1

A Trusted Computing Framework for Cloud Data

Security using Role-based Access and Pattern
Recognition
Gyanapriya Pradhan1 and Madhukrishna Priyadarsini2
1
C.V Raman Global University, Bhubaneswar, India, [email protected]
2
National Institute of Technology, Tiruchirapalli, India, [email protected]

Abstract—Due to the digitization of data and the dynamic re- sophisticated attackers, conventional security measures like
quirements of the users, cloud computing is one of the most used firewalls and encryption are no longer adequate. Although in-
technologies in the present scenario. Cloud computing provides a trusion detection systems (IDS) [13] are essential for spotting
platform to store, process, and share data remotely for heteroge-
neous users and provides services according to the requests gen- and stopping security breaches, they frequently have trouble
erated by those users. However, its rapid growth has led to one of spotting new and complicated threats. The identification and
the major challenges in the environment; the security and privacy prevention of harmful actions is one of the most important
of the data. To address the security and privacy concerns, in this security concerns in cloud computing. In addition, end-to-
paper, our major contribution is a trusted computing framework end security is an essential requirement in the cloud platform,
namely SFBRA (Secure Framework using Behavior and Role
Analysis) for cloud data security. The framework utilizes user log where the security is provided from the login of the users to the
monitoring data, pattern recognition algorithms, and role-based cloud environment to the storage [14], processing, and sharing
access mechanisms to detect malicious and suspicious activities of the data and to the signout of the users from the platform.
of different users. Our proposed framework provides two levels To safeguard sensitive data and guarantee the integrity of the
of security for cloud users. In Level-1, we calculate the trust cloud computing environment, it is essential to build strong
value of the logged-in users by analyzing the existing log table
and pattern of request access. In Level-2, we calculate the trust security perimeters in the constantly changing landscape of
of the request (storage, processing, sharing) data packet using cyber threats and the possibility of unauthorized access [15].
behavior analysis of the user and a role-based access mechanism The above-mentioned challenges need to be addressed by
and finally detect the malicious activities. The efficacy of our designing an end-to-end security framework that provides
proposed framework is demonstrated through experimentation, user authentication and authorization and data security and
where we compare our framework with existing research works.
The results show 95% accuracy in potential attack detection privacy after logging into the cloud platform. We are motivated
and prevention,approximately 8 Mbps throughput, and 0.003% by the existing challenges and the requirements to design a
packet drop on average. security framework that will be implemented in real-life cloud
Index Terms—Cloud computing, Security, Attack Detection, platforms such as Google Docs, Microsoft 365, etc where login
Behavior Analysis, Role-based Access, Pattern Recognition, Trust authentication and authorization are necessary. In addition, the
Calculation.
designed framework can be used to provide security in the
cloud storage sharing environment such as Dropbox, Google
I. I NTRODUCTION Drive, One Drive, i cloud, Egnyte, etc. where data security
In the last decade, cloud computing has grown exponen- and privacy of each logged-in user are important.
tially, due to the revolution in data digitization i.e., resource In this research, we design a trusted computing framework;
allocation, data storage, and processing, computing power uti- a Secure Framework using Behavior and Role Analysis (SF-
lization, etc.[10]. Cloud computing provides a highly flexible BRA) for end-to-end data security in the cloud environment.
and scalable platform where users can utilize the services Our framework leverages the wealth of user log monitoring
of digitization platforms as a pay-per-use model and on- data available in cloud systems, combined with advanced
demand requests. The distributed nature of cloud computing techniques such as pattern recognition and role-based access
platform makes it an easy target for attackers who exploit mechanisms, to effectively detect and differentiate malicious
the vulnerabilities by injecting multiple attacks such as denial and suspicious users, and to provide security to the cloud
of service (DoS), distributed denial of service (DDoS) [11], platform. The combination of behavior and role analysis are
IP spoofing, tampering, information disclosure, elevation of important innovations of our proposed framework. Here, we
privilege, etc. Researchers have been provided multiple so- detect abnormal behavior of malicious users that may lead
lutions to detect and prevent attack types in the cloud such to unauthorized access or suspicious intentions. Our designed
as intrusion detection systems (IDS) [12], machine learning framework’s accuracy and effectiveness are increased by the
and AI-based techniques, behavior-based detection, anomaly role-based threshold calculation module, which also enables
detection, signature-based detection, role-based access con- us to customize the detection procedure for individual users
trol (RBAC), homomorphic encryption, etc. In the face of by their unique roles and privileges. We collect and analyze
 2

