No abstract

This paper reviews the background and related studies in the areas of cloud systems, intrusion detection and blockchain applications against cyber attacks. This work aims to discuss collaborative anomaly detection systems for discovering insider and outsider attacks from cloud centres, including the technologies of virtualisation and containerisation, along with trusting intrusion detection and cloud systems using blockchain. Moreover, the ability to detect such malicious attacks is critical for conducting necessary mitigation, at an early stage, to minimise the impact of disruption and restore cloud operations and their live migration processes. This paper presents an overview of cloud architecture and categorises potential stateof-the-art security events based on their occurrence at different cloud deployment models. Network Intrusion Detection Systems (NIDS) in the cloud, involving types of classification and common detection approaches, are also described. Collaborative NIDSs for cloud-based blockchain applications are also explained to demonstrate how blockchain can address challenges related to data privacy and trust management. A summary of the research challenges and future research directions in these fields is also explained.

The cloud computing paradigm is changing how businesses operate, providing greater efficiency, tolerance, elasticity and flexibility in computing workloads. Underpinning these changes are multiple data centers, operated by different entities and distributed globally. Despite these benefits, cloud computing presents new classes of cyber-attack, opportunities to attack and processes to subvert. One of the primary strategies to defend against cyber-attacks is the migration process. A secure Virtual Machine (VM) migration is essential to safeguard cloud data centers against insider and outsider attacks. In this paper, we propose a collaborative anomaly detection system for discovering insider and outsider attacks from cloud systems and their migration process. The proposed system is named Mixture Localization-based Outliers (MLO) and utilizes Gaussian-mixture models for fitting network data and a local outlier factor function for discovering abnormal patterns in network traffic data. In order to validate the effectiveness of the models, the datasets of UNSW-NB15 and BoT-IoT are employed. The experimental results have revealed the high performance of the proposed system compared with several peer anomaly detection techniques.