1

Cloud network security and privacy

Omessead Benmbarak, Phd Student , COSIM

Abstract—Cloud computing is becoming very trendy in the II. C LOUD S TORAGE

information world due to its efficiency, cost-effectiveness, pay-
as-you-go, flexibility and scalability. It offers infrastructures, Cloud storage is a cloud computing model that stores data
ready-to-use platforms and services according to the needs of its on the Internet through a cloud computing provider who
customers. Data security is an important issue encountered when
using these benefits of cloud computing. It can bring potential manages and operates data storage as a service [2]. It’s
security threats to the organization by not having firewalls, delivered on demand with just-in-time capacity and costs,
detection and prevention mechanisms. This paper provides an and eliminates buying and managing your own data storage
overview of different intrusions in cloud. Then, we analyze some infrastructure. This gives you agility, global scale and dura-
existing cloud based Firewalls and intrusion detection systems bility, with “anytime, anywhere” data access. These cloud
(IDS) with respect to their type, positioning, detection time,
detection technique, data source and attacks they can detect. The storage vendors manage capacity, security and durability to
analysis also provides limitations of each technique to evaluate make data accessible to your applications all around the
whether they fulfill the security requirements of cloud computing world. Applications access cloud storage through traditional
environment or not. storage protocols or directly via an API. Many vendors offer
Index Terms—Cloud Computing; Cloud Security; Firewalls; complementary services designed to help collect, manage,
Intrusion Detection and Prevention System; secure and analyze data at massive scale.

I. I NTRODUCTION
Cloud computing is a new computing paradigm in which the III. C LOUD SECURITY ISSUES
Internet is used to connect to provider network services [1].
According to the definition of the National Institute of Stan- Despite the advantages of Cloud Computing offered for the
dards and Technology (NIST), cloud computing is access via user, its adaptation as a storage medium is a major issue with
a telecommunications network, on demand and in self-service, regard to the security of valuable data in the cloud. Several
to configurable shared computing resources. Cloud computing problems [3] within cloud computing are:
provides three main services: Software as a Service (SaaS), • Data integrity
Platform as a Service (PaaS), and Infrastructure as a Service • Privacy and confidentiality
(IaaS). Additionally, cloud providers implement various types • Availability of data
of cloud models, such as public cloud, private cloud, and
hybrid cloud. Cloud computing deals with computing, storage,
software, network and storage equipment. The main benefit A. Data integrity
that cloud computing offers to the tenant is reduced cost
and increased scalability. The paper is organized as follows: Integrity Consists of protection against improper modifica-
in Section two, we give a detailed description of the cloud tion or destruction of information and includes a guarantee
storage. After introducing you=the security in cloud computing of non-repudiation and authenticity of information. That is to
we give same intrusions in cloud computing. In section five, say, the data must not be deformed or modified by use or
briefly presents a some preliminaries about firewalls. In section time. The user undertakes not to voluntarily disturb the proper
six, we described the intrusion detection and prevention. We functioning of computer systems and networks (internal or
validate our approach by a suggestion of some work to be external), whether by abnormal handling of the equipment, or
done to improve IT security at the cloud level and we end by the introduction of parasitic software known as generic of
with a conclusion. viruses, Trojans, logic bombs.
 2

