identified that emphasis should not only be given only on fast performance but quality of service should be considered seriously.