Int J Syst Assur Eng Manag

https://doi.org/10.1007/s13198-025-02705-8

ORIGINAL ARTICLE

Cloud computing security assurance modelling through risk

analysis using machine learning
Abhishek Sharma1 · Umesh Kumar Singh2

Received: 31 December 2021 / Revised: 16 February 2023 / Accepted: 31 December 2024

© The Author(s) under exclusive licence to The Society for Reliability Engineering, Quality and Operations Management (SREQOM), India and
The Division of Operation and Maintenance, Lulea University of Technology, Sweden 2025

Abstract The concept of Cloud Computing has exploded help the network security administrator to mitigate the real
in popularity, and the reason for this is the cost-effective time attacks under cloud computing environments.
transmission, storage, and powerful computation it offers.
The objective is to provide end-users with remote stor- Keywords Cloud computing (CC) · Cloud attacks ·
age and data analysis capabilities using shared computing Cloud security · Machine learning · Intrusion detection
resources, lowering an individual’s total cost. Consumers, system (IDS) · Cyber attacks · Cloud security assurance
on the other hand, are still hesitant to use this technology
due to security and privacy concerns. In this work a thor-
ough overview of the various Cloud attacks and security 1 Introduction
challenges is presented and security assurance modelling
is done through risk analysis using machine learning. In One of the primary motivations for cloud computing is
order to analyze the security risk in terms of threats and the usage of current-generation Internet-based technology.
attacks for cloud computing environments, the most recent Cloud computing, according to the National Institute of
dataset (ISOT Cloud Intrusion Dataset) is used for intrusion Standards and Technology (NIST) (Mell & Grance 2011),
detection under cloud computing environments. The meth- provides on-demand, convenient, ubiquitous, and reliable
odology involves the implementation of multiple supervised network access to large configured shareable computing
machine learning algorithms like support vector machine resources that can be easily managed and utilized with
(SVM), random forest (RF), logistic regression (LR), Naïve minimal effort and interaction with cloud service providers
Bayes (NB), Artificial Neural Network (ANN), K-nearest (Nister & Stewenius 2006). It’s a cutting-edge information
Neighbor (kNN) to identify & classify intrusions for cloud system technique that provides dynamically shared resources
environment. As a result, accuracy of the proposed SVM through the Internet while also generating revenue (Kim
model is evaluated as 99.2%. The performance metrics of 2013).
various machine learning implementation models are also Cloud computing is inspired by the Pay As You Go
compared & investigated using parameters like accuracy, (PYAG) concept, in which you only pay for the services
AUC, F1, precision, and recall. The results are represented you use (Subashini & Kavitha 2011). One of the most nota-
as confusion matrices. The outcome of this work will further ble benefits of the PAYG approach is that we can reduce our
usage by delivering specific assets as needed. Clients can
customize the operating system, memory, CPU, networking,
and access control to meet their own requirements. Assets
* Abhishek Sharma are delivered at the client’s or end-request user’s (Ku & Chiu
[email protected]
2013). Individual users as well as industry benefit greatly
Umesh Kumar Singh from cloud computing, which has attracted the attention of
[email protected]
researchers (Fotiou et al. 2015).
1
Shri Vaishnav Vidyapeeth Vishwavidyalaya, Indore, India The cloud services defined by XaaS and X = [S, P, I]
2
Vikram University, Ujjain, Ujjain, India and their use of internet task execution. Cloud enables the

Vol.:(0123456789)
 Int J Syst Assur Eng Manag

resource sharing option to increase execution time and their servers (Sharma & Singh 2021a, 2021b). Authors
service availability (Gill et al., 2019). Cloud computing give a specific section on reliability and risk of complex
addresses resource scarcity concerns by delivering a vari- systems in (Misra & Verma, 2011), which is an attempt
ety of services tailored to the needs of clients (Buyya et al. to convey the state-of-the-art on new capabilities, meth-
2010), (Villegas et al. 2012) at multiple levels, such as Infra- odologies, implementations, strategies, and surveys per-
structure as a Service (IaaS), Platform as a Service (PaaS), taining to particular areas of reliability and risk analy-
and Software as a Service (SaaS). sis and management. The authors (Kansal et al., 2019)
Different applications are delivered over the cloud with- describe how to filter the most commonly seen vulner-
out having to be installed on the client’s machine. It allows ability type/class using a multi-criteria decision-making
developers and application designers to create applications approach called analytic network process, which involves
without having to purchase a server. It also provides vir- dependency among many criteria and input from various
tual instances of the actual hardware resources. All of these options. The concept of an automated deployment method
cloud services have the potential to reduce costs and pro- for computer program applications based on cloud com-
cessing power (Bermbach 2017), but they are all subject to puting is described in (Zhai et al., 2021). Computer serv-
security threats. Data breach is one of the most serious prob- ers typically reserve adequate resources for the highest
lems that a cooperative server can cause for both the tenant load in order to meet potential load situations, resulting
and the cloud service provider. Personal information (social in a significant reduction in resource use. Simultaneously,
security numbers, personal messages, credit card informa- the server load will be tracked in real time. In (Jaiswal
tion, and addresses) as well as commercial information could & Gupta 2017), the authors provide a plan that detects
be taken. In the existing scenario, the cloud consumer, which and addresses the system’s security vulnerabilities. It was
could be a service or data owner, must totally depend on the also suggested that potential risks to the cloud system be
service provider for information security and privacy (Basu identified first (Sharme et al, 2023), (Alzubi et al 2023),
et al. 2018). Users lose control of their data when it is kept and then algorithms implemented by existing systems be
on a cloud server, which leads to problems like data breaches assessed by calculating the security index to see if they can
(Mather et al. 2009). protect the system from the dangers indicated.
Security is the primary concern of the cloud computing Complex methods rely on the convergence of physi-
environment, and hence the security framework will guide cal and cyber or software components are known as CPSs.
both the cloud consumer as well as Cloud Service Provider CPS provides a diverse set of services. The number of CPS
about the clear perimeter of individuals and their shared deployed is steadily rising, posing a multitude of secu-
responsibility at each level. The cloud actors are able to rity and safety concerns. The concept and architecture of
simulate the proposed SRM based Cloud Computing secu- Cyber Physical Systems, explain the security objectives
rity framework either in there in-house or external cloud and difficulties of Cyber Physical Systems, and examine
environment for evaluation of the security parameters and the security risks and assaults of 3 levels of CPSs in this
compliance (Singh & Sharma, 2021). Identity management work (Sharma & Singh, 2022; Kumar & Vajpayee, 2016).
of cloud users is one of numerous challenges with cloud Cloud Computing is prone to manifold security threats
computing, including cloud user administration, multi-ten- varying from network level threats to application-level
dency support, and application security (Karthiban & Smys threats. Cloud network security brings out the taxonomy
2018). The major goal is to bring attention to the assurance of various types of cloud attacks that have occurred in the
concerns that are threatening cloud computing’s expansion. recent past, and it also lists out the successfully imple-
As a result, the aim of this research is to develop a taxonomy mented solutions to mitigate the risks (Sharma & Singh
of the security concerns that cloud environments face. This 2021c, 2022).
taxonomy is based on the identification of various security Here in this work introduction section includes the
vulnerabilities at various levels, as well as viable mitigation cloud computing issues and challenges. The second sec-
approaches for cloud applications security assurance. tion introduces the cloud computing security attacks which
As a service provider is accountable for accessibility also includes the application level attacks, traditional
and availability of various services, cost of maintenance attacks, wrapping attack and virtual machine (VM) based
entangled with it is negligible and clients remain free from attacks. The third section represents the literature review.
management and maintenance issues of resources at pro- The force action includes the proposed methodology
vider’s end. Because of these characteristics, Cloud Com- which starts with the experimental setup then the data sets
puting came to be called simply IT on demand or utility used attack scenarios and followed by the implementation
computing. A main significant feature of Cloud Comput- methodology. Within the fifth section the result analysis
ing is its Scalability and is attained via virtualization of is done through various graphs and tables followed by the
conclusion in the 6th section.
Int J Syst Assur Eng Manag

