Practical Machine Learning for Cloud Intrusion Detection

Abstract

Operationalizing machine learning based security detections is extremely challenging, especially in a continuously evolving cloud environment. Conventional anomaly detection does not produce satisfactory results for analysts that are investigating security incidents in the cloud. Model evaluation alone presents its own set of problems due to a lack of benchmark datasets. When deploying these detections, we must deal with model compliance, localization, and data silo issues, among many others. We pose the problem of "a ack disruption" as a way forward in the security data science space. In this paper, we describe the framework, challenges, and open questions surrounding the successful operationalization of machine learning based security detections in a cloud environment and provide some insights on how we have addressed them.

A Taxonomy of Software Engineering Challenges for Machine Learning Systems: An Empirical Investigation

“…There exists empirical studies [6] and experience reports [7,15,19,21] published across different disciplines that present an end-to-end development process and challenges of operational AI-enabled applications. In a field study of how intelligent systems are developed, Hill et al [6] describe a high-level process that includes the following activities that are not necessarily sequential: defining problem, collecting data, establishing ground truth, selecting algorithm, selecting features and creating and evaluating ML model.…”

A Review of Machine Learning Algorithms for Cloud Computing Security

“…The primary motivation behind the model was to offer access to an approved client in the cloud and choose the confided in the asset for his calculation [16]. In Reference [84], the advantages are ensuring high data privacy consistency, restriction, and information and disadvantage are difficulties to manage information. In Reference [16], the advantage is that a trust-based access control model is an efficient method for security in CC, and the disadvantage is security issues.…”

“…Kumar et al [84] described the framework, challenges, and open questions surrounding the successful operation of ML-based security detection in a cloud environment. Regular irregularity recognition does not create acceptable outcomes for investigators who examine security episodes in the Cloud.…”

Ciberseguridad : el reto del siglo XXI

“…Una de las limitaciones para los sistemas de detección es la falta de conjuntos de datos etiquetados de manera exhaustiva. Muchas veces, los expertos etiquetan los conjuntos de datos en dominios limitados y esto conduce a la falta de muestras etiquetadas y a numerosos errores de etiquetado, conjuntos de datos desbalanceados, dificultad para identificar fuentes maliciosas y más [11].…”