Deployment of Intrusion Detection System in Cloud: A Performance-Based Study

The aim of Cloud Computing environment is to provide low cost, reliable, rapid, on-demand services to the users anywhere and anytime. But with its rapid development the security challenges are numerous. The capability of the malicious users to compromise cloud security from outside and inside has increased many folds. Hence organizations and users are skeptical about the security of cloud based services. To detect various attack patterns there are different deployment scenarios and detection methods of intrusion detection system( IDS) a cloud administrator can adopt. The Network IDS and Host IDS techniques have gone a long way in detection of known and unknown attacks in cloud infrastructure as a Service (IaaS). This paper focuses on deployment of signaturebased IDS for detection of intrusion at network level and cloud VM instances. It discusses the flow of traffic in provider and self-service provider network architecture in OpenStack environment and use of port mirroring to detect intrusion. The results evaluate the CPU and memory performance measure of IDS and management of the alerts generated due to malicious and non-malicious traffic at varying speed.