2 Cloud computing security attacks IP address in this circumstance. As a result, data ends up
in an undesired location. In comparison to cryptographic
A cloud computing attack is a malicious operation aimed approaches, a distributed anomaly detection system pro-
at causing harm to the cloud’s resources. Many researchers vides equivalent security and has a more acceptable adop-
have explored and investigated security problems (Lombardi tion route. In (Karlin et al. 2008), an analogous security
and Pietro 2011) and have provided a full description of scheme is detailed.
secure cloud infrastructure. This section discusses the basic
security attacks specified in taxonomy, as well as the avail- 2.1.4 Sniffer attack
able mitigation measures.
Intruders can collect data packets flowing over the network
using a variety of apps. It is possible to read data sent in an
2.1 Network level attacks unencrypted format. There is a chance that crucial informa-
tion travelling via the network will be intercepted or traced.
The machines that are operating within a cloud platform are Reusing IP addresses Attack. Sniffer detection platform
connected to the cloud platforms outside platform via a net- based on RTT (round trip time) and ARP (address resolu-
work. Over the network, an intruder might assault a system, tion protocol), which is used to find a sniffing structure on
thereby weakening cloud-based services and compromising the network (Chen et al. 2017).
data privacy. The following sections explain network-level
attacks. 2.1.5 Botnets

Botnets are characterized as a cybercriminal’s planned inter-

2.1.1 Scanning of port connected virus of an affected computer network without the
user’s knowledge. Botnets are a group of infected comput-
On the server side, a port might be investigated to check ers (bots) that are controlled remotely via the Command-
the status of services running on the target system. For and-Control channel (C&C) by a bot-master (machine that
port scanning, the network on which the target machine controls the bot network) (Alejandre et al. 2017). They fre-
is located must be accessible. Port scanning is a technique quently send spam emails, spread malware, and engage in
for exposing target computer flaws that lead to denial-of- other cybercrime activities. Bot-masters are discovered by
service attacks (Riquet, Grimaud, and Hauspie, 2012). To filtering packets and tracking communication to avoid botnet
prevent this attack, a firewall and an intrusion prevention attacks (Alejandre et al. 2017; Kourai et al. 2012).
system (IPS) are utilized. The affected and exposed ports are
actively detected and controlled by the firewall (Scarfone &
2.1.6 DNS attack
Mell, 2007). Before the IPS can get a complete map of the
network, it detects ports and shuts them down.
The Domain Name System (DNS) converts the domain
name into an IP address. As an alternative to the original
2.1.2 Replay attack
request, the user could be routed to another malicious cloud.
As a result, the path is diverted through some malicious
A legitimate data transmission is maliciously delayed or
sender-receiver link. Such a chosen path may pose a security
repeated in this attack. The attacker saves and redirects old
risk. Domain Name System Security Extensions (DNSSEC)
messages, then sends this message to one of the participants
is used to mitigate the consequences of DNS attacks.
in order to get access in the future. By sending commu-
nications to an old tenant, the attacker acquires access to
unlawful resources. To mitigate this attack (Khan and Salah, 2.1.7 Reusing IP addresses attack
2018), session tokens, timestamps, denying concurrent
logins, and restricting the session period were employed. Other users on the network can reuse and reassign IP
addresses. Even after a user’s address has been used, it stays
2.1.3 BGP prefix hijacking in the DNS cache [22]. The privacy of the original client
is violated if this address is utilized by another user due to
An attack on the network in which the Autonomous sys- reassignment or hacking. As a result, data from the origi-
tem is given the erroneous IP address. Malicious insiders nal client can be accessed by other clients. To prevent this
gain access to the undetected IP address as a result. A faulty attack, the cache of previous ARP addresses is purged.
AS broadcasts inaccurate information about the associated
IPs. Authenticated traffic was routed to an unauthenticated
 Int J Syst Assur Eng Manag

2.2 Application‑level attacks affected system after acquiring all necessary information. To

avoid any sensitive material release, software solutions such
2.2.1 Dictionary attack as Web Vulnerability (WV) Scanner are deployed.