process logs from both legitimate and malicious users to Deep reinforcement learning is proposed as part of a
evaluate the effectiveness of our proposed SFBRA framework. cloud IDS deployment architecture in the related study by
The results of our experiments demonstrate that our proposed Kamalakanta et al. [2]. The IDS consists of a host network,
framework successfully detects malicious activities, and dis- agent network, and administrator network. For increased se-
cards the requests or blocks the users. The effectiveness of curity, the agent network is segregated using a VPN. System
our framework is shown by comparing it with state-of-the-art calls made by VMs to the hypervisor are examined by the
security solutions in the cloud environment. IDS, which extracts useful log data for intrusion detection.
The major contributions of this paper are as follows: Utilizing system calls gives intrusion detection systems an
1) We identify multiple security attacks in the cloud plat- edge. However, relying on precise and comprehensive log
form. data may create performance, scalability, and resilience issues
2) We design a trusted computing framework namely SF- against different types of assaults in real-world cloud systems.
BRA (Secure Framework using Behavior and Role Anal- The research study by Chien et al.[3] suggests a framework
ysis) for end-to-end security in the cloud as an integration for identifying abnormal user behavior in cloud systems by
of two levels of security (Level-1 and Level-2). regularly mining patterns and applying anomaly detection
3) In Level-1, we calculate the trust of each cloud user trying methods. It used a lightweight agent to gather data about
to log in to the cloud platform using pattern recognition system operations and convert it into profiles of user behavior.
and previous log values. We set a threshold value for High detection rates, user discrimination, and real-life im-
trust. For the users whose calculated trust value is less plementation are all demonstrated by the framework. Future
than the trust threshold, the cloud provider blocks them research may concentrate on enhancing accuracy, security
for a specified time period. In this step, we identify the testing in abnormal situations, and tackling further security
malicious user and prevent them from login to the cloud challenges.
platform. In a study, M. Mdini et al. [4] proposed Watchmen
4) In Level-2, We calculate the trust and role of each Anomaly identification (WAD), a successful method for real-
logged-in user according to their request for access and time anomaly identification in network monitoring systems.
role change. Here, we again set another trust threshold. To discover anomalies and resolve resource limitations and
The packets whose trust value is less than the set trust periodic changes, WAD uses pattern recognition techniques
threshold, those packets are discarded. In this step, we and an unsupervised algorithm. Potential drawbacks include
identify the malicious data packet and discard them, so separating false positives and identifying unique abnormalities
that they can not access further mechanisms in the cloud. without prior training data. The future scope includes scaling
5) The SFBRA is evaluated through extensive experimen- and adaptation.
tation for varying attack patterns. Comparing the results To increase data security and regulate access in the cloud,
with six existing attack detection strategies demonstrates K.Sethi et al. [5] suggested an architecture that combines role-
95% accuracy in detecting attacks. SFBRA is also ac- based access control (RBAC) and homomorphic cryptography.
curate in detecting coordinated attacks from multiple The framework overcomes difficulties with computing en-
attackers in Level-2 yet maintaining the performance crypted data and makes data sharing based on user authoriza-
metrics, e.g., throughput, packet drops, and delay. tion. Role initiation, user management, data storage, and trust
The rest of the paper is organized as follows. Section II value evaluation are among the trust management components
provides a comprehensive review of related work in cloud it has. This architecture has better data protection, regulated
security using attack detection, behavior analysis, and pattern access, and multi-granular operating rights. However, there are
recognition. Section III Proposes a trusted computing frame- no thorough analyses or experimental findings in the study.
work namely SFBRA (Secure Framework using Behavior and The framework may be improved upon in the future, as well as
Role Analysis) for cloud data security highlighting the key performance testing and scalability issues in large-scale cloud
components and the functionalities. Section IV describes the settings.
experimental setup including data collection and evaluation K.Sethi et al [6], suggested a parallel homomorphic en-
metrics and comparison with existing solutions. Finally, we cryption method for safe cloud data storage. It presents a
conclude in Section V with a summary of our contributions useful approach that permits parallel calculations on encrypted
and potential future research directions. data to increase efficiency. With an improvement of 80%
over sequential techniques, the system shows promise. Future
II. R ELATED W ORKS development will focus on real-time applications and enabling
Numerous researchers have examined various classifiers floating-point maths. For the RBAC system, S. Chakraborty
and strategies in the area of intrusion detection in the cloud [7] presented a trust model that takes users’ trust into account
environment to improve accuracy and recognize both identified by giving users different trust degrees. These trust ratings are
and unidentified threats. based on a variety of variables, including user credentials, past
Servin et al. [1] presented a multi-agent reinforcement conduct, and user recommendations. The responsibilities are
learning (MARL) system and explored the difficulties of matched to trust levels. Extensions, a policy language, and
applying reinforcement learning. Decision agents (DA) and the construction of a permissions management system are all
heterogeneous sensing agents (SA) made up the Q-learning- future ambitions. The article by Fujun et al.,[8], describes the
based MARL system. Trust and Context-Based Access Control (TCAC) paradigm,
 3

which improves the conventional Role-Based Access Control

(RBAC) system by combining trust and context information.
According to contextual circumstances and trustworthiness,
users are given roles in the TCAC model, allowing them
to exercise the relevant permissions. To calculate user trust
in distributed systems, the study proposes a trust evaluation
technique using local and global reputation. However, they
do not include in-depth implementation details and empirical
validation, allowing space for future studies to assess the
effectiveness, scalability, and application of the TCAC model.
All of these trust models solely take into account user trust
in an RBAC system. The confidence that data owners have in
the RBAC system as a whole, determines the trust of the roles
in the RBAC system with whom they desire to engage, is not
addressed in any of these research works. For cloud storage
solutions to work, data owners must be trusted.
The SP-DPM model [17] stands out as a significant addition
to the field of safeguarding data generated by the Internet of
Things. By utilizing effective encryption and data partition-
ing, SP-DPM is excellent at improving security and privacy.
Because of its adaptability, it may be applied to a wide
range of industries, including cloud computing, healthcare,
businesses, and multimedia data. Notably, through extensive
experimentation and comparisons with existing models, SP-
DPM demonstrates its effectiveness with excellent outcomes
for accuracy, precision, recall, and F1-score. The model’s
strength is its strong methodology, which places a strong em-
phasis on security. Its possible shortcomings include resource
intensiveness and possible implementation problems.
The Differential and TriPhase adaptive learning-based
Privacy-Preserving Model (DT-PPM) stands out among the
models available for protecting patient privacy when it comes
Fig. 1. Workflow of the Proposed Secure Architectural Framework for Cloud
to medical data stored in the cloud. By utilizing MFNN for
analysis, k-anonymization, and noise injection through the
Laplace mechanism, DT-PPM attains a strong 87.03% accu- possible scalability issues, in addition to worries about com-
racy, guaranteeing trustworthy data analysis. Though acknowl- putation time, accuracy in specific situations, and decreased
edged for improving overall security, privacy, and usefulness, data utility[20].
its implementation difficulty and a minor decrease in the use Our proposed framework offers enhanced efficiency through
of data are points to take into account [18]. the integration of static and dynamic analysis techniques. It
The suggested MLPAM (Machine Learning and Probabilis- boasts a high accuracy rate of 92% in detecting potential
tic Analysis based Model) [19] combines machine learning attacks and malicious behavior, surpassing existing papers in
and strong encryption to improve security while pursuing safe both effectiveness and precision. Table I shows the existing
and effective data sharing in cloud environments. By providing security solutions methodologies, outcomes, and drawbacks. It
distinct keys for each data owner, MLPAM guarantees safe also lists our proposed solution, the secure framework using
sharing and outperforms previous efforts by up to 186%. behavior and role analysis (SFBRA), proposed in this paper.
Its effectiveness is highlighted by notable improvements in
Detection Accuracy, Precision, Recall, and Specificity. The fa- III. P ROPOSED S ECURE A RCHITECTURAL F RAMEWORK
vorable aspects of MLPAM position it as a major contribution FOR C LOUD
to furthering safe data management in cloud contexts, even In this section, we present our proposed secure framework
though the conclusion doesn’t specifically list any drawbacks. for end-to-end security in the cloud environment, named Se-
When it comes to differential privacy models, the Privacy- cure Framework using Behavior and Role Analysis (SFBRA).
Preserving Model based on the Differential approach (PPMD) The SFBRA framework integrates two levels of security,
performs exceptionally well since it uses many machine learn- Level-1, and Level-2, to address multiple security attacks in
ing algorithms for cloud-based classification, partitions data the cloud platform. Figure 1 shows the overall workflow of
for privacy, and introduces noise. With an accuracy rate of the proposed framework and the flow of data through different
up to 93.75%, PPMD is notable for its effectiveness and layers.
security. Nevertheless, there are several drawbacks, such as the The operational flow of SFBRA is discussed as follows: the
model’s incapacity to safeguard the classification model and users try to log in to the cloud platform by providing their user
 4

