An Integrated approach for effective Intrusion Detection with Elasticsearch

Abstract

Cloud computing environments are easy targets for intruders and pose new risks and threats to an organization because of their service and operational models, the underlying technologies, and their distributed nature that relies on the network for its working. However, IDSs are among the efficient security mechanisms that can handle most of the threats of cloud computing. In spite this, several deficiencies of current IDSs technologies and solutions hinder their adoption in a cloud. The proposed work focuses on developing improved IDS that provides an integrated approach of both techniques i.e. anomaly based as well as knowledge based whether implement on network or host based IDS for cloud computing to detect masquerade, host, and network attacks and provides efficient deployments to detect DDoS attacks. The work comprises of integration of two powerful open source tool Suricata and Snort together with the proposed DDoS detection rule make the working of IDS more effective and high alarm rate generating Hybrid IDS.