Keywords

1 Introduction

Cloud Computing is an emerging technology in the recent years. It provides basic services such as Software as a Service, Platform as a Service, Infrastructure as a service, Security as a Service etc. While providing these services, there exist several issues such as data issues [1, 2]: Data Lock-in, Data Transfer Bottlenecks, Traffic Management, Reputation sharing, security issue: availability of Service, Data Security, performance issues and energy issue since cloud services are stipulated through Internet. In this, cloud security has gained more importance over the past years with the increase in the number of threats targeting network for information and misuse. Cloud virtualizations runs through standard protocols and are vulnerable to intruders for cyber attacks [3]. Intrusion Detection System plays vital tool for cloud security to prevent outside attacks rather than inside attacks. Attacks are of two types: (1) Active Attacks—likely to change the content. (2) Passive attacks—does not change the content but monitors/listens [4, 5]. The existing IDS works in the network layer which makes the intruder to intrude at application level. Some of the authorized port such as HTTP (80) is kept always open for providing the web services to the cloud user. Other protocols at application layer, such as FTP (21) is not opened always but can be opened when needed. The attack that goes undetected by network layer can be detected by Application level IDS. The efficient IDS technique is incorporated in cloud infrastructure to predict these attacks which works at application level. The classification of IDS and its detection techniques are discussed in the following chapter.

2 Classification of IDS

The Intrusion Detection System has been classified based on the following factors (i) Based on environment and (ii) based on detection techniques. Figure 1 shows the Classification of IDS [1, 6].

Fig. 1
figure 1

Classification of IDS

Full size image

2.1 Based on the Environment

IDS has been classified into 3 types [7].

  • Network based IDS (NIDS): It monitors the network traffic and analyses the network for any maliciousness.

  • Host based IDS (HIDS): It monitors the activity of a system and detects the intrusive behavior through monitoring and analyzing log file.

  • Application based IDS: It analyses the particular application for vulnerability.

The Table 1 shows the comparison of Host based IDS and Network Based IDS.

Table 1 Comparison of host based IDS and network based IDS
Full size table

2.2 Based on Detection Method

Signature based Detection: This method uses signature based pattern matching by comparing the captured patterns with the existing historical data in knowledge base to detect intrusions. It is used to detect known attacks.

Anomaly Detection: In this method, the legitimate users behavior are collected over a period of time and the statistical test will applied on observed behavior to detect any abnormalities. It is used to detect unknown attacks. Apart from statistical test, machine learning based and data mining technique can be used to detect anomalies.

Hybrid Detection: This method enhances the detection rate by combining both misuse and anomaly detection. The misuse detection detects only known attacks and the unknown attacks not detected by the misuse will be detected by anomaly method.

3 Semantic Versus Non-semantic

The packets transferred between cloud users and servers are captured and analyzed for any intrusion. Based on the detection techniques discussed, a signature based intrusion detection system is built to analyze the packets that are expected to be delivered to the network service or application. The intrusions can be detected either semantically or non-semantically.

3.1 Non-semantics Based IDS

Non-semantics based IDS hunted for the patterns in the input traffic and if the pattern matches with some predefined pattern then a intrusion alert will be displayed. An intelligent hacker may intrude the system by simply not using the patterns hunted by the non-semantics based IDS. So, a non-semantics based intrusion detection system fails miserably.

3.2 Semantic Based IDS

A semantics based IDS will define a rule such that the occurrence of some sort of patterns in the network traffic definitely indicates a malicious activity. So there are no false positives (false alarm of an attack) in semantic based IDS. Moreover, the time taken for detecting an attempt is very lesser than non-semantic based IDS since the search space is reduced.

4 Architecture of Cloud IDS

The packets transferred between cloud users and servers are captured by packet sniffer and analyzed for any maliciousness by Cloud IDS Engine [8]. The architecture of the Cloud IDS is shown in Fig. 2. Ethereal is used for protocol analyzer/packet capturing. The Protocol analyzer recognizes the protocol type and dispatches the packet to the corresponding state machine. A protocol analyzer will need to parse messages according to a protocol-specific message format and it reduce the number of false positive and false negative. This needs parsing to be done incrementally, since application-layer messages can be split among several packets. Correct parsing state must be maintained between packets, else partial messages will be analyzed incorrectly. The messages are then analyzed by the message parsing grammar. Semantic Classification tree is constructed by analyzing the specification of the protocol [9]. The specification gives the Rules and the individual patterns which will be matched in the corresponding fields of the protocol [10]. The tree is formed in the top-down format. As each node on the path from the root to a leaf node checks with the input, if any signature does not matches with the rule base then it raises alerts to the cloud IDS Interpreter which in turn alerts the Virtual Cloud Provider. The traffic is continuously monitored and analyzed for any malicious behavior and is reported to the administrator.