B. Privacy and confidentiality C. Attacks on Virtual Machine

the property that the data is made unavailable to an unautho- Virtualization is a software technology widely used in Cloud
rized user. In simple words, it refers to the mechanism through Computing, which employs hardware and/or simulation soft-
which the data is accessible to the user who is authorized ware to run multiple operating systems and applications on a
to access the sensitive data where others including cloud shared hardware architecture. The attacker can take control of
computing processing should not extract any information from installed virtual machines [4]. For example, BluePill, SubVir,
it. and DKSM are some well-known attacks on the virtual layer.
Through these attacks, hackers may be able to compromise
the installed hypervisor, to gain control of the host. New
C. Availability of Data vulnerabilities, such as the zero-day vulnerability, are found
Availability refers to the ability to use a desired infor- in virtual machines (VMs) that lure an attacker to gain access
mation or resource, so it is a question of guaranteeing that to the hypervisor or other virtual machines, a cloud protection
a resource will be accessible by the client at all times, at system advanced can be developed by monitoring the activities
their convenience. A loss of availability is an interruption of guest virtual machines and the intercommunication between
of access to information or its use or to the information the various components of the infrastructure.
system. Redundancy is the primary strategy used to improve
D. Backdoor Attack
cloud system availability. Major cloud system vendors offer
geographic redundancy in their cloud systems, enabling single- Developers enable Backdoor option before publishing a
vendor high availability. website, this allows them to make it easier for developers to
access the backdoor, and sometimes these options are ignored,
This could allow hackers to remotely access the infected node
IV. I NTRUSIONS TO C LOUD C OMPUTING in order to compromise user privacy. In the Cloud Computing
environment, the attacker can access and control the cloud
Several common intrusions causes availability, confidential-
user’s resources through the backdoor channels and make
ity and integrity issues to Cloud resources and services.
the VM a Zombie to initiate a DoS/DDoS attack. This can
lead to spying and piracy of legitimate products. Firewall
A. Port scan and signature-based or anomaly-based IDS can be a common
solution to prevent backdoors.
Port scanning is a technique used to list open ports, closed
ports and filtered ports on a network server. In the cloud E. Insider attack
scenario, the attacker can attack the services offered by port Insider attacks are the realisation of the risk to companies,
scanning. There may be some issues regarding port scanning their data, their business partners and their long-term future
which could be used by an attacker such as Port 80 (HHTP) caused by insiders becoming malicious and acting upon it.
which is always open and is used to provide web services to These attacks are orchestrated or executed by people that
the user. Other ports, such as port 21(FTP), are not open all are trusted with varying levels of access to a company’s
the time, it will open when needed so the ports should be systems and facilities, and who have intimate knowledge
secured with encryption until the server software is properly of the company’s infrastructure which an external attacker
configured. This attack can be avoided by using security would take a significant period of time to develop.For insider
systems such as an IDS intrusion detection system or a attacks, signature based intrusion detection solutions can
firewall. normally be used.

B. Denial of service attack Firewall and Intrusion detection and prevention system in
Cloud could be the common solution to prevent some of the
A DoS attack is an attempt to render services assigned to attacks listed above. Several intrusion detection techniques are
authorized users unusable. In such an attack, the attacker tries discussed in next section.
to flood the victim by sending a large number of packets
from the innocent host (zombie) into the network. The Cloud V. F IREWALLS
is more vulnerable to DoS attacks, because it is shared by The firewall is considered a control and monitoring
many users, which makes DoS attacks much more damaging. choke point. It can be a single computer system or a set
When the cloud computing operating system notices a heavy of cooperating systems. The firewall allows only authorized
workload on the flooded service, it will start providing more traffic, as defined by the security policy, to pass. Firewalls [18]
computing power to deal with the additional workload. The are used to deny or allow protocols, ports or IP addresses...
attacker does not need to flood all servers that provide a It diverts incoming traffic according to a predefined policy.
certain target service, but only can flood a single Cloud address Several types of firewalls are discussed in [5].
in order to achieve a complete loss of availability on the
scheduled service. Using an intrusion detection system (IDS) Several researches [6], [7] et [8] have been carried out to
is the most common method of defense against this type of define the types of firewalls such as depicted in table I.
attack.
 3

TABLE I to the Cloud provider. And we’ve identified changes in

S UMMARY OF FIREWALLS TYPES . firewall filtering to telemetry that will allow the firewall
Firewall Type Summary to periodically collect and share application information,
Static Packet fil- detected threats, detected DNS information, and device health
tering firewalls • Allow/deny packet by inspecting only header with a particular network. Cloud security service provider
information such as source or destination ad-
dress, port numbers etc. uses threat information gathered through telemetry to provide
• detect malicious code in packets. enhanced intrusion prevention system (IPS) and spyware
• Cannot prevent against spoofing and fragment signatures to corporate firewall and other customers in the
attack
world.
Stateful packet
filtering • Used in client server environment where client
initiates request and server responses which are
Regarding IPDSs, An IDPS uses more patterns and rules
firewalls
allowed in bypassing the firewall rules. to give highly secure and trustworthy services. Therefore, it
• Requires additional resources like memory for needs more computing resources to provide better security.
state tables maintained in hardware or software
By extending this situation to cloud computing, the resources
Stateful inspec- allocated to cloud customers will decrease (Lee et al, 2011)
tion firewalls • Enhanced form of stateful packet filtering fire- [13]. Thus, the best solution is not necessarily a very complex
walls.
• Used for applications like FTP where multiple system using many resources and rules, but an optimized
ports are used. design and using intelligent techniques that make the system
• Examine the payload and open or close the independent through self-management and self-learning.
ports as per the protocol.

