Keywords

1 Introduction

In recent times, the IT infrastructure is outsourced by the companies to the Cloud in order to get the benefits offered by the Clouds like scalability, rapid provisioning, and reduced cost. In spite of the advantages offered by Clouds, security in general and malicious insider threats in particular has been the most critical area of concern of the organizations. Thus, gaining the trust of the Cloud users’ security from the insider threats is important to achieve [1, 2]. The traditional mechanisms of intrusion detection are not flexible enough to manage with the needs of Clouds, such as frequent changes in infrastructure. In this paper, we study the problem of insider threats within the domain of Cloud computing. Also, we have studied the various intrusion detection systems available for the Cloud environments and identified the characteristics which are offered by the existing systems and the needs for the future improvements.

2 Cloud Computing: A Security Perspective

The security remains the biggest issue in Cloud computing, as Cloud provides services which are located on a remote location and it is the trust of consumer on Cloud service providers that their data will be secured. The integrity and confidentiality of the user’s data are at risk as they do not have physical control over the data [3]. This is because of the fact that the Cloud server is at different location and client is located at different locations. Therefore, the server cannot be trusted completely for managing details of users and access rights. The data of user is at risk due to insider attacks or compromised servers. This can be overcome if the users trust Cloud service providers to secure and properly manage their data [4]. Due to the fact that the insiders are very well familiar with the infrastructure, procedures of operation and terms and conditions of the organization the attack of malicious insiders are more severe [4]. Insider attacks are done by malicious employees at any location, i.e., provider’s or user’s. The attacks caused by the insiders have an adverse effect on the trust of the Cloud user on the provider. Passwords, cryptographic keys, and files can easily obtained by the malicious insider. These attackers not only damage the financial value but also the reputation of an organization [4].

3 Intrusion Detection System (IDS)

Intrusion detection is the process of monitoring computers or networks for unauthorized entry, activity, or file modification.

3.1 Classification of IDS According to Source of Data [5, 6]

  1. 1.

    Host-based intrusion detection system (HIDS): in which sensors are responsible for detecting intrusions. Intrusions are found on single host. These operate on host side and monitors as well as detects malicious activities in system calls, application logs, etc.

  2. 2.

    Network intrusion detection systems (NIDS): sensors are focused on network segment only. NIDS monitor the attacks in networks and detect the variation in the transmissions in the networks.

  3. 3.

    Distributed intrusion detection systems (DIDS): combine both the types of sensors. It further has three types: (a) Mobile agent IDS (MA-IDS), (b) Grid-based IDS (GIDS), and (c) Cloud-based IDS (CIDS).

3.2 Limitations of Various IDSs

HIDS cannot be used as attackers may not leave traces in the operating system of the host where the IDS are residing. NIDS cannot detect the attack if the communication is encrypted. In clouds, distinct users share various resources. The attacks can migrate from and be intended for any of the Cloud resources. Thus only DIDs can be used. But, the challenges in the adoption of the DIDS in Clouds are (i) Distinct types of users and user requirements; (ii) Complex architecture; and (iii) Different requirement of security. MA-based IDS are not suitable as (i) Hierarchical structure poses problem of reliability and scalability, and (ii) Not flexible to protect from the attacks on IDS itself. GIDS are not suitable as (i) Every service model (SaaS, IaaS and PaaS) has different set of threats, users, and requirements; (ii) Clouds are highly scalable; (iii) GIDS solution cannot correlate the alerts from the different nodes; (iv) Performance and load balancing are needed more in Clouds than Grid [6].

4 Literature Review

Rule-based learning for the identification of insiders and a solution for the detection of wrong insider activities have been given by the authors [7]. Some of the threats identified include insecure shared technology vulnerabilities, application programming interfaces, and malicious insiders. When an attack occurs, machine learning techniques are used to raise an alarm. The seven common activities of the insiders are (Table 1):

Table 1 Common activities of insiders
Full size table

For activity classification purposes, the following machine learning techniques are used (Table 2).

