A survey on gaps, threat remediation challenges and some thoughts for proactive attack detection in cloud computing

Future Generation Computer Systems

Volumn 28, Issue 6, 2012, Pages 833-851

  Khorshed, Md Tanzim ^a   Ali, A B M Shawkat ^a   Wasimi, Saleh A ^a  

^a CENTRAL QUEENSLAND UNIVERSITY   (Australia)

Author keywords

Cloud computing; Machine learning; Security; Threats; Trust

Indexed keywords

ATTACK DETECTION; ATTACK PREDICTION; BUSINESS OUTCOMES; CLOUD PROVIDERS; COST OF SERVICE; CYBER-ATTACKS; HYPERVISOR; LARGE DATABASE; LONG-TERM POTENTIAL; MACHINE-LEARNING; MEMORY PERFORMANCE; MODEL PERFORMANCE; MODERN MACHINES; PERFORMANCE DATA; SECURITY; SECURITY ISSUES; SECURITY LOGS; SECURITY THREATS; SUPPORT VECTOR MACHINE TECHNIQUES; THIRD PARTY SOFTWARE; THREAT DETECTION; THREATS; TRUST; USER COMMUNITIES;

CRIME; LEARNING SYSTEMS; SECURITY OF DATA;

CLOUD COMPUTING;

EID: 84858158707     PISSN: 0167739X     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.future.2012.01.006     Document Type: Conference Paper

References (83)