TABLE I
E XISTING R ESEARCH W ORK F EATURE A NALYSIS

Model Methodology Outcomes Drawback

MARL for intrusion de- - Agents learn hierarchy, interpreting - Scales effectively for a large number -Relies on a simple RL strategy with
tection [1] local states and communicating up- of agents. a straightforward Q-update function.
ward - Enables collaboration among diverse - Limited exploration of more com-
- Utilizes distributed RL for cooper- agents for detecting DDoS attacks. plex RL techniques for enhanced per-
ative detection of faults, attacks, and formance
abnormal states.
Deep reinforcement - Utilizes Deep Reinforcement Learn- - Demonstrates higher accuracy in in- - Computational cost challenges.
learning-based adaptive ing (DRL) with Q-learning and deep trusion detection - Limited exploration of DRL in the
cloud IDS architecture. learning for autonomous and adaptive - Maintains a balance between high context of cloud network security.
[2] intrusion detection. accuracy and low false positive rates
(FPR)
FP Outlier Detection [3] - Scanning the memory of running Framework detects all malicious ac- -System in early development, indi-
virtual machines and employing a tivities with ¡ 4.6% false positives. cating potential limitations.
Bayesian inference-based trust mech- - Profiles identify 86% suspicious be- - Long-term datasets needed to ad-
anism along with a frequent pattern haviors across users with ¡ 1% false dress issues like ”concept drift” in
outlier factor. positives. user behaviors.

Watchmen Anomaly De- - WAD processes data in real-time, - Enhances productivity and trou- - Faces issues with tolerance band and
tection (WAD) [4] highlighting abrupt changes. bleshooting efficiency. parameter configuration.
- Creates reference patterns, and de- - Provides instant alerts, reducing - Requires improvements for auto-
tects anomalies by measuring gaps. manual checks matic parameter computation
RBAC with Homomor- - Integration of RBAC and Homo- - Enhances security by enabling en- - Potential increased computational
phic Cryptosystem Inte- morphic Cryptosystem using trust and crypted data computations without complexity (not explicitly stated).
gration [5] role hierarchy. decryption. - Effectiveness depends on accurate
- Trust value calculated based on user - Provides fine-grained access control trust value calculations, which may
count and feedback for role-based ac- through role-based permissions. vary.
cess.
Homomorphic cryptosys- - Design of parallel algorithms for - Over 80% improvement in execution - The current system handles only
tem for secure cloud data encrypted file operations with multi- time for parallel implementations. integer representation, not floating-
storage [6] threading and ”cipher-text refresh” at - Provides practical, secure data stor- point arithmetic.
KGS. age without compromising data secu- - Future work is needed for function-
rity. level encryption to enhance security.
TrustBAC [7] - Extends RBAC by introducing trust - Integrates RBAC advantages with a - Possible need for additional
levels based on user factors. multi-level trust model. credential-based evaluations.
- Users assigned trust levels determine - Enhances access control by consid- - Acknowledges ongoing work,
access privileges. ering user behavior and recommenda- indicating potential limitations.
tions.
TCAC (Trust and Context- - Role assignment based on user trust- - Flexible and scalable for dynamic - Approaches do not consider geo-
Based Access Control) [8] worthiness and context information. distributed systems. social information.
- Trust evaluation using local and - Dynamic role assignment based on
global reputation. user behavior and context.
Secure Data Protection - Uses K-anonymization, CP-ABE, - SP-DPM secures IoT data with - SP-DPM may introduce complex-
Method (SP-DPM) [17] and a voting classifier for enhanced strong partitioning and encryption ities, particularly with intricate data
IoT data security and privacy. - Suited for diverse do- structures or diverse applications.
- Proposes data partitioning, analysis, mains—healthcare, enterprises, - Security measures might demand
and experiments, comparing results cloud computing, multimedia. extra resources, potentially impacting
with state-of-the-art models. system performance
Differential and TriPhase - Employs k-anonymization for pri- - High accuracy of 87.03% ensures - Implementation complexity may
adaptive learning-based vacy by grouping sensitive data. reliable data analysis. pose challenges
Privacy-Preserving Model - Introduces noise via the Laplace - Enhances overall privacy, security, - Noise injection could lead to a slight
(DT-PPM) [18] mechanism and utilizes MFNN for and utility of medical data sharing and reduction in data utility
effective data analysis. analysis in cloud environments.
Machine Learning and - Individualized encryption keys for - Significant improvement, up to - No explicit mention of identified
Probabilistic Analysis secure data sharing. 186%, over existing works cons or limitations in the provided
based Model (MLPAM) - Integration of machine learning and - Achieved notable enhancements in information.
[19] probabilistic analysis for enhanced Detection Accuracy, Precision, Re- - Further details on potential draw-
security infrastructure and effective call, and Specificity compared to prior backs or challenges are not specified
sharing protocols. works. in the given context.
A differential privacy - PPMD ensures privacy through data - PPMD achieves up to 93.75% accu- - It does not protect the classification
model for sensitive data partitioning, injecting statistical noise racy, excelling in both accuracy and model and scalability challenges
(PPMD) [20] into sensitive sections. privacy preservation compared to ex- - High computation time, low accu-
- The model integrates differential pri- isting methods. racy, and reduced data utility.
vacy and deploys machine learning - Highlight efficiency, security, and
for cloud-based classification. optimality, making it superior for
cloud-based data sharing
SFBRA (This Paper) - Level-1: Trust calculation using - Dual-layered security with static and -Dependency on user log data for
pattern recognition and log values, dynamic analysis. behavior analysis.
blocking users below the threshold. - High accuracy in attack detection - Future testing is needed for coordi-
- Level-2: Trust and role calculation and efficient data processing. nated attacks.
based on access requests, discarding
packets below the threshold.
 5