In a dictionary attack, the attacker uses every conceivable

word combination to decode the data that has been success- 2.2.6 CAPTCHA breaking
fully transferred within a network. As a result, the attacker
gains unauthorized access to network data. It can be avoided CAPTCHA was created to protect network resources from
by using an OTP (One-Time Password), which is described being over-exploited and spammed (Sridhar and Smys
in (Jadhav et al. 2016). To prevent these types of attacks, 2016). CAPTCHA could be hacked by spammers using
strong encryption algorithms are used. the audio system and text-to-speech software to defeat the
CAPTCHA test. As a result, an account can be accessed
by an unauthenticated user. As a preventative precaution,
2.2.2 Shared architecture
a secure CAPTCHA framework has been provided based
on the identification of more than one moving object to a
The cloud has a multi-tenant environment and a common
multifarious background.
architecture. When the architecture is shared, the victim’s
application execution path can be traced. Authorization,
access control, and authentication are just a few of the issues
2.2.7 Manipulation of hidden field
that arise in a shared environment. Rapid elasticity and
isolation are important issues in multi tenant environment
Some fields in web pages that are used by developers are
resource accounting (Chen et al. 2011). Its vulnerabilities
hidden. Hidden fields in HTML forms include important
can also be exploited to gain access to a victim’s account
information such as the user ID and pricing, among other
and track their activities. The likelihood of data leaking in
things. The attacker can modify the values of these fields on
a shared architecture can be discovered by examining the
the index page and subsequently post them on the web page
binary code of the program (Doychey et al., 2015).
(Bhadauria, 2012). By implementing proper security checks,
the system can avoid this attack.
2.2.3 Denial of service attack
2.2.8 Distributed DOS attacks
The service provider’s server becomes overwhelmed with
requests, and the service becomes unavailable to author-
The attack comes from a variety of dynamic networks that
ized users. IDS (Vieira et al. 2010) is the most often used
have previously interacted in the form of service attacks in
encounter approach. Firewalls and switches are preventative
denial-of-service attacks. Adversaries gain control of infor-
instruments.
mation streaming by reusing data that had already been sent
across network machines. As a consequence, the attacker
gains control over the volume and type of public usage infor-
2.2.4 Cookie poisoning
mation (Lin et al., 2012). IDS is used to protect the cloud
against DDOS attacks (Bakshi, 2010), (Lua, 2011).
By gaining unauthorized access to the programme, an unau-
thorized user can change or modify the contents of cookies.
2.2.9 Hypervisor oriented attacks
Cookies are used to store information about a user’s identity
and authorizations. Once these are accessible, their content
The hypervisor allows several VMs to be configured on dif-
can be duplicated in order to impersonate an authenticated
ferent physical hosts. The guest system executes malicious
person. This attack can be avoided by using an encryption
code. This guest system tries to set up malicious malware
technique on cookies and cleaning them up on a regular
to seize complete control and disable the host system’s ser-
basis (Gollmann et al., 2008).
vices (Luo et al. 2011). Inter-communication among various
components and monitoring the occurrences of guest Vir-
tual Machines can be used to construct a progressive cloud
2.2.5 Google hacking
defense system (Wu et al. 2010).
Hackers utilize the Google search engine to discover sen-
sitive material and then use that information to get into
user accounts. The hacker next performs the hacking of the
Int J Syst Assur Eng Manag

2.3 Traditional attacks present on a system. Furthermore, various virtual machine

management stages could be employed to support large-
In taxonomy, this is the third type of attack. There are three scale cloud attacks.
main attacks that can threaten the user while entering the
cloud, as outlined below.
3 Literature review
2.3.1 SQL injection attack
In (Bamhdi, 2021; Dhanabal, 2015; Abrar, 2020; Idhammad
The vulnerable code is injected into the SQL code in order et al., 2018), the author used GCP to conduct a number
to acquire unauthorized control of the database (Clarke-Salt of experiments in order to evaluate the preferred solution
et al., 2009) and dynamically detect and extract users. SQL using the CIDDS-001 public dataset. When compared to a
injection attacks are prevented using a proxy-based infra- Random Forest classifier, the obtained results are adequate.
structure (Liu et al. 2009). The system had a 97 percent accuracy rate, a 0.21 percent
average false positive rate, and a 6.23 s average running
2.3.2 Cross site scripting attack time.
In (Rani et al., 2019), the author presents a review of
Malicious programs can be included in web page code. The IDS based on signature and anomaly detection methodolo-
user inadvertently clicks on the dangerous links. As a result, gies in some other tabular format in order to obtain a clear
an interfering third party acquires access to the customer’s understanding of the assaults to be identified, as well as the
personal information and is able to hack into their accounts. benefits and limitations that existing systems face. When a
By recognizing untrusted information on networks, a blue- bulky flow of data packets flows in a cloud environment, the
print-based solution has been proposed to lessen reliance on author (Zaidi 2021) proposes a Network Intrusion Detection
web browsers (TerLouw et al., 2009). System (NIDS) to recognize intrusions at the front & back-
end. The dataset was designed and evaluated for precision,
2.3.3 Man in the middle attack recall, accuracy, and model build time in order to find the
optimum machine-learning algorithm for intruder detection,
In this attack, an unauthorized user tries to intrude on a cli- but the result was below 90%.
ent–server conversation in order to inject false information. The IDS model in (Chen et al. 2020) is built using the
The attacker gains access to the data and communications of random forest (RF) technique, and the network traffic data
both the client and the sender. This attack is only possible if of multiple network levels of each cloud server is collected
the attacker can replicate each endpoint of the agreement as using the tcpdump utility and data mining methods. In the
predicted by the genuine end. To prevent these attacks, all instance of RF, the testing findings reported in the system for
protocols that require some form of authentication at end- intrusion detection had an accuracy of up to 99.71 percent.
points are utilized (Callegati et al. 2009; Siddiqui et al. 2019, In (Jaber et al., 2020) & (Ghosh et al. 2015), authors con-
Dash et al., 1997). For example, authentication sent to either ducted experiments using the NSLKDD dataset. The results
of two parties using a mutually trusted authority’s certificate. acquired utilizing hybrid mechanism (FCM–SVM) related to
For attack prevention, many encryption techniques such as performance assessment and comparison analysis reveal that
Cain, Dsniff, Ettercap, Airjack, were utilized. the suggested method can identify irregularities, although
the effectiveness of accuracy of their suggested technique
2.4 Wrapping attack was 99.1%.
Various systems for evaluating and detecting DDoS
Authentication information for tenants is retained in the attacks have lately been deployed. Many of these detection
replicating body of the SOAP (Simple Object Access Pro- and sensing jobs are based on feature selection characteris-
tocol) header wrapping attacks. It enables an attacker to tics from a pool of traced IP packets. The recent increase in
execute malicious code and gain access to Cloud services. the number of DDoS attacks in the application layer of net-
This attack can be mitigated by employing proper signature work protocols has sparked debate and piqued the interest of
techniques and SSL settings. the research community (Somani et al., 2017). Such research
ideas and concepts can be separated into three categories:
2.5 VM based attacks methodologies based on network traffic characteristics,
methods based on puzzles, and tactics based on applica-
Vulnerabilities in the VM are harmed as a result of such tions. DDoS attacks rely on machine learning techniques
attacks. This disrupts cloud services and data security. Vari- to increase the accuracy of false-positive rate detection. A
ous virtual machines (VMs) cause a variety of dangers to be number of past tasks have been committed to improving
 Int J Syst Assur Eng Manag

