1.1 Background of Study
It is efficient and cost economical for consumers to use computing resources as much as they need or use services they want from Cloud Computing provider. Especially, Cloud Computing has been recently more spotlighted than other computing services because of its capacity of providing unlimited amount of resources. Moreover, consumers can use the services wherever Internet access is possible, so Cloud Computing is excellent in the aspect of accessibility. Cloud Computing systems have a lot of resources and private information; therefore, they are easily threatened by attackers. (Enisa, 2009).
Especially, System administrators potentially can become attackers. Therefore, Cloud Computing providers must protect the systems safely against both insiders and outsiders. IDSs are one of the most popular devices for protecting Cloud Computing systems from various types of attack. Because an IDS observes the traffic from each VM and generates alert logs, it can manage Cloud Computing globally. (Roberto Di Pietro and Luigi V. Mancini, 2008).
Another important problem is log management. Cloud Computing systems are used by many people, therefore, they generate huge amount of log-s. So, system administrators should decide to which log should be analyzed first. (JaeHyuk Jang, Cisco, 2010).
Anomaly detection systems identify those activities which deviate significantly from the established normal behaviors of the system. These anomalies are most likely regarded as intrusions. Anomaly detection techniques can be effective against unknown or the latest attacks. However, anomaly detection systems tend to generate more false alarms because an anomaly may be a new normal behavior or an ordinary activity. There are three ways to report the detection results. They are notification, manual response, and automatic response. In notification response system, IDS only generates reports and alerts. In manual response system, IDS provides additional capability for the system administrator to initiate a manual response. In automatic response system, IDS immediately respond to an intrusion through auto response system.
1.2 Problem Statement of the Study
The fully distributed and open structure of cloud computing and services becomes an even more attractive target for potential intruders. It involves multi-mesh distributed and service oriented paradigms, multi-tenancies, multi-domains, and multi-user autonomous administrative infrastructures which are more vulnerable and prone to security risks. Cloud computing service architecture combines three layers of inter-dependent infrastructure, platform and application; each layer may suffer from certain vulnerabilities which are introduced by different programming or configuration errors of the user or the service provider. A cloud computing system can be exposed to several threats including threats to the integrity, confidentiality and availability of its resources, data and the virtualized infrastructure which can be used as a launching pad for new attacks. The problem becomes even more critical when a cloud with massive computing power and storage capacity is abused by an insider intruder as an ill-intention party which makes cloud computing a threat against itself.
1.3 Aim of the Study
The aim of this study is to design a multi-level intrusion detection and log management system in cloud computing.
- Objectives of the Study
The specific objectives are:
- To increase resource availability of Cloud Computing system.To handle the potential threats by deploying Multi-level IDS and managing user logs per group according to anomaly level. To develop an address book application that will be launch as a cloud application.
- Scope and Limitation of Study
Multi-level intrusion detection and log management in cloud computing is an embracing topic in the determinant of how applications are developed and installed on a server, intrusion detection systems which acts as an antivirus is also installed to fight against cyber-attacks. For the purpose of this research work, the researcher shall be limited to developing an address book application which will be installed on a server for us to be able to test the strength of multilevel intrusion and log management in cloud computing.
The problems encountered during the course of carrying out this research work include Fund:
- There was limited fund to take care of the research properly especially when test running the application.
- Research Material: Lack of access to research materials on the topic in the school library and even public libraries were also a major constraint in the cause of this project.
1.6 Significance of Study
The significance of this study includes the following:
- It helps in economic cost reduction in running a particular application. It provides humans with effective resource management.
- It will help organizations in focusing on core business in the sense that you only concentrate on what means most to you. Since your applications will be run over the internet, you do not have to worry about technical problems and other inconveniences associated with physical unified storage solution spaces.
- It increases performance and support by updating the fact that all your software and applications automatically.
- It provides security and compliance. It provides anytime anywhere access to information.
1.7 Definition of Terms
Cloud Computing: the practice of using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server or a personal computer.
Log management (LM): comprises an approach to dealing with large volumes of computer-generated log messages (also known as audit records, audit trails, event-logs, etc.). Log Management generally covers: Log collection. Centralized log aggregation. Long-term log storage and retention.
Intrusion Detection: An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations.
Html Code: – HTML stands for Hyper Text Markup Language. It is a type of computer language that is primarily used for files that are posted on the internet and viewed by web browsers. HTML files can also be sent via email.
Markup language: – A markup language is a combination of words and symbols which give instructions on how a document should appear. For example, a tag may indicate that words are written in italics or bold type.
Web browser: -A Web browser is a software program that interprets the coding language of the World Wide Web in graphic form, displaying the translation rather than the coding. This allows anyone to “browse the Web” by simple point and click navigation, bypassing the need to know commands used in software languages.
File extension: – A file extension is the suffix at the end of a filename that tells a computer, and the computer user, which program is needed to open the file. Also called a filename extension, this suffix preceded by at least one period, is generally one to five characters long but the norm is usually three characters in length.
Email: – Email, also sometimes written as e-mail, is simply the shortened form of electronic mail, a protocol for receiving, sending, and storing electronic messages. Email has gained popularity with the spread of the Internet. In many cases, email has become the preferred method of communication.
TCP/IP: – This often used but little understood set of operations stands for Transmission Control Protocol/Internet Protocol. TCP/IP is the combination of the two and describes the set of protocols that allows hosts to connect to the Internet. In actuality, TCP/IP is a combination of “more than those two protocols, but the TCP and IP parts of TCP/IP are the main ones and the only ones to become part of the acronym that describes the operations involved.
Text File: – A text file is a computer file that stores a typed document as a series of alphanumeric characters, usually without visual formatting information. The content may be a personal note or list, a journal or newspaper article, a book, or any other text that can be rendered accurately in typewritten form. Hyper Link:-A hyperlink is a graphic or a piece of text in an Internet document that can connect readers to another webpage, or another portion of a document. Web users will usually find at least one hyperlink on every webpage. The simplest form of these is called embedded text or an embedded link.