TABLE II
N OTATIONS USED IN THE PROPOSED SFBRA F RAMEWORK

Notation Description
S Sequence of user behavior
Bi Behavior of each sequence Si
N Number of cloud users
B Behavior set of N cloud users
BM Behavior matrix
θ1 Trust value for static analysis Fig. 2. Log File Creation and Storage in Central Log Server for Cloud Users
θ2 Trust value for dynamic analysis
θ Overall trust value
AR Access request
PR Process request
NV D National vulnerability database
TS Time stamp
VS Vulnerability Score
M Magnitude of each role
W1 , W 2 , W 3 Weight parameters

Fig. 3. Behavioural Pattern Matching

ID and password. The server first checks the trustworthiness of
the user using behavior analysis methodology and calculates
the trust of the user, where it considers the log monitor data cloud user attempting to log in to the cloud platform. The
of the same user in Level-1. Once the user is termed as analysis is carried out in two essential steps: Static Analysis
trusted then, the server allows the user to send its request and Dynamic Analysis.
packet to the cloud for accessing the storage or processing 1) Static Analysis: In the Static Analysis phase, we detect
of data. Otherwise, the server suspends the user login for a and analyze the timestamps of user activities using a log
particular period. Here, we consider only two request packets monitor. By examining the user’s historical behavior, including
by the user i.e., storage request and processing request. Once login patterns and various activities, we aim to identify any
the user sends its request packet, the cloud again calculates suspicious patterns or anomalies. This step allows us to gain
the trustworthiness of the sent packet request using another insights into the user’s past actions, helping us assess their
module trust and role calculation before processing it. This overall trustworthiness. We can detect whether the user has
module takes the input as the log monitor data for the same previously engaged in any suspicious activities or exhibited
user inside the cloud. In the next step, the role of the user is unusual behavior during login sessions. The static analysis is
calculated, and if the role is trusted, then the cloud grants carried out using two steps as follows;
access to the same user otherwise the request packet is Step 1: Log File Creation and Storage in Central Log
discarded. Server for Cloud Users In the first step, we are converting
The trustworthiness is calculated in the two levels because unstructured log data into a well-organized format, because,
malicious users can try to access the cloud using the legitimate raw log files are not arranged in order fashion and parsing
user’s login ID and password. In the Level-1 security which is required before they can be utilized effectively. Here, we
is checked inside the cloud server, the framework calculates choose the XML format for log file structuring. We extract
the trust of users by analyzing their historical behavior and vital details from the raw log data, such as; event name, event
real-time factors such as access requests, process requests, ID, associated process or thread ID, opcode, and timestamp.
IP address, and vulnerability score. This evaluation helps in Let XM Lm m
i is the XML format with behaviors defined as Bi
identifying suspicious patterns and determining the trustwor- = {Si,1 , Si,2 , ...Si,m } where Si,t (1 < t < m) is one behavior
thiness of users. Level-2 security in the cloud focuses on entry, and S is the sequence of behavior.
calculating the trust and role of logged-in users, considering Step 2: Behavioural Pattern Matching In this Step, we do
elements such as user identification, password, timestamp, behavior matching and review the findings from the log files
access requests, process requests, IP address, and vulnerability to produce a structured file for more operation on the user
score. By integrating static and dynamic analysis techniques information. We can identify significant patterns and trends
and considering various factors, the SFBRA framework pro- in the log data. We separate particular behavioral aspects
vides a robust approach to evaluating user trust, preventing and characteristics using behavior extraction techniques, which
unauthorized access, and analyzing role behavior, ultimately helps to gain a better knowledge of how the system functions
enhancing the overall security of cloud platforms. and interacts. The next step is behavior matching, where
The next subsections describe Level-1 and Level-2 security we contrast the discovered behavioral patterns with estab-
frameworks in detail. The details of the parameters used in lished standards/patterns. This process enables us to effectively
Level-1 and Level-2 are summarized in Table II. identify abnormalities, possible risks, or anomalous system
activity.
A. Level-1 Security: Trust Calculation and User Blocking The methodical process of behavior pattern matching, be-
In Level-1 of our security framework, our focus is on havior extraction, and behavior matching provides a thorough
behavior analysis to determine the trustworthiness of each examination of log data, producing insightful information
 6