DDoS attack detection and sensing efficiency. In this sec- 2019) provide the best mathematical model for predicting
tion (Salmen et al. 2015), we’ve summarized a few recent the level of stakeholder satisfaction (Q) as part of their
studies on detecting DDoS attacks. work on software quality prediction, although security
Fadir Salmen (Liu & Chang et al., 2011) et al. devised concerns for cloud-specific applications have not yet been
and proposed a community-level digital signature to monitor resolved. In order to improve prediction accuracy, the
flow using two meta-heuristic methods. They demonstrated author of (Jain, Rachna et al., 2019) proposes an ensem-
improved accuracy by integrating random site visitors into ble learning technique that uses predictions from earlier
the detection of DDoS attacks to test the effectiveness of the supervised learning algorithms. However, this approach is
designed procedures, but the required model was unable to only applicable to life insurance datasets; it cannot be used
discover DOS attacks. Liu et al. (Eskin et al. 2002) used 2 with real-time datasets in a cloud computing environment.
coordinated protectors, Behavior Analyzer and Egress Filter, In addition to network security, researchers have expressed
to safeguard systems from DDoS cyber-attacks. Counter- a strong interest in applying machine learning and deep
attack strategies implemented provide various services for learning techniques to other healthcare and medical sec-
every application dependent on the degree of deviation. tors, including radiography, drug development, cancer
A standalone classification based on SVM is utilized to diagnosis, and medical data privacy (Jafar et al., 2022).
discover anomalies in (Dantas et al. 2014), where train-
ing data is charted within a specified characteristic space.
Various approaches have been used to mine relevant fea-
tures from a set of data, and then a few classifiers, like 4 Proposed methodology
pattern recognition, ML, and statistics, have been trained
using the data set section. Adaptive Selective Verification For investigating the security risks in terms of threads
(ASV) is a hosted protection solution that protects against and identification of intrusion during the runtime, an inte-
HTTP POST Flooding attacks, according to Dantas Y et al. grated approach is implemented using multiple machine
(Vijayalakshmi et al. 2012). Because ASV is designed to learning algorithms simultaneously. Before implementa-
prevent DDoS attacks at the network layer, it assumes that tion, it is required to collect the data from the memory
interactions between server and consumer stateless syn- dump and log files and prepare various data sets. Then
ack connections are ongoing. However, such attempts are the data sets are preprocessed using multiple methods to
insufficient as a mechanism for preventing DDoS attacks prevent under and out fitting. During the preprocessing of
at the Application Layer. To protect against DDoS attacks, the data set the correlation among the various features are
many systems involving machine learning and data mining required to find out so that it will be free from the outliers.
have been implemented. Alkasassbeh et al. (Salmen et al.
2015)) looked at 27 features in numbers in a recent batch 4.1 Experimental setup
of data for present DDOS attacks in network layers, which
included (HTTP, SIDDOS) Flood. The work focused on The experimental setup is implemented using Jupyter note-
the relative evaluation of several classifiers used inside a book which is deployed over the Google Cloud. Using this
pool and the calculation of the evaluation matrix for each platform, the algorithm is implemented using python with
method used. This notion encompasses Naive Bayes, MLP, various machine learning libraries and packages. Before
and machine learning, which are all typical Random For- implementation of ML algorithms, the ISOT data set is pre-
est mechanisms. MLPs had the greatest accuracy rate of processed by implementing the various steps. The processed
98.63 percent out of all these concepts and techniques (Liu ISOT data set is then imported and visualized using python
& Chang et al., 2011). The authors (Vijayakumar et al., & Jupyter notebook. Due to the large size of the data set,
2022) propose the Evolutionary Optimization Algorithm Google Cloud platform is used here for implementation of
for Cloud Based Image Retrieval System (EOA-CIRS) the proposed methodology. Following is the configuration
method, whereas the author of (Priscila, 2022) explored of Google Cloud virtual machine used as an experimental
risk-Based access control mechanisms for the Internet of setup:
Vehicles utilizing artificial intelligence. Platform: Google Cloud Platform (GPU based).
The authors demonstrate that machine learning-based Region & Zone: asia-southeast1-a(Singapore).
intrusion detection systems perform well in contexts of fog Machine-Type: n1-standard-8 (8 vCPUs with 30 GB
and edge computing (Alzubi et al. 2022a, b). Omar Alzubi memory).
et al. (2022a, b) developed edge concepts including mobile CPU platform: Intel-Broadwell.
edge computing (MEC) and fog computing (FC) to address Disk Size: 100 GB.
IoT implementation issues. The authors of (Gheisari et al OS:Debian.
Environment:Python 3 (with Intel® MKL).
Int J Syst Assur Eng Manag

Table 1  Phase vice monitored packets Details This is critical for the development and evaluation of truthful
Phase No. of days Total packets Benign Malicious
intrusion prototypes for cloud computing by industry and
/ phase observed (logged) research (Aldribi, 2018; Aldribi, 2020). The details of phase
vice monitored packets is represented in Table 1:
1 4 24,519,987 15,306,027 9,213,960
To avoid the problem of overfitting and to eliminate outli-
(62.42%) (37.58%)
ers, the characteristics of 55,379 packets are used as a train-
2 5 12,418,998 9,770,676 2,648,322
(78.68%) (21.32%) ing and testing dataset for machine learning algorithms for
intrusion detection.

Environment version:M73. 4.3 Attack scenarios

Boot & Data disk:100 GB disk.
Extensions:BigQuery, GCS Filebrowser, Vizier. Both application and network layer threats are included in
Shielded VM:Secure Boot not enabled, vTPM enabled, the ISOT-CID. The attacks are further classified into two
Integrity Monitoring enabled. categories based on how and where they originate: inside
or outside the ISOT-cloud environment. Inner attacks come
4.2 Datasets from a vulnerable instance within the ISOT cloud plat-
form networks and targeting either the inner cloud platform
The dataset is about 2.5 TB in size, and it includes typical or the external environment, whereas external attacks origi-
operations including comprehensive range of attack vectors. nate from the exterior environment and target the ISOT-
It was gathered in two stages (phase1 during 2016, Decem- cloud platform. The following are the different types of
ber & phase2 during 2018, February) and across many attacks that have been carried out represented in Table 2:
weeks for VMs and numerous weeks & time intervals for
Hypervisors. The normal or benign data comes from web 4.4 Methodology
apps and administrative responsibilities such as observing
the validity of virtual machines, restarting, refreshing, gen- The proposed methodology consists of 5 steps. In step-1 data
erating files, SSHing into the machines, and signing in to a Collection task is performed and in the second step data is
cloud host. More than 160 genuine customers, comprising preprocessed before implementation of the actual algorithm.
more than 60 end consumers and legitimate traffic created The proposed methodology is as shown in Fig. 1:
by 100 robots, generated web traffic by doing activities like During the third step the data set is imported within the
sign up, read-post or comment to blogs, explore different experimental setup (Notebook in GCP) using python, Pan-
URLs, and etc. A credential management system for active das & sklearn. During the fourth step the whole data set is
accounts is among the major web applications (Aldribi, separated into two parts called training pairs, the first part
2018; Aldribi, 2020). is training-dataset which contains 75% of the whole dataset
The ISOT is a collection of data obtained from multiple and the second part is testing dataset which contains the rest
cloud layers, such as hypervisors, internetworks & guest- of the 25% data set. During the fifth step multiple supervised
hosts. It includes information from various formats and from machine-learning algorithms and models are implemented
numerous sources of data, like storage dumps, assets (exam- like SVM, random forest, logistic regression, KNN, Naive
ple: CPU) usage log files, process call traces, system’s log Bayes. The proposed methodology used is detailed in fol-
files & internet traffic. It’s big & diversified enough to sup- lowing steps:
port an extensive sort of intrusion data-models, sets of fea- Step -1: Data Collection
tures, and analysis models. The objective of ISOT-CID is to
represent a real cloud-based dataset; it is completely pure a) Collect Data from log files, memory dump files, and
but hasn’t been processed, modified, or damaged in any way. miscellaneous files.