Proxy firewalls
• Can isolate internal network within Internet. VIII. C ONCLUSION
• Analyze the protocol syntax by breaking up
client/server connection. Cloud internet is a very valuable technological facility with
• Require lots of network resources. excellent service for its users. The security of the cloud
computing model must be an essential issue for its success. In
this mini paper, we have described various intrusions that can
lead to the loss or modification or unavailability of data and
VI. I NTRUSION D ETECTION AND P REVENTION S YSTEM resources. Then, we illustrated according to research carried
out by researchers the various types of firewalls and the IDS
A. IDS/IPS techniques in a cloud environment. We have provided the summary in
In the cloud, the detection method used by IDS can be the form of tables which are helpful in understanding the
signature-based or anomaly-based. The IDS can be installed various types easily. The analysis of several articles shows
in different places either at the edge of a network or on a that although the various IDS techniques in the cloud, they
host or on a virtual machine/hypervisor, or distributed in do not offer complete security. Cloud security can be greatly
all regions of the cloud. A summary of existing IDS/IPS improved by using soft computing techniques. However, there
techniques with their strengths and limitations is given in the are still several challenges and open questions to consider. In
table II. Table III, we have provided the limitations of each technique.
These security challenges must therefore be resolved before a
standard framework for cloud security can be recommended.
B. Types of IDS/IPS unsed in Cloud Computing
A bref of various IDSs are shown in Table III. We R EFERENCES
summarize the approaches presented with their type, [1] P. Mell and T. Grance. (2011) The nist definition of cloud computing
technique, positioning in the Cloud, advantages and (draft). [Online]. Available: http://csrc.nist.gov/publications/drafts/800-
disadvantages. This gives the cloud security research 145/Draft-SP-800-145-cloud-definition.pdf
[2] A. W. Services. (2022) Cloud storage. [Online]. Available:
community several challenges to address before a standard https://aws.amazon.com/what-is-cloud-storage/
cloud security framework can be proposed [12]. [3] W. Stallings. (2007) Network security essentials applications
and standards. [Online]. Available: http://www.ctan.org/tex-
archive/macros/latex/contrib/IEEEtran/
[4] D. Kusnetzky. (2014, Sep.) Layer virtualization model. [Online].
VII. P ROPOSED S OLUTION Available: https://virtualizationreview.com/articles/2014/10/14/7-layer-
virtualization-model.aspx
The proposed solution should provide a reliable cloud- [5] D. Sequeira. (2021) Intrusion prevention systems- security’s silver
based security solution for organizations where they can bullet? ANS Institute InfoSec Reading Room . [Online]. Available:
have their own management and monitoring. We proposed https://sansorg.egnyte.com/dl/ShxFE4Pwsl
[6] S. S. Naghmeh Dezhabad. (2018) Learning-based dynamic scalable load-
a distributed firewall architecture as a solution. Agents run balanced firewall as a service in network function-virtualized cloud
on each node in the system to manage firewall rules on computing environments. Springer Science+Business Media, LLC, part
those nodes. These agents communicate with a central Cloud of Springer Nature.
[7] A. Pathak. (2021) Différence entre les pare-feu matériels, logiciels
Firewall Management Server which is the central store of et cloud. [Online]. Available: https://geekflare.com/fr/hardware-vs-
knowledge and management before sending the packets software-cloud-firewall/
 4

TABLE II
SUMMARY OF IDS/IPS TECHNIQUES

IDS/IPS Technique Characteristics/Advantages Limitations/Challenges

Misuse detection
• Identifies intrusion by matching captured pat- • Cannot detect new or variant of known attacks.
terns with preconfigured knowledge base. • Knowledge base for matching should be
• High detection accuracy for previously known crafted carefully.
attacks. • High false alarm rate for unknown attacks.
• Low computational cost.