Table 2 Machine learning techniques
Full size table

It has been found by the analysis that decision tree C4.5 and multilayer perception are better for activity classification in Cloud-based environment. The result of the confusion matrix reveals C4.5 as the best classifier.

Authors in [8] have used technique of multithreading for improving the performance of the IDS. NIDS proposed sensitizes as well as monitors the network traffic using the sensors. In this model, the Cloud user accesses the remote servers over the Cloud network. The monitoring and logging of the requests and the actions of the user are done by a multi-threaded NIDS, which has large data handling capacity and also reduces the packet loss.

A combined approach for malware detection and root kit prevention used in [9] in virtualized Cloud environment. The IDS is intended to execute on VM instances with a backend Cloud to share out malware scanning operations among numerous back ends. Flexible, distributed security solution is given with a minimal overall resource footprint on the end host. The traditional signature checks are performed for the detection of known as all as the novel malware. An integrity check of authorized Kernel modules is given which can prevent the installation of root kits through the corrupted kernel modules. This approach is easy to maintain as only change is to be made in the kernel of the system. Infrastructural security is focused not the attacks against VM monitors.

Authors [5] in their research presented a review of various methods and tools used for detection and prevention of intruders in Cloud computing. Four concepts for the development of the CIDS identified are (a) automatic computing; (b) oncology; (c) risk management; and (d) fuzzy theory. The taxonomy gives two layers functional layer and structural layer. The requirements identified for CIDPS on the basis of review are (i) large-scale handling of multi tiered autonomous computing and data processing environments; (ii) detection of variety of attacks with least positive rates; (iii) super fast detection and prevention; (iv) self-adaptive automatically; (v) CIDPS Scalability; (vi) deterministic; (vii) synchronization of autonomous CIDPS; (viii) resistance to compromise. A Cloud intrusion detection and prevention system which meets all the requirements is considered to be good one.

A framework of CIDS is presented in [6], which has a module to review the alerts and notify the administrator of the Cloud. The features identified are (i) point-to-point solution which is applicable to various platforms and expandable; (ii) as there is no central coordinator, so single point of failure is not there; (iii) distribution of processing to different Cloud locations protects the CIDS from the threats which can organize a job in the VM and alter its workings if it was executed in monitored VM; (iv) installing middleware where the framework resides increases the flexibility and portability; (v) it uses knowledge base combined with the behavior base which increases attack coverage; (vi) every node has audit system for monitoring of the messages and logging. It gives the benefit that every node has the capability to detect the masqueraders. The following three models have been given as CIDS detection models:

  1. 1.

    Audit Exchange Model (Model A): The nodes Cloud swap over audit data. It has high detection efficiency and the low survival of the masquerader. Its limitations include need of rapid cyclic updates of audit data at the CNs.

  2. 2.

    Audit Exchange Model with a neural network (Model B): Combines model A to neural networks. It offers the benefit of less survival of masquerader than Model A and C. Also the hit rate is high with lower false positive and false negative alarms than Model A and C. Other than limitations of model A; it has a limitation of low performance due to overhead to update neural network.

  3. 3.

    The Independent Model (Model C): Every node of Cloud calculates its own audit data without swapping data with Cloud nodes. The benefits offered are no need of periodic update and less burden for Cloud network, as no swapping of data is there. Also there are low processing overheads than model A and C. Limitations include longer survival of masquerader than model A & B and low hit rate than model B as neural cannot be used.

The applications of the three proposed models are to be done to find the best one. Also the summarizer and parser algorithms are to be parallelized in order to reduce the corresponding overhead.

An Insider threat detection model to detect despiteful insiders has been proposed in [10]. An observational system to test this possibility was implemented to sustain the applicability in a SaaS Cloud deployment model. This method uses the sequential rule mining approach to discover malicious utilization patterns for a particular profile.

Authors in [11] have given an ICAS (IDS Cloud analysis system). MapReduce algorithm of Hadoop is used for the analysis of intrusion detection system in log files. It creates a user-friendly output view in which user can easily and clearly monitor the behavior of the attack. In experimental study, it has been found that the calculation speed is increased by 80%. IDP8200, NK7 Admin and Snort logs are used as ICAS analysis object record in this paper. The main advantage of ICAS is the scalability and reliability offered by it. ICAS can be improved for the processing large-scale data.