Table 2  Layer vice types of attack performed on Cloud Platform

Layer / Phase Phase -1 Phase -2

Application Layer HTTP Flood DOS, Dictionary/Brute Force login attacks, Web Vulnerabilities Scanning, Cross-site scripting (XSS),
Network Scanning, SQL injection, Fuzzers, HTTP Flood DOS
Network Layer DNS Amplification DOS, Synflood DOS, UDP Flood DOS, Path/directory traversal, DNS Amplification DOS, Network
Probing, Backdoor (reverse shell), Remote-to-Local (R2L), Scanning, Synflood DOS, UDP Flood DOS, Unclassified
Network Scanning, Trojan Horse, Unclassified (unsolicited (unsolicited traffic)
traffic)
 Int J Syst Assur Eng Manag

Fig. 1  Proposed Methodology

b) Represent the gathered data into csv format. feature space having highest value at the SV and uniform
decay in all dimensions around the SV, resulting in hyper-
Result: ISOT-CID data set csv files. spherical edges of the kernel function. The Gaussian or RBF
Step -2: Data Preprocessing kernel is:
( )
a) Digitalize all the features of the dataset using numeric ||x − y||2
K(x, y) = EXP −
values. 2𝜎 2
b) Define & declare the target feature within the proposed
Here, ||x–y|| represents the Euclidean distance. The lin-
dataset.
ear weighted arrangement of the kernel function generated
c) Fill up the missing parameters of the dataset by finding
within a data point and every SV is the SVM classifier hav-
‘mode’ of the respective feature.
ing Gaussian kernel. The importance of a SV in data point
d) Find the Pearson Correlation coefficient of all the pairs
categorization is tempered by the SV’s global prediction
of features using following expression:
utility, and K(x,y), the SV’s local influence on prediction at
n(Σxy) − (Σx)(Σy) a specific data point.
R= √
(nΣx2 − (Σx)2 )(nΣy2 − (Σy)2 ) b) Implement Random Forest, logistic regression, KNN,
Naive Bayes algorithms of the same dataset.
  Where R is Pearson correlation coefficient between x c) Evaluate all the supervised classification algorithms or
and y, n is number of observations. models with respective performance matrices.
e) Identify the features on the basis of correlation threshold Results: Performance Matrix content accuracy, F1, Preci-
value. sion & recall.
f) Find the outliers and discard them.

Result: Final data set with selected features in csv files.

5 Results analysis
Step -3: Import & visualize Data Set
As per the methodology used for analyzing the security risk
a) Import the processed dataset within the experimental
and attack analysis (through attack vector), the ISOT data set
setup built on GCP using Jupyter Notebook.
is preprocessed through correlation coefficient analysis for
b) Visualize the finalized digital dataset having no missing
selecting the features which positively contribute and hav-
values & outliers.
ing relationship with the target feature. The following figure
c) Define & declare target features.
represents the features selected on the basis of correlation
coefficient and their relationship & respective Heat Map:
Result: Finalized digital dataset is imported.
In Fig. 2a, blue underline is used to represent the nega-
Step – 4: Build Training Pair
tive correlation Coefficient value whereas green underline is
used to represent the positive correlation Coefficient value
a) Split the data set into two categories.
between the pairs. On the basis of Pearson correlation 10
b) Training Dataset: 75%.
features are identified including targets for further imple-
c) Testing Dataset: 25%.
mentation. Whereas Fig. 2b represents the respective heat
map of outliers. The following Fig. 3 represent the perfor-
Result: Data set is ready with training pairs.
mance of various supervised machine learning algorithms
Step -5: Implement Proposed ML Algorithms
implemented here on ISOT dataset in terms of confusion
A) Implementation of Support vector machine.
matrix:
The Gaussian kernel calculated using a support vector
Multiple machine learning algorithms or models are
(SV) is an exponentially declining function in the source
implemented on the preprocessed standard cloud-based data
Int J Syst Assur Eng Manag

Fig. 2  a Correlation of selected feature pairs b Heat Map respective to outliers

set. The comparison of implemented models on the basis The whole experiment and implementation is carried out
of 5 parameters like AUC, CA, precision all, recall & F1 is on the Google cloud platform using GPU based VM. The
performed as presented in the following table: performance of the execution was recorded & is as follows:
Now, it is clear from the above table that the random for-
est, ANN and kNN algorithm has 100% accuracy, precision 1) Training Time: 4.32 s
and other performance parameters. As far as the training 2) CPU utilization: 12.41% (maximum)
time is concerned, the support vector machine (SVM) is hav- 3) Memory utilization:4.63% (maximum)
ing the best performance (4.32 s) among all of them & as 4) Disk Space utilization: 9.58% (maximum)
compared to previous implementation (Liu & Chang et al., 5) Disk Throughput: 1.66 MB/S
2011). As compared to the previous implemented algorithms 6) Model execution Parallelism: Yes
which was having the accuracy rate of 97% (Liu & Chang
et al., 2011) for RF, less than 90% (Dantas et al. 2014) for
RF, 99.1% for FCM–SVM (Patel et al. 2013), 98.63% for
Naive Bayes & ANN [(Lua, 2011), the proposed method is 6 Conclusion
having better performance with respect to all the five param-
eters represented in Table 3.The following figure 4 represent The cloud paradigm has changed the IT sector. For busi-
ROC curve and Cumulative gains (Lift Curve with Convex nesses and organizations, it offers a variety of advan-
hull) of implemented models: tages. Even while the cloud offers many benefits, it’s still
 Int J Syst Assur Eng Manag

Fig. 3  Confusion Matrices of Supervised ML Algorithms / Model on ISOT-CID Dataset

Table 3  Evaluation of S. No Algorithm / model Area under Classification Precision Recall F1