user’s trustworthiness at that moment. During the training

of the neural network, it takes the input pattern from the
behavior matrix BM defined in the previous step and defines
corresponding class labels, which are used to train the neural
Fig. 4. Process of Behaviour Extraction network. Then, it adjusts the weights (W 1, W 2, W 3) and
biases through backpropagation to minimize the difference
between its predictions and the actual labels. The output of the
and trustworthy results. These findings provide insight into FFBPNN typically has the class of labels in the recognition
the system’s operation and possible weak points, and they task. The final testing is done when the input contains a new
considerably improve the overall security and dependability of pattern. Let θ2 be the trust value in the dynamic analysis
the system. Our research study seeks to significantly influence process and is calculated as
the fields of system analysis and cybersecurity through the use n
of a strict methodology.
X
θ2 = W1 ∗ ARi + W2 ∗ P Ri + W3 ∗ N V Di (2)
The behavior extraction from structured data is done through i=1
the following procedures; we embark on further refining
3) Overall Trust Value Calculation: The overall trust value
the structured data by undertaking sequence ID extraction
for the user in Level-1 is calculated by combining the trust
and subsequent encoding. This crucial stage allows us to
values of both static analysis and dynamic analysis and is
construct a comprehensive behavior matrix, which serves as
denoted as:
the foundation for behavior extraction. Through a meticulous
θ = θ1 + θ2 (3)
and systematic approach, we extract relevant sequence IDs
from the structured data, enabling us to encode and represent 4) User Validation and Access Control: Here, we compare
the intricate relationships among various events and activities. the calculated overall trust value with a predefined trust value,
By employing advanced encoding techniques, we transform typically assumed to be 0.5. If the calculated trust value
the sequence IDs into a coherent and analyzable behavior exceeds the predefined threshold, the user is allowed further
matrix. This matrix captures the underlying patterns and inter- access to the cloud environment. In this case, the user is
actions within the system, providing valuable insights into the considered trustworthy enough to utilize the cloud resources
system’s behavior and performance. The behavior extraction without restrictions.
process in this step plays a pivotal role in our research, as However, if the calculated trust value is less than the
it facilitates a deeper understanding of the system’s dynamics predefined threshold, it indicates potential malicious behavior
and aids in identifying potential anomalies or irregularities that or insufficient trustworthiness. Consequently, the system will
may impact its overall functioning. Figure 2, 3, 4 show the block the user from accessing the cloud platform or discard
steps and methods used in the behavior extraction process. their login request, effectively preventing unauthorized access
Let B =B1 , B2 ...., Bn be the set that contains behavior of and maintaining the security of the cloud environment.
N cloud users. When the behavior entry Si,t matches the
behavior Bj (j ∈ (1, N )), the entry in the behavior matrix
will be Si,t = [e1i,t , e2i,t ,....,eN j B. Level-2 Security: Trust and Role Calculation
i,t ], where ei,t will be set as 1 and
others are set as 0. Finally, the
 generated behavior matrix is In the Level-2 security of our proposed framework SFBRA,
Si,1  1 we focus on calculating the trust and role of each logged-
ei,1 . . . eN

 Si,2  i,1
.. in user based on their access requests and role changes.
represented as BMi =  .  =  . This matrix
   
 ..  . This level provides an additional layer of security to prevent
1 N malicious data packets from accessing further mechanisms in
ei,m . . . ei,m
Si,m
the cloud. The details regarding the trust and role calculation
is the behavior matrix of a cloud user i. Let θ1 be the trust
are presented in the following subsections.
value in static analysis which is calculated as
1) Trust Calculation: The trust calculation in Level-2
no.of 1inBMi incorporates various elements, including user identification
θ1 = (1)
totalentriesinBMi (ID), password, timestamp, access request, process request,
2) Dynamic Analysis: The Dynamic Analysis phase in- IP address, and vulnerability score (NVD score). To ensure
volves pattern detection using specific neural network-based an accurate assessment of trust, we employ two calculation
algorithms such as the Feed-Forward Backpropagation neural methods as follows:
network (FFBPNN). Here, we consider various factors, in- 1) Vulnerability Calculation: To assess the vulnerability
cluding the user’s access request, process request, IP address, of a packet, we introduce the vulnerability calculation,
and vulnerability score (NVD score). Each of these factors which considers the product of the timestamp and the
contributes to calculating a dynamic trust value for the user. vulnerability score (NVD score). The National Vulnera-
To calculate the dynamic trust value, we assign appropriate bility Database [16] is a repository of information about
weights (W 1, W 2, W 3) to the factors, based on their sig- software vulnerabilities maintained by NIST. It provides
nificance in determining user trust. The Feed-Forward Back- details on vulnerabilities, severity ratings, and references
propagation neural network (FFBPNN) algorithm processes to patches and advisories. It helps organizations and
the relevant data to derive a numerical value representing the individuals stay informed about vulnerabilities and take
 7

TABLE III modified, allowing the system to identify potential anomalies

NATIONAL V ULNERABILITY DATABASE (NVD ) S CORE or suspicious activities. Magnitude assesses the impact of
NVD Score Protocol role changes by considering factors such as the level of
7.8 TCP access granted or revoked. It quantifies the significance of
5.0 UDP each role change in terms of its effect on the overall system
9.8 DNS
security. The timestamp parameter denotes the time at which
5.8 ICMP
10.0 ARP the role calculation is performed. It enables the system to track
7.5 IGMP and analyze the changes in roles over time, facilitating the
8.6 IPv4 identification of patterns or trends in role behavior. The role
5.0 IPv6
indicates the current role of the user, providing the baseline
value for the role calculation. By integrating these elements,
necessary actions to secure their systems. Mathematically, the role calculation formula evaluates the behavior of users
this can be expressed as: concerning role changes and their influence on the system’s
n
X security. The overall SFBRA framework solution is shown in
V C(t) = T Si (t) ∗ V Si (t) (4) Algorithm 1. In Algorithm 1, step-5 to step-9 can be performed
i=1 in O(n) time, and step-15 to step-31 can be performed in
Here, T Si is the time stamp of the packet i at time t O(n) time. So, the time complexity of the proposed algorithm
and V Si is the vulnerability score of the packet i at is O(n). The space complexity is O(n) as step-5 and step-6
time t. This equation quantifies the vulnerability of a take O(n) space to generate and store the behavioral matrix
packet based on the combination of its arrival time and BMi .
the severity of potential security risks indicated by the
vulnerability score. Table III shows the vulnerability score
of various protocols. Algorithm 1 SFBRA Security Solution
2) Exposure Calculation: To determine the exposure level 1: procedure LEVEL 1(AR, P R, N V D)
of a packet, we utilize the exposure calculation method. 2: T = 0, i = 1
The exposure calculation shown in equation 5 takes into 3: XM L= GenerateStructuredLogData()
account the sum of the access request, process request, 4: do
and the timestamp. The packet request is dropped if the 5: Generate BMi
resulting value is less than the predetermined threshold. 6: θ1 = div(no.of 1’s in BMi , total entries in BMi )
The exposure calculation can be represented as: 7: θ2 = sum( AR, P R, N V D)
Pn 8: θ = θ1 +θ2
ARi (t) ∗ P Ri (t) ∗ T Si (t) 9: i=i+1
EC(t) = i=1 Pn (5)
i=1 T Si 10: while ((T ̸= Tmax )&& (i ̸= n))
11: end procedure
Here, ARi (t) is the access request by packet i at time t,
12: procedure LEVEL 2(T S, V S, AR, P R, W , M , n)
P Ri is the process request by packet i at time t, and T Si
13: T = 0, i = 1
is the timestamp of packet i at time t. By incorporating
14: do
the timestamp and assessing the proportion of access and
15: TrustCalculation()
process requests, this equation provides an estimation of
16: Find(V C)
the exposure level of a packet. It enables the system
17: V C= multiply(T S, V S)
to deny further processing if the exposure surpasses the
18: Find(EC)
defined threshold.
19: EC1 = multiply(AR, P R, T S)
2) Role Calculation (Role Identified Behavior Analysis): 20: EC= divide(EC1 , T S)
The role calculation mechanism focuses on determining the 21: Trust= add(EC, V C)
total number of role requests and analyzing the changes in 22: if (Trust > Θ) then
roles over time. In this calculation, we consider three crucial 23: Goto RoleCalculation
elements: weight, frequency, and magnitude. The role of each 24: else
logged-in user is calculated as follows: 25: Goto end procedure
Pn Pn 26: end if
i=1 (Wi ∗ Mi ) ∗ i=1 T Si
Ri = (6) 27: RoleCalculation()
Role
28: R1 = multiply(W , M , T S)
Here, Wi is the weight of each role, Mi is the magnitude 29: R= divide(R1 , Role)
of each role, and T Si is the time stamp for role i. The weight 30: i=i+1
represents the weightage assigned to each role, indicating its 31: while ((T ̸= Tmax )&& (i ̸= n))
importance or level of access. This weightage is a constant 32: end procedure
value associated with each role. Frequency measures the
number of role changes for a particular user within a specific
period. It tracks the frequency with which a user’s role is
 8