1. B. Schneier, M. Ranum, 2009, Face-off: assessing cloud computing risks retrieved 9 MAY 2011, from http://searchcloudsecurity.techtarget.com/video/Face- off-Assessing-cloud-computing-risks.
2. M.M. Boroujerdi, and S. Nazem Cloud computing: changing cogitation about computing World Academy of Science, Engineering and Technology 2009 58
3. R. Buyya, C.S. Yeo, S. Venugopal, Market-oriented cloud computing: vision, hype, and reality for delivering it services as computing utilities, 2008.
4. R. Buyya, C.S. Yeo, S. Venugopal, J. Broberg, and I. Brandic Cloud computing and emerging IT platforms: vision, hype, and reality for delivering computing as the 5th utility Future Generation Computer Systems 25 6 2009 599 616
5. D. Catteddu, and G. Hogben Benefits, risks and recommendations for information security European Network and Information Security Agency (ENISA) 2009
6. D.S. Linthicum, Cloud computing and SOA convergence in your enterprise: a step-by-step guide: Addison-Wesley professional, 2009.
7. P. Mell, and T. Grance The NIST definition of cloud computing National Institute of Standards and Technology 53 6 2009
8. J. Heiser, What you need to know about cloud computing security and compliance, Gartner, Research, ID, 2009.
9. S. Subashini, and V. Kavitha A survey on security issues in service delivery models of cloud computing Journal of Network and Computer Applications 2010
10. S. Covert, Press release retrieved 20 May 2011, 2009 from http://cloud-standards.org/wiki/index.php?title=PressRelease.
11. M. Rutkowski, A. Sill, M. Edwards, L. Vreck, C. harding, P. Lipton, et al., 2011, Cloud standards wiki retrieved 20 May 2011, from http://cloud- standards.org/wiki/index.php?title=MainPage.
12. J. Archer, and A. Boehm Security guidance for critical areas of focus in cloud computing Cloud Security Alliance 2009
13. J. Archer, A. Boehme, D. Cullinane, P. Kurtz, N. Puhlmann, J. Reavis, 2010, Top threats to cloud computing, version 1.0. cloud security alliance retrieved 7 May 2011, from http://www.cloudsecurityalliance.org/topthreats/ csathreats.v1.0.pdf.
14. G. Brunette, R. Mogull, Security guidance for critical areas of focus in cloud computing V2. 1. 2009 CSA (cloud security alliance), USA, Disponible en: http://www.cloudsecurityalliance.org/guidance/csaguide, v2.1, 1.
15. CloudAudit, 2010, CloudAudit (codename: A6) retrieved 8 May 2011, from http://www.cloudaudit.org/index.html.
16. DMTF, 2011, Cloud management retrieved 21 May 2011, from http://www.dmtf.org/standards/cloud.
17. ETSI, 2011, Grid and cloud computing retrieved 21 May 2011, from http://www.etsi.org/WebSite/Technologies/GRIDCLOUD.aspx.
18. NIST, 2011, NIST cloud computing program retrieved 21 May 2011, from http://www.nist.gov/itl/cloud/.
19. OCCI, 2011, Open cloud computing interface retrieved 21 May 2011, from http://occi-wg.org/.
20. OCCI, 2011, Open cloud consortium retrieved 21 May 2011, from http://opencloudconsortium.org/working-groups/.
21. SNIA 2011, Cloud storage initiative retrieved 21 May 2011, from http://www.snia.org/forums/csi.
22. O. Arasatnam, S. Boardman, 2010, Security for the cloud and SOA retrieved 8 May 2011, from http://www.opengroup.org/soa/projects/security.htm.
23. O.C. Manifesto, Open cloud manifesto, 2009, Available online: www.opencloudmanifesto.org/Open, 20.
24. I. Foster, Y. Zhao, I. Raicu, S. Lu, Cloud computing and grid computing 360°compared, 2008.
25. T. Ferrari, and L. Gaido Resources and services of the EGEE production infrastructure Journal of Grid Computing 2011 1 15
26. A. Balaz, O. Prnjat, D. Vudragovi, V. Slavni, I. Liabotis, and E. Atanassov Development of grid e-Infrastructure in SouthEastern Europe Journal of Grid Computing 2011 1 20
27. F. Brasileiro, M. Gaudencio, R. Silva, A. Duarte, D. Carvalho, and D. Scardaci Using a simple prioritisation mechanism to effectively interoperate service and opportunistic grids in the EELA-2 e-Infrastructure Journal of Grid Computing 9 2 2011 241 257
28. K. Jeffery, H. Schubert, B. Neidecker-Lutz, The future of cloud computing opportunities for European cloud computing beyond 2010, Expert Group Report, public version, 1 2010.
29. M. Armbrust, A. Fox, R. Griffith, A.D. Joseph, R.H. Katz, A. Konwinski, et al., Above the clouds: a berkeley view of cloud computing, EECS Department, University of California, Berkeley, Tech. Rep. UCB/EECS-2009-28, 2009.
30. M.T. Khorshed, A.B.M.S. Ali, S.A. Wasimi, Monitoring insiders activities in cloud computing using rule based learning, Paper presented at the Proceedings of IEEE TrustCom-11, Nov. 1618, Changsha, China, 2011.
31. M.T. Khorshed, A.B.M.S. Ali, S.A. Wasimi, Trust issues that create threats for cyber attacks in cloud computing, Paper presented at the Proceedings of IEEE ICPADS, December 79, Tainan, Taiwan, 2011.
32. B.P. Rimal, E. Choi, I. Lumb, A taxonomy and survey of cloud computing systems, 2009.
33. G. Ness, 2009, 3 Major barriers to cloud computing retrieved 22 May 2011, from http://www.infra20.com/post.cfm/3-major-barriers-to-cloud-computing.
34. N. Leavitt Is cloud computing really ready for prime time? Growth 27 2009 5
35. J. Brodkin Gartner: seven cloud-computing security risks Infoworld 2008 1 3
36. R. Mikkilineni, V. Sarathy, Cloud computing and the lessons from the past, 2009.
37. A. Chonka, Y. Xiang, W. Zhou, and A. Bonti Cloud security defence to protect cloud computing against HTTP-DoS and XML-DoS attacks Journal of Network and Computer Applications 2010
38. C. Everett Cloud computing-a question of trust Computer Fraud & Security 6 2009 5 7
39. G. Wrenn, 2010, Unisys secure cloud addressing the top threats of cloud computing retrieved 25 May 2011, from http://www.unisys.com/unisys/common/ download.jsp?did=1120000970002010125&backurl=/unisys/ri/wp/detail. jsp&id=1120000970002010125.
40. R. Choubey, R. Dubey, and J. Bhattacharjee A survey on cloud computing security, challenges and threats International Journal on Computer Science and Engineering 2011 3
41. M. Pastaki Rad, A. Sajedi Badashian, G. Meydanipour, M. Ashurzad Delcheh, M. Alipour, and H. Afzali A survey of cloud platforms and their future Computational Science and Its ApplicationsICCSA 2009 2009 788 796
42. V. Chang, G. Wills, D. De Roure, A review of cloud business models and sustainability, 2010.
43. S. Srinivasamurthy, D. Liu, Survey on cloud computing security, 2010.
44. J. Heiser, M. Nicolett, Assessing the security risks of cloud computing, Gartner Report, 2009.
45. D. Lacey, 2010, Top threats to cloud computing? Retrieved 21 May 2011, from http://www.computerweekly.com/blogs/davidlacey/2010/03/ topthreatstocloudcomputing.html.
46. K. Choo Cloud computing: challenges and future directions Trends and Issues in Crime and Criminal Justice 2010
47. D. Svantesson, and R. Clarke Privacy and consumer risks in cloud computing Computer Law & Security Review 26 4 2010 391 397
48. E. Grosse, J. Howie, J. Ransome, J. Reavis, and S. Schmidt Cloud computing roundtable Security & Privacy, IEEE 8 6 2010 17 23
49. A.T. Monfared, Monitoring intrusions and security breaches in highly distributed cloud environments, 2010.
50. T. Andrei, R. Jain, Cloud computing challenges and related security issues, A survey paper, 2009, DOI: http://www.cse.wustl.edu/~jain/cse571-09/ftp/ cloud.pdf.
51. B. Grobauer, T. Walloschek, and E. Stcker Understanding cloud-computing vulnerabilities IEEE Security and