Supervised ML algorithms ROC csurve accuracy (CA)
/ Model on the basis of (AUC)
Performance matrix
1 Support Vector machine (SVM) 1.000 0.992 0.992 0.992 0.992
2 Random Forest 1.000 1.000 1.000 1.000 1.000
3 Naive Bayes 0.948 0.846 0.846 0.846 0.846
4 Logistic Regression 0.991 0.896 0.900 0.896 0.897
5 Artificial Neural Network (ANN) 1.000 1.000 1.000 1.000 1.000
6 K-nearest Neighbour (kNN) 1.000 1.000 1.000 1.000 1.000

security vulnerable. Therefore, one of the biggest obstacles algorithms abstracted also including support vector machine
to adopting the cloud is security. Customers and vendors (SVM), random forest (RF), logistic regression (LR), Naive
are aware of security problems and assaults. The adoption Bayes (NB), artificial neural network (ANN), and K-nearest
of cloud computing is being hampered by a number of Neighbor (kNN). Training and testing of data were carried
problems, threats, and security vulnerabilities that have out using various supervised ML algorithms or Models in
been shown by this research. As a result of the special which multiple attacks variations are involved were detected
characteristics of the cloud, security problems with virtu- & analysis as a risk. The algorithms & models could detect
alization, resource pooling, and sharing arise. According attack with 99.2% accuracy in case of SVM and with 100%
to provider security concerns, a variety of cloud security in case of Random forest, ANN & kNN. Thus, SVM can be
problems and assaults are analyzed. (Figure 4) used effectively to detect intrusion in real-time networks.
The work presented in this paper can help better under- Various machine learning algorithms can also be applied in
stand the various threats and security issues connected to parallel for sensing and detecting attack, however amongst
Cloud Computing and used to design countermeasures to these SVM, Naive Bayes, ensemble methods, logistic regres-
an existing set of threats. In this work, the intrusion detec- sion algorithm over Machine learning had proved to produce
tion was performed using the most recent ISOT-CID data- efficient outcome.
set. The dataset was preprocessed by choosing 10 attributes As a future work multiple classification algorithms &
based on their correlation & significance. To detect and models can be implemented as an integrated approach at real
categorize intrusions in a cloud environment, the meth- time, to perform zero-day protection. It can be further useful
odology utilizes a variety of supervised machine learning for the taxonomy development of attacks. Due to successful
Int J Syst Assur Eng Manag

Fig. 4  a ROC Curve of implemented model b Cumulative gains (Lift Curve with Convex hull) of supervised model implemented

identification & classification of attacks as a risk, it will Funding They have no known competing financial interests or per-
assist & help the Cloud security administrator for prioritiza- sonal relationships that could have appeared to influence the work
reported in this paper. This research did not receive any specific grant
tion & mitigation plan development. from funding agencies in the public, commercial, or not-for-profit
sectors.
 Int J Syst Assur Eng Manag

Declarations computing. J Cloud Comput 6(1):1. https://​doi.​org/​10.​1186/​

s13677-​016-​0071-y
Chen Y, Li X, & Chen F (2011). Overview and analysis of cloud com-
Conflict of interest The authors declare that: The submitted work
puting research and application. In Ebusiness and E-government
is original and is not published elsewhere in any form or language.
(ICEE) International Conference on, 2011 (pp. 1–4).
It has not been published elsewhere and that it has not been submit-
Chen L, Xian M, Liu J, & Wang H (2020). Intrusion detection sys-
ted simultaneously for publication elsewhere. We have no conflicts of
tem in cloud computing environmentInternational Conference on
interest to disclose.
Computer Communication and Network Security (CCNS), 2020
(pp. 131–135). https://​doi.​org/​10.​1109/​CCNS5​0731.​2020.​00037
Clarke-Salt J (2009) SQL injection attacks and defense. Elsevier
Dantas YG, Nigam V, & Fonseca IE (2014). A selective defense for
References application layer ddos attacks. In IEEE joint intelligence and secu-
rity informatics conference, 2014 (pp. 75–82). IEEE Publications.
Abdulaziz Aldribi IT, Belaid Moa ON (2020) Hypervisor-based cloud Dash M, Liu H (1997) Feature selection for classification. Intell Data
intrusion detection through online multivariate statistical change Anal 1(3):131–156. https://​doi.​org/​10.​3233/​IDA-​1997-​1302
tracking Computers & Security. Elsevier, p 88 Dhanabal L, Shantharajah SP (2015) A study on NSL-KDD dataset for
Abrar I, Ayub Z, Masoodi F, &Bamhdi AM (2020). A machine learning intrusion detection system based on classification algorithms. Int
approach for intrusion detection system on NSL-KDD dataset. J Adv Res Comput Commun Eng 4(6):446–452
Proceedings of the—International Conference on Smart Electron- Doychev G, Köpf B, Mauborgne L, Reineke J (2015) Cacheaudit: a tool
ics and Communication, ICOSEC 2020 (pp. 919–924). https://d​ oi.​ for the static analysis of cache side channels. ACM Trans Inf Syst
org/​10.​1109/​ICOSE​C49089.​2020.​92152​32 Secur 18(1):1–32. https://​doi.​org/​10.​1145/​27565​50