C. Security Analysis of Proposed SFBRA Framework data d and S(d) is 1, then C(u, d) = 0.
In this section, we analyze our proposed SFBRA frame- R(u) is not authorized for data d ∧ S(d) is 1 =>
work’s correctness using logic. The security property we C(u, d) = 0.
want to prove is that the proposed framework ensures the
privacy/confidentiality of sensitive data which is presented as D. Working of Proposed SFBRA Framework with an Example
follows:
Here, we demonstrate our proposed SFBRA framework’s
1) Proposed SFBRA Framework: The framework ensures
operation considering the two-level security. Two example use
the confidentiality/privacy of sensitive user data in the
cases are explained for legitimate and malicious users’ overall
cloud environment. The proposed framework relies on a
trust calculation.
dynamic access control algorithm that considers factors
Example 1: Legitimate user trust calculation When a
such as user roles, behavior patterns, and the log data of
legitimate user logs in to the cloud, at the Level-1 security its
the logged-in user.
behavior is analyzed to check the trustworthiness. Using the
2) Security Property: Confidentiality/Privacy - Ensuring that
static analysis phase the unstructured log data is converted into
unauthorized users cannot access sensitive user data in the
organized XML format with event name, event ID, process
cloud.
ID, Opcode, and timestamp information of the user. Let
3) Assumptions: 1. The proposed security solution algorithm
XM Lm i is the XML format with behaviors defined as Bi
m
is correctly implemented and cannot be tampered with.
= {Si,1 , Si,2 , ...Si,m } where Si,t (1 < t < m) is one behavior
2. User roles and behavior patterns are accurately repre-
entry, and S is the sequence of behavior. The behavior matrix
sented in the system.
is calculated as
4) Formalization: Let C(u, d) represent the confidentiality
level assigned to user u for data d. Let R(u) represent no.of 1inBMi 2
θ1 = = = 0.4 (7)
the role of user u. Let B(u) represents the behavior totalentriesinBMi 5
pattern of user u. Let S(d) represent the sensitivity The dynamic analysis phase involves pattern detection us-
classification of data d.The access decision can be ing specific machine-learning algorithms. Here, we consider
formalized as follows: various factors, including the user’s access request, process
( request, IP address, and vulnerability score (NVD Score).
1; access authozied To calculate the dynamic trust value, we assign appropriate
0; Otherwise weights (w1, w2, w3) to the factors. The weight values are
5) Logical Reasoning and Formal Proofs: experimental and chosen according to the priority of the
factors.
a) Role Based Access: Each user u is accessing a partic-
n
ular role at a certain timestamp T S and is calculated X
θ2 = W1 ∗ ARi + W2 ∗ P Ri + W3 ∗ N V Di
as R(u) using equation 6. So, ui => (R(u)i , T Si ). (8)
i=1
If other users try to access the authenticated data d
= 2 ∗ 2 + 3 ∗ 5 + 4 ∗ 7.0 = 47
then the timestamp T S, magnitude M , and the weight
W are modified and it will notify user u regarding its The overall trust value is calculated as
change in role. For all user u and data d if R(u) is
authorized for d => C(u, d) = 1. θ = θ1 + θ2 = 47 + 0.4 = 47.4 (9)
b) Behavior Pattern: If there is any adversarial attack For user validation, here we compare the calculated overall
on the authenticated user data then the entries in the trust value with a predefined trust value of 0.5 (assumed
behavior matrix BM will be changed and so will considering various experimental results), If the calculated
the static trust value θ1 . Simultaneously, it affects the trust value is more, then the user is allowed for Level-2
weights (W1 , W2 , W3 ) of the feed-forward backprop- security, otherwise blocked.
agation neural network (FFBPNN) and the dynamic Once the user has been entered into the Level-2 security
trust value θ2 . So, the overall trust value θ will be layer, the framework calculates the trust and role of each
different for user ui in a certain timestamp T Si , which logged-in user based on their access request and role changes.
is not valid, and the system detects the adversarial The vulnerability values are calculated as:
attack on the sensitive data.
n
For all user u and data d if B(u) deviates significantly X
V C(t) = T Si (t) ∗ V Si (t) = 253 ∗ 10 = 2530 (10)
from the usual pattern, then C(u, d) is adjusted.
i=1
Deviation in B(u) => Adjustment in C(u, d)
c) Sensitivity Classification: If there is no change in the To determine the exposure level of a packet, we utilize
overall trust value θ or user ui in a certain timestamp the exposure calculation. If the resulting value exceeds the
T Si , then the access decision will be 1, which demon- predetermined threshold, the packet request is dropped.
strates the access authorization mentioned in step-4, Pn
otherwise it is classified as 0 and the user request is i=1 ARi (t) ∗ P Ri (t) ∗ T Si (t) 2 ∗ 3 ∗ 10
blocked. EC(t) = Pn = =3
i=1 T Si 20
For all user u and data d, if R(u) is not authorized for (11)
 9