Anomaly detection [9]

• Uses statistical test on collected behaviour to • Lot of time required to identify attacks.
identify intrusion. • Detection accuracy is based on amount of
• Can lower the false alarm rate for unknown collected behaviour or features
attacks.

Artificial Neural Net-

work based IDS [10] • Classifies unstructured network packet effi- • It requires lot of time at training phase.
ciently. • Large number of samples required for training
• Multiple hidden layers in ANN increase effi- effectively.
ciency of classification. • Has lesser flexibility

Fuzzy Logic based IDS

• Used for quantitative features. • Detection accuracy is lower than ANN.
• Provides better flexibility to some uncertain
problems.

Association rule based

IDS • Used to detect known attack signature or rel- • It cannot be used for totally unknown attacks.
evant attacks in misuse detection. • It requires more number of database scans to
generate rules.
• Used only for misuse detection.

Support Vector Machine

based IDS • It can correctly classify intrusions, if limited • It can classify only discrete features. So, pre-
sample data are given. processing of those features is required before
• Can handle massive number of features. applying

Genetic Algorithm based

IDS [11] • It is used to select best features for detection. • It is complex a method.
• Has better efficiency. • Used in specific manner rather than general
.
Hybrid Techniques • It is an efficient approach to classify rules accu- • Computational cost is high.
rately.

TABLE III
SUMMARY OF EXISTING IDS APPROACHES IN CLOUD

Title IDS Type Technique used Positioning Pros Cons

IDS architecture for HIDS Signature based detection On each node False rate for unknown attack Requires more training
Cloud environment and Anomaly detection is lower since ANN used. time and samples for de-
using ANN. tection accuracy.
VM compatible IDS NIDS Signature based detection On each VM Secure VM based on user con- Multiple instances of IDS
architecture figuration. are required which de-
grades performance.
Cooperative agent DIDS Signature based detection On each Cloud Prevent system from single Cannot be used for all
based approach region point failure. types of attacks Computa-
tional overhead high.
Mobile agent based DIDS Anomaly detection On each VM Provides IDS for Cloud appli- Produce network load
approach cation regardless by their loca- with increase of VMs
tion. attached to MA.
DDoS attack detec- NIDS Signature based detection On each VM Secures VM from DDoS at- Can only detects known
tion in virtual ma- tacks. attacks since only snort
chine used.
NIDS in open source NIDS Signature based detection On traditional Can detect several known at- It cannot detect insider at-
Cloud Network tacks. tacks as well as known
attacks since
VMI-IDS based ar- Hypervisor Anomaly detection. On hypervisor Detect attacks on VMs. VMI Very complex method.
chitecture based IDS can be attacked.
 5

[8] L. A. Khakpour AR. (2018) First step

toward cloud-based firewalling. [Online]. Avail-
able: http://www.business.att.com/enterprise/Family/network-
security/firewall-endpoint/
[9] J. C. J. K. B. hmedPatel, Mona Taghavi. (2013) An intrusion detection
and prevention system in cloud computing : Asystemic review. [Online].
Available: http://www.elsevier.com/locate/jnca/
[10] N. Ádám; Branislav Madoš; Anton Baláž; Tomáš Pavlik.
(2017) Artificial neural network based ids. [Online]. Available:
https://ieeexplore.ieee.org/document/7880294
[11] W. Li. A genetic algorithm approach to net-
work intrusion detection. address =. [Online]. Avail-
able: https://www.giac.org/paper/gsec/3703/genetic-algorithm-approach-
network-intrusion-detection/105794
[12] U. H. R. M. Yasir Mehmood, Muhammad Awais Shibli. (2017) Intrusion
detection system in cloud computing: Challenges and opportunitiese.
[13] J. H. E. T. M. C. SJ. H. Lee, M. W. Park. (2011) Intrusion detection
system and log management in cloud computing. [Online]. Available:
http://www.ctan.org/tex-archive/macros/latex/contrib/hyperref/