Fig. 2
figure 2

Architecture of cloud IDS

Full size image

5 Vulnerabilities at Application Level Protocol

The attackers make the system to be compromised by hacking the protocols such as HTTP, FTP etc.… at application layer. The semantic Classification tree has been generated for the following vulnerabilities if any malicious code matches with the semantic rule base then it raises alerts to the cloud IDS Interpreter which in turn generates alert to the Virtual Machine.

5.1 HTTP Vulnerabilities

The HTTP protocol is application level protocol and is based on the pattern of request/response [11]. A client establishes a connection with a server and sends a request to the server in the form of a request method, URI, and version, followed by a MIME-like message containing request modifiers, client information, and possible body content. The server responds with a status line, including the message’s protocol version and a success or error code, followed by a MIME-like message containing server information, entity meta information, and possible body content. Most HTTP communication is initiated by a cloud user agent and consists of a request to be applied to a resource on server. The HTTP Grammar is constructed. Based on this Grammar, Semantic classification tree is generated and analyses the message for any intrusions.

The following table gives an overview of various HTTP attacks and the extent to which the intruders can compromise the system by gaining information about the system. The HTTP Request syntax: Method/URI/Version. The method can be GET, POST etc. The attacks can be analyzed by looking at the GET method and the corresponding response. The signatures by which the intruders can compromise the system through HTTP Request is shown in Table 2. The HTTP responses are identified by the status codes associated with it and are shown in Table 3.

Table 2 Vulnerabilities at HTTP request
Full size table
Table 3 Vulnerabilities at HTTP response
Full size table

5.2 FTP Vulnerabilities

FTP URL Syntax (By RFC 1738):

ftp://user:password@host:port/path

USER:

A user name (user id) on the host

PASSWORD:

The password corresponding to the user name

HOST:

The fully qualified domain name of a network host, or its IP address

PORT:

The port number 21

Table 4 shows the vulnerabilities at FTP.

Table 4 Vulnerabilities at FTP
Full size table

5.3 Scripting Vulnerabilities

There are several applications vulnerable to the HTML scripting attacks. The scripting attacks can be found in HyperText Markup Language (HTML). The malicious HTML-based content will be embedded by the attackers within cloud user web requests. Many of the browsers are enabled in default and has the capability to interpret the scripts embedded within HTML content. The attacker can successfully inject the script embedded in HTML, it will be executed by Cloud user [12]. By executing the injected malicious code, the attacker can modify the content or can hack the username and password. The code can be written in any scripting languages. Scripting tags which are used to insert malicious content are <SCRIPT>, <OBJECT>, <APPLET> and <EMBED>. Cross Site Scripting (CSS), SQL Injection, Denial of Service and Brute force are the most common of all attacks in HTML [11] shown in Table 5.

Table 5 Scripting vulnerabilities
Full size table

The vulnerabilities mentioned above can be detected by IDS engine. The semantic classification tree will be generated for these vulnerabilities by analyzing the features of request and its corresponding response sequence. The signature that does not matches with the semantic rule base checks for any maliciousness and report to the virtual cloud provider [13, 14]. The complete semantics of the HTTP, FTP transferred (request-response) between cloud user and cloud provider are maintained. The IDS engine checks the pattern of each incoming packet individually for attack.

6 Conclusion

The proposed architecture of cloud IDS at application level protects the vulnerabilities at levels since it protects the below layers. The semantic Classification tree plays vital role by parsing the various protocol message to the IDS Interpreter and has an efficient memory usage since the amount of memory needed for working of the IDS depends on the rule size. The signatures and rules are updated automatically and can be expandable with more semantic parameters. The false alarm rate gets reduced by using Signature based Intrusion Detection System. Hence the vulnerabilities can be detected more accurately.