Fig. 6. Attack packet detection comparison of proposed SFBRA framework

Fig. 5. Identification of similar and dissimilar patterns using the mentioned
with state-of-the-art research proposals
behavioral pattern matching method in Level-1 security

speed. The computing machine runs Ubuntu 64-bit and has

Next for role calculation, we consider three crucial ele-
8 GB of main memory RAM. Python 2.7.15 programming
ments: weight, frequency, and magnitude. The role of each
language is used. We compare the performance of SFBRA
logged-in user is calculated as follows:
with four state-of-the-art research papers Chakraborty, S. et
Pn Pn al. [7], Feng, F. et al. [8], Ma, W et al. [9], A. Servin et al.
i=1 (Wi ∗ Mi ) ∗ i=1 (5 ∗ 2) ∗ 414
T Si [1], considering multiple network parameters such as attack
Ri = = = 1035
Role 4 detection, throughput, and packet drop. The experiments were
(12)
The calculated trust is more than the predefined threshold conducted using various datasets and metrics to assess the
value and the role value is more, so the cloud provides access effectiveness and accuracy of our framework. The results are
to the legitimate user. taken from the continuous simulation run over 10 minutes.
Example 2: Malicious user trust calculation When a
malicious user logs into the cloud, Level-1 security fo- A. Attack Detection
cuses on behavior analysis to check the trustworthiness. Let We used a synthetic data set of 15000 user logins and ran
XM Lm i is the XML format with behaviors defined as Bi =
m
studies to assess the effectiveness of SFBRA in attack de-
{Si,1 , Si,2 , ...Si,m } where Si,t (1 < t < m) is one behavior tection. The dataset comprised several attack types, including
entry, and S is the sequence of behavior. The behavior matrix denial of service (DoS), distributed denial of service (DDoS),
is calculated as IP spoofing, data manipulation, and information leaking. We
no.of 1inBMi 2 contrasted SFBRA’s performance with the four state-of-the-art
θ1 = = = 0.05 (13) research papers Chakraborty, S. et al. [7], Feng, F et al. [8],
totalentriesinBMi 40
Ma, W et al. [9], A. Servin et al. [1] each of which used a
In dynamic analysis, the pattern is detected using specific
different strategy for attack detection.
machine-learning algorithms. The dynamic value is calculated
The result analysis of attack detection is shown in Figure
as:
6. In comparison to the other frameworks, the SFBRA has
n
X a reduced failure rate and bypass rate. A larger percentage
θ2 = W1 ∗ ARi + W2 ∗ P Ri + W3 ∗ N V Di
(14) of possible threats were successfully identified and stopped,
i=1
hence boosting the cloud platform’s security. In particular, our
= 0.02 ∗ 2 + 0.03 ∗ 3 + 0.04 ∗ 5.0 = 0.33
approach outperformed the other frameworks when it came to
The overall trust value is calculated as: identifying possible assaults, achieving an astounding accuracy
of 95%.
θ = θ1 + θ2 = 0.05 + 0.33 = 0.38 (15)
The integrated strategy used by SFBRA, which combines
For user validation, here we compare the calculated overall behavior analysis, role-based access control, and pattern recog-
trust value with a predefined trust value of 0.5. The calculated nition algorithm- Feed-Forward Backpropagation neural net-
trust value determines that this user is not a legitimate user, work (FFBPNN), is responsible for its exceptional perfor-
terminates all the access requests, and blocks the user for mance in attack detection. A higher degree of security for
further execution. cloud platforms is provided by SFBRA, which efficiently
detects aberrant activity and identifies malicious users by
IV. E XPERIMENTAL R ESULTS AND E VALUATION taking into account user log monitoring data and examining
In this section, we present the experimental results and eval- user behavior.
uation of our proposed framework, SFBRA (Secure Frame-
work using Behavior and Role Analysis), for cloud data secu- B. Throughput
rity. The experiments are performed on a machine equipped We have done one experiment on a user login database of
with Intel (R) Core (TM) i5-4210U CPU @ 1.70GHz clock 15000 users to gauge the performance of our framework. The
 10

In terms of attack detection, throughput, and packet loss,

the test findings generally confirm the usefulness and superi-
ority of our suggested framework, SFBRA. The comparisons
with the chosen research works reveal SFBRA’s exceptional
performance, showing more accuracy, increased system perfor-
mance, and improved data security. These findings highlight
the usefulness of SFBRA in securing cloud data and preserving
the reliability of cloud platforms, confirming its potential for
use in real-time applications.