Aldribi A, Traore I, & Moa B. (2018). Data sources and datasets for Eskin E, Arnold A, Prerau M, Portnoy L, Stolfo S (2002) A geometric
cloud intrusion detection modeling and evaluation. Studies in Big framework for unsupervised anomaly detection. In: Barbará D,
Data, 333–366. https://​doi.​org/​10.​1007/​978-3-​319-​73676-1_​13. Jajodia S (eds) Applications of Data Mining in Computer Secu-
Mishra B, Das H, Dehuri S, &Jagadev A. Cloud computing for rity. Springer US, Boston, pp 77–101. https://​doi.​org/​10.​1007/​
optimization: Foundations, applications, and challenges. Studies 978-1-​4615-​0953-0_4
in Big Data, 39: 333–366. Springer. Fotiou N, Machas A, Polyzos GC, Xylomenos G (2015) Access control
Alejandre FV, Cortés NC, & Anaya EA (2017). Feature selection to as a service for the Cloud. J Int Serv Appl 6(1):1–15
detect botnets using machine learning algorithms. In Electronics, Gheisari M et al (2019) An optimization model for software quality
communications and computers (CONIELECOMP) International prediction with case study analysis using MATLAB. IEEE Access
Conference on, 2017 (pp. 1–7). 7:85123–85138. https://​doi.​org/​10.​1109/​ACCESS.​2019.​29208​79
Alzubi OA, Alzubi JA, Alazab M, Alrabea A, Awajan A, Qiqieh I Ghosh P, Mandal AK, Kumar R (2015) An efficient cloud network
(2022a) Optimized machine learning-based intrusion detection intrusion detection system. Adv Intell Syst Comput 10:91–99.
system for fog and edge computing environment. Electronics https://​doi.​org/​10.​1007/​978-​81-​322-​2250-7_​10
11(19):3007. https://​doi.​org/​10.​3390/​elect​ronic​s1119​3007 Gill, S. S. et al. (2019). Transformative effects of IoT, Blockchain and
Alzubi OA, Qiqieh I, Alzubi JA (2022) Fusion of deep learning Artificial Intelligence on cloud computing: Evolution, vision,
based cyberattack detection and classification model for intel- trends and open challenges, Internet of Things, pp. 100118.
ligent systems. Cluster Comput J. https:// ​ d oi. ​ o rg/ ​ 1 0. ​ 1 007/​ Gollmann D (2008) Securing web applications. Inf Secur Tech Rep
s10586-​022-​03686-0 13(1):1–9. https://​doi.​org/​10.​1016/j.​istr.​2008.​02.​002
Alzubi JA, Alzubi OA, Singh A, Ramachandran M (2023) Cloud-IIoT- Idhammad M, Afdel K, Belouch M (2018) Distributed intrusion detec-
based electronic health record privacy-preserving by CNN and tion system for cloud environments based on data mining tech-
blockchain-enabled federated learning. IEEE Trans Industr Inf niques. Procedia Comput Sci 127:35–41. https://d​ oi.o​ rg/1​ 0.1​ 016/j.​
19(1):1080–1087. https://​doi.​org/​10.​1109/​TII.​2022.​31891​70 procs.​2018.​01.​095
Bakshi A, &Dujodwala YB (2010). Securing cloud from ddos attacks Jaber AN, Rehman SU (2020) FCM–SVM based intrusion detec-
using intrusion detection system in virtual machine. In Communi- tion system for cloud computing environment. Clust Comput
cation Software and Networks. ICCSN’10. Second International 23(4):3221–3231. https://​doi.​org/​10.​1007/​s10586-​020-​03082-6
Conference on, 2010 (pp. 260–264). Jadhav SS, Hagwane PK, Labhade PC, &Nalawde KS (2016). Data
Bamhdi AM, Abrar I, Masoodi F (2021) An ensemble based approach confidentiality in cloud computing using android application,
for effective intrusion detection using majority voting. TELKOM- Imp.J. Interdiscip. Res., 2(6).
NIKA (Telecommun Comput Electron Control) 19(2):664. https://​ Jain R, Alzubi J, Jain N, Joshi P (2019) Assessing risk in life insurance
doi.​org/​10.​12928/​telko​mnika.​v19i2.​18325 using ensemble learning. J Intell Fuzzy Syst 37(2):2969–2980
Basu, S. et al. (2018). Cloud computing security challenges and solu- Jaiswal S, Gupta D (2017) Engineering and validating security to make
tions-a survey, in 2018 IEEE8th Annual Computing and Com- cloud secure. Int J Syst Assur Eng and Management 8(S2):1419–
munication Workshop and Conference (CCWC) (pp. 347–356). 1441. https://​doi.​org/​10.​1007/​s13198-​017-​0612-x
Bermbach D (2017) Quality of cloud services: expect the unexpected. Kansal Y, Kapur PK, Kumar U, Kumar D (2019) Prioritising vulner-
IEEE Internet Comput 21(1):68–72. https://d​ oi.o​ rg/1​ 0.1​ 109/M ​ IC.​ abilities using ANP and evaluating their optimal discovery and
2017.1 patch release time. Int J Math Op Res 14(2):236. https://​doi.​org/​
Bhadauria R, Sanyal S (2012) Survey on security issues in cloud com- 10.​1504/​IJMOR.​2019.​097758
puting and associated mitigation techniques. Int J Comput Appl Karlin J, Forrest S, Rexford J (2008) Autonomous security for autono-
47(18):47–66. https://​doi.​org/​10.​5120/​7292-​0578 mous systems. Comput Netw 52(15):2908–2923. https://​doi.​org/​
Buyya R, Broberg J, Goscinski AM (2010) Cloud computing: Princi- 10.​1016/j.​comnet.​2008.​06.​012
ples and paradigms, 87. John Wiley & Sons Karthiban K, &Smys S (2018). Privacy preserving approaches in cloud
Callegati F, Cerroni W, Ramilli M (2009) Man-in-theMiddle attack to computing, in 20182nd International Conference on Inventive
the HTTPS protocol. IEEE Secur Priv 7(1):78–81 Systems and Control (ICISC) (pp. 462–467).
Chen X, Chen S, Zeng X, Zheng X, Zhang Y, Rong C (2017) Frame- Khan MA, Salah K (2018) IoT security [Review], blockchain solutions,
work for context-aware computation offloading in mobile cloud and open challenges. Futur Gener Comput Syst 82:395–411
Int J Syst Assur Eng Manag