A framework which is an open source solution has been given in [12]. APIs and interfaces are given which are used in the development of the security components in a distributed manner and building of customized event correlation rules. The framework consists of a collection of components which are organized in a hierarchical manner. The three main components of the framework are probes, agents, and security engines.

According to the three architectural layers, the security engines are organized in a hierarchical manner. At the lowest layer, the raw security data collected by the security engines. It can be offered by the Cloud provider as service which includes IDSs; Log analyzers; and specific security mechanisms provided by the Cloud platform. It is the responsibility of the Cloud provider, at the higher level, to enable additional IDSs and attack them to independent VMs. The provider is able to recognize the compromised virtual components of the clients by correlating the information provided by the higher layer with the data collected by the lower layer. Attack Evaluation Tree (AET) is used to represent the attack in a tree like structure. The goal of the attacker is the root node while the access path is through the offsprings.

Authors in the research [13] introduced three concrete MI attacks with a proof of concept implementation based on existing tools. Three introduced MI attacks in this paper are: memory scanning, template poisoning, and snapshot cracking.

Authors [14] described the differences between the traditional insider and insider in the Cloud. The two types of insider threats identified in Cloud computing, viz., (a) at the Cloud providers end, and (b) at the Cloud clients end. Both have different set of problems and area of attacks. The countermeasures of the insider threat in the Cloud provider are:-At client side: Cryptographic techniques, geo-redundancy are used; and At provider side: Separation of duties, logging, legal binding, and insider detection models. The problems in various methods are: (a) IDS/IPS: in IaaS host-based IDS can be used, (b) Separation of duties: As in Clouds, same person has multiple roles, it is difficult to implement it in Clouds; (c) Attack origin identification: (i) In case of Clouds, the access is usually done by some remote computer. So there are no physical evidence for the attack, only digital evidence like IP etc can be used and (ii) In case of shared credentials, it is difficult to fix the responsibly; (d) Single point of failure and data leakage: Access to console of administrator can cause heavy loss of that, that without any sign of intrusion. The countermeasures of the insider threat in the Cloud outsourcer are (a) At client side: Log auditing, host-based IDS/IPS are used and (b) At provider side: Anomaly detection, separation of duties, and multifactor authentication are used.

5 Comparative Study

The various techniques being used for the detection of the intruders revealed by review are proactive forensics, graph-based analysis, honey pots (based on network sensors), IDS (based on network sensors), system call analysis (host based user profiling), command sequences and windows usage events, file system, memory, I/O, and hardware monitoring, metrics about user sophistication (Usage Anomalies), insider threat specification language, knowledge graphs, customized minimal attack trees, technological, social and educational and psychological parameters [15,16,17,18,19,20,21].

Selecting the best one is quite challenging. The characteristics desired in a CIDS are (i) Scalable and distributed IDS for Clouds without the failure points, (ii) Combination of Knowledge base and behavior base in order to detect the known as well as the unknown attacks with reasonable false alarm rates, (iii) Avoid single point of failure, (iv) the IDS should be protected from the attacks by isolating it, (v) flexible architecture, (vi) take into consideration various service models and requirements of user, (vii) dynamic policies as the security needs of each VM are varied, (viii) reduction in data transfer cost by reducing the network bandwidth, (ix) easy to adapt.

6 Future Scope

In this paper, we studied the insider attacks in the Cloud-based environments. An insider can easily attack in the Cloud environment. The effect of the attack is more severe than the traditional environments. Also the entity that physically performed the attack is difficult to detect and identify. The literature review has revealed the fact that in order to secure Cloud environment from the insiders a new insider prediction and detection models is needed. Also to evade the false estimations and generate correct user profiling new CIDS is required. Moreover, it appears that there is an adorning necessity for developing transparent network in Clouds. Also application intrusion detection systems (IDS) for Clouds are required. These systems can be given as a service to their clients who want to protect their infrastructure which has been outsourced. In future, model for predicting and detecting insider threats will be developed.