V. C ONCLUSION
The proposed Secure Framework using Behavior and Role
Analysis (SFBRA) is a thorough and cutting-edge solution
Fig. 7. Throughput and packet drop comparison of proposed SFBRA
framework with state-of-the-art research proposals to the immediate security issues in cloud computing. SFBRA
offers a comprehensive solution for protecting cloud platforms
from potential threats by seamlessly integrating static and
system’s performance was tested in the trials under numerous dynamic analysis methodologies, behavior monitoring, role-
circumstances, including diverse protocols and vulnerability based access control, and advanced pattern recognition algo-
levels. The pace at which the system processes data packets rithms. The dual-layered design of SFBRA, which includes
is known as throughput, and it reflects the effectiveness and Level-1 and Level-2 security measures, demonstrates its flex-
performance of the cloud platform. A remarkable throughput ibility and efficiency in a range of security circumstances.
accuracy of 92% was attained (approx. 8 Mbps) by SFBRA, The empirical analyses conducted in this study demonstrate
according to the testing findings, demonstrating effective data the efficacy of SFBRA over existing approaches, highlighting
processing and system performance. We contrasted SFBRA’s its exceptional accuracy in attack detection, effective data
throughput with that of the four state-of-the-art research works processing throughput, and low packet drop rates. SFBRA
we chose, where each used a distinct set of data-processing ultimately offers itself as a crucial asset in the ongoing growth
methods and algorithms. The throughput comparison results of of cloud security due to its capacity to simultaneously secure
our proposed SFBRA framework with state-of-the-art research data integrity and user privacy while retaining operational
proposals are shown in Figure 7. efficiency. The proposed SFBRA framework can reinvent the
Due to its streamlined processing processes, effective role- rules of data protection and safe cloud-based operations in the
based access control, and use of pattern recognition algo- future as the use of cloud platforms continues to influence
rithms, SFBRA has good throughput performance. The SF- current data management.
BRA guarantees seamless and fast data processing, resulting One of the limitations of the proposed framework is that
in increased system performance and user experience by it depends on user log data for behavior analysis. Due to
precisely analyzing user requests and behavior. unavoidable circumstances such as log maintenance failure if
the data is not available then it won’t be able to calculate the
C. Packet Drop trust value of the user. In the future, we would like to eliminate
the limitation mentioned above and test coordinated attacks on
We have compared the effectiveness of our frame-
our proposed framework to check its efficacy.
work, SFBRA, with the four state-of-the-art research papers
Chakraborty, S. et al. [7], Feng, F et al. [8], Ma, W et al. [9],
A. Servin et al. [1] for packet drop. The percentage of data R EFERENCES
packets deleted or rejected by the system during processing is [1] A. Servin and D. Kudenko, ”Multi-agent Reinforcement Learning for
referred to as packet drop. Reduced packet drops mean more Intrusion Detection,” Proceedings of the 5th, 6th and 7th European
Conference on Adaptive and Learning Agents and Multi-agent Systems:
dependable and effective data processing, reducing data loss, Adaptation and Multiagent Learning, 2008.
and maintaining smooth communication on the cloud platform. [2] Kamalakanta et al., ”Deep Reinforcement Learning based Intrusion De-
According to the results of our experiments shown in Figure tection System for Cloud Infrastructure.” 12th International Conference on
Communication Systems & Networks (COMSNETS), 2020.
7, SFBRA has a lower packet loss (0.003% on average) rate [3] Chien-Yi Chiu, Chi-Tien Yeh, and Yuh-Jye Lee. ”Frequent Pattern-based
than the other frameworks (approximately 10%). This shows User Behavior Anomaly Detection for Cloud System.” Conference on
that a larger proportion of data packets were correctly handled Technologies and Applications of Artificial Intelligence, 2013.
[4] M. Mdini, A. Blanc, G. Simon, J. Barotin, and J. Lecoeuvre, ”Moni-
by our system, guaranteeing dependable communication and toring the Network Monitoring System: Anomaly Detection using Pattern
reducing data loss. Recognition,” Proceedings of the International Conference on Network and
The strong data processing methods, effective role-based Service Management (CNSM), 2017.
[5] Sethi, K., Chopra, A., Bera, P., & Tripathy, B. K., ”Integration of Role
access control, and precise pattern recognition are responsible Based Access Control with Homomorphic Cryptosystem for Secure and
for SFBRA’s remarkable performance in minimizing packet Controlled Access of Data in Cloud”, In Proceedings of Security of
loss. To guarantee reliable data transmission, avoid excessive Information and Networks, 2017.
[6] Sethi, K., Majumdar, A., & Bera, P., ”A Novel Implementation of Parallel
packet dropouts, and enhance system performance, SFBRA Homomorphic Encryption for Secure Data Storage in Cloud”, International
manages and prioritizes data packets properly. Conference on Cyber Security and protection of Digital Services, 2017.
 11

[7] Chakraborty, S., & Ray, I., ”TrustBAC - Integrating Trust Relationships
into the RBAC Model for Access Control in Open Systems”, In Proceed-
ings of the ACM Symposium on Access Control Models and Technologies,
2008.
[8] Feng, F., Lin, C., Peng, D., & Li, J., ”A Trust and Context-Based
Access Control Model for Distributed Systems”, 10th IEEE International
Conference on High-Performance Computing and Communications, 2019.
[9] Ma, W., Zhou, Q., Hu, M., and Wang, X. ”A Deep Learning-Based
Trust Assessment Method for Cloud Users”, Security and Communication
Networks, 2021.
[10] Teni, C., Nawale, A., ”A Comprehensive Review on Cloud Computing
Security”. Vidhyayana - An International Multidisciplinary Peer-Reviewed
E-Journal, 2023.
[11] Tian, Y., & Romero Nogales, A. F., ”A Survey on Data Integrity Attacks
and DDoS Attacks in Cloud Computing”. IEEE 13th Annual Computing
and Communication Workshop and Conference (CCWC), 2023.
[12] Butt, U. A., Amin, R., Mehmood, M., Aldabbas, H., Alharbi, M. T., &
Albaqami, N., ”Cloud Security Threats and Solutions: A Survey”, Wireless
Personal Communications, 2023.
[13] Attou, H., Guezzaz, A., Benkirane, S., Azrour, M., & Farhaoui, Y.,
”Cloud-Based Intrusion Detection Approach Using Machine Learning
Techniques”, Big Data Mining and Analytics, 2023.
[14] Akbar, H., Zubair, M., and Malik, M. S., ”The Security Issues and
Challenges in Cloud Computing”, International Journal for Electronic
Crime Investigation, 2023.
[15] Kumar, U. V., and Reddy, E. M., ”Preventing Unauthorized
Users from Accessing Cloud Data”, Available online at:
https://ssrn.com/abstract=4448543, 2023.
[16] National Vulnerability Database (NVD). Available on:
https://nvd.nist.gov/vuln/search. Accessed on June 2023.
[17] Gupta, R., Gupta, I., Singh, A.K., Saxena, D. and Lee, C.N., 2022. An
iot-centric data protection method for preserving security and privacy in
cloud. IEEE Systems Journal.
[18] Gupta, R., Saxena, D., Gupta, I. and Singh, A.K., 2022. Differential
and triphase adaptive learning-based privacy-preserving model for medical
data in cloud environment. IEEE Networking Letters, 4(4), pp.217-221.
[19] Gupta, I., Gupta, R., Singh, A.K. and Buyya, R., 2020. MLPAM: A
machine learning and probabilistic analysis based model for preserving
security and privacy in cloud environment. IEEE Systems Journal, 15(3),
pp.4248-4259.
[20] Singh, A.K. and Gupta, R., 2022. A privacy-preserving model based on
differential approach for sensitive data in cloud environment. Multimedia
Tools and Applications, 81(23), pp.33127-33150.