Kim W (2013) Cloud computing architecture. Int J Web Grid Serv Sharma A, & Singh UK (2021b). Deployment model of e-educational
9(3):287–303. https://​doi.​org/​10.​1504/​IJWGS.​2013.​055724 cloud for departmental academics automation using open source.
Kourai K, Azumi T, & Chiba S. (2012). A self-protection mechanism HTL Journal, 27(5, 36), ISSN 1006–6748. https://​doi.​org/​10.​
against stepping-stone attacks for IaaS clouds. In Ubiquitous 37896/​HTL27.5/​3535
intelligence and computing and9th International Conference on Sharma A, Singh UK et al. (2021c). ‘A Comparative analysis of secu-
Autonomic and Trusted Computing (UIC/ATC) 9th International rity issues and vulnerabilities of leading Cloud Service Providers
Conference on, 2012 (pp. 539–546). and in-house University Cloud platform for hosting E-Educational
Ku C-Y, & Chiu Y-S. (2013). A novel infrastructure for data sanitiza- applications,’ IEEE Mysore Sub Section International Conference
tion in cloud computing [Research paper], in Diversity. Technol- (MysuruCon), ISBN 978–0–7381–4662–1.
ogy, and innovation for operational competitiveness. Proceedings Sharma A, Singh UK (2022) Modelling of smart risk assessment
of the 2013 International Conference on Technology Innovation approach for cloud computing environment using AI & supervised
and Industrial Management p. S3_25–28. machine learning algorithms. Global Trans Proc 3(1):243–250
Kumar SN, Vajpayee A (2016) A survey on secure cloud: Security and Sharma A, Singh UK et al. (2023) Security and Privacy aspect of
privacy in cloud computing. Am J Syst Softw 4(1):14–26 Cyber-Physical Systems. In A. Baliyan(Ed.), Cyber Physical
Lin W, & Lee D (2012). Traceback attacks in cloud-Pebbletrace botnet. system: Concept and application. CRC Press Taylor & Francis
In Distributed Computing Systems Workshops (ICDCSW)32nd Group, 1st ed.,Chapman and Hall/CRC. https://​doi.​org/​10.​1201/​
International Conference on, 2012 (pp. 417–426). 97810​03220​664-9
Liu HI, & Chang KC. (2011). Defending systems against tilt DDoS Siddiqui ST, Alam S, Shuaib M, Gupta A (2019) Cloud computing
attacks. In 6th International Conference on Telecommunication security using blockchain. J Emerg Technol Innovative Res
Systems, Services, and Applications (TSSA), 2011 (pp. 22–27). 6(6):791–794
IEEE Publications. Singh UK, Sharma A (2021) Cloud Computing Security Framework
Liu A, Yuan Y, Wijesekera D, &Stavrou A (2009). SQLProb: A proxy- Based on Shared Responsibility Models. In: Bali V, Bhatnagar
based architecture towards preventing SQL injection attacks. In V, Aggarwal D, Bali S, Diván MJ (eds) Cyber-Physical, IoT, and
Proceedings of the 2009 ACM Symposium on Applied Computing Autonomous Systems in Industry 4.0. CRC Press, Boca Raton, pp
(pp. 2054–2061). 39–55. https://​doi.​org/​10.​1201/​97810​03146​711-3
Lombardi F, Di Pietro R (2011) Secure virtualization for cloud comput- Singh UK, Sharma A, Singh SK, Tomar PS, Dixit K, Upreti K (2022)
ing. J Netw Comput Appl 34(4):1113–1122. https://​doi.​org/​10.​ Security and Privacy Aspect of Cyber Physical Systems. In: Bali-
1016/j.​jnca.​2010.​06.​008 yan A, Kaswan KS, Kumar N, Upreti K, Kannan R (eds) Cyber
Lua R, Yow KC (2011) Mitigating ddos attacks with transparent and Physical Systems: Concepts and Applications. Chapman and Hall/
intelligent fast-flux swarm network. IEEE Network 25(4):28–33. CRC, Boca Raton, pp 141–164. https://​doi.​org/​10.​1201/​97810​
https://​doi.​org/​10.​1109/​MNET.​2011.​59580​05 03220​664-9
Luo S, Lin Z, Chen X, Yang, Z, & Chen J. (2011). Virtualization secu- Somani G, Gaur MS, Sanghi D, Conti M, Buyya R (2017) DDoS
rity for cloud computing service. In Cloud and service computing attacks in cloud computing: Issues, taxonomy, and future direc-
(CSC)International Conference on, 2011 (pp. 174–179). tions. Comput Commun 107:30–48. https://​doi.​org/​10.​1016/j.​
Mather T, Kumaraswamy S, &Latif S (2009) Cloud security and pri- comcom.​2017.​03.​010
vacy: An enterprise perspective on risks and compliance. O‘Reilly Sridhar S, &Smys S (2016). A survey on cloud security issues and
Media, 2009. challenges with possible measures. In International Conference
Mell, P., &Grance, T. (2011). ―The NIST definition of cloud on Inventive Research in Engineering and Technology, 4.
computing. Subashini S, Kavitha V (2011) A survey on security issues in ser-
Misra KB, Verma AK (2011) Special Section on reliability and risk vice delivery models of cloud computing. J Netw Comput Appl
assessment of complex systems. IEEE Trans Reliab 60(1):59–60. 34(1):1–11. https://​doi.​org/​10.​1016/j.​jnca.​2010.​07.​006
https://​doi.​org/​10.​1109/​TR.​2011.​21102​10 TerLouw M, &Venkatakrishnan VN. (2009). ―Blueprint: Robust
Nister D, &Stewenius H (2006). Scalable recognition with a vocabulary prevention of cross-site scripting attacks for existing browsers.
tree. In Computer vision and pattern recognitionIEEE computer In Security and Privacy30th IEEE Symposium on, 2009 (pp.
society conference on, 2 (pp. 2161–2168). 331–346).
Patel A, Taghavi M, Bakhtiyari K, CelestinoJúnior J (2013) An intru- Vieira K, Schulter A, Westphall C, Westphall C (2010) Intrusion detec-
sion detection and prevention system in cloud computing: a sys- tion techniques in grid and cloud computing environment. IT Prof
tematic review. J Netw Comput Appl 36(1):25–41. https://d​ oi.o​ rg/​ IEEE Comput Società 12(4):38–43
10.​1016/j.​jnca.​2012.​08.​007 T. Vijayakumar K, Ramalakshmi C, Priyadharsini S, Vasanthakumar
Rani M (2019) A review of intrusion detection system in cloud com- S, and Sharma A,(2022) Bio-Inspired Optimization Algorithm on
puting. SSRN Electron J. https://​doi.​org/​10.​2139/​ssrn.​33551​27 Cloud based Image Retrieval System using Deep Features," 2022
Riquet D, Grimaud G, & Hauspie M (2012). Large-scale coordinated International Conference on Augmented Intelligence and Sustain-
attacks: Impact on the cloud security. In Innovative mobile and able Systems (ICAISS), Trichy, India, 2022, pp. 871–876, https://​
Internet services in ubiquitous computing (IMIS)Sixth Interna- doi.​org/​10.​1109/​ICAIS​S55157.​2022.​10010​739.
tional Conference on, 2012 (pp. 558–563). Vijayalakshmi M, Shalinie SM, &Pragash AA. (2012). IP traceback
Salmen F, Hernandes P, Carvalho L, &Proenca M (2015). Using firefly system for network and application layer attacks. In International
and genetic metaheuristics for anomaly detection based on net- Conference on Recent Trends in Information Technology, (pp.
work flows. In Proceedings of the 11th Advanced International 439–444). IEEE Publications.
Conference on Telecommunications (pp. 113–118). Villegas D, Bobroff N, Rodero I, Delgado J, Liu Y, Devarakonda A,
Scarfone K, Mell P (2007) Guide to intrusion detection and prevention Fong L, MasoudSadjadi S, Parashar M (2012) Cloud federation
systems (idps). NIST Spec Publ 800(2007):94 in a layered service model. J Comput Syst Sci 78(5):1330–1344.
Sharma A, & Singh UK (2021a). Investigation of cloud computing https://​doi.​org/​10.​1016/j.​jcss.​2011.​12.​017
security issues and challenges, 3rd International Conference on Wu H, Ding Y, Winer C, & Yao L (2010). Network security for virtual
Integrated Intelligent Computing Communication and Security machine in cloud computing. In Computer Sciences and Conver-
(ICIIC), 2021. https://​doi.​org/​10.​2991/​ahis.k.​210913.​055 gence Information Technology (ICCIT) 5th International Confer-
ence on, 2010 (pp. 18–21).
 Int J Syst Assur Eng Manag

Zaidi, T. (2021), A network intrusion based detection system for cloud Publisher’s Note Springer Nature remains neutral with regard to
computing environment. Preprints. https://d​ oi.o​ rg/1​ 0.2​ 0944/p​ repr​ jurisdictional claims in published maps and institutional affiliations.
ints2​02104.​0183.​v1
Zhai H, Wang J (2021) Automatic deployment system of computer Springer Nature or its licensor (e.g. a society or other partner) holds
program application based on cloud computing. Int J Syst exclusive rights to this article under a publishing agreement with the
Assur Eng Manag 12(4):731–740. https:// ​ d oi. ​ o rg/ ​ 1 0. ​ 1 007/​ author(s) or other rightsholder(s); author self-archiving of the accepted
s13198-​021-​01068-0 manuscript version of this article is solely governed by the terms of
Priscila S (2022) Risk-Based Access Control Mechanism for Internet of such publishing agreement and applicable law.
Vehicles Using Artificial Intelligence. Security and Communica-
tion Networks 2022:1-13 https://​doi.​org/​10.​1155/​2022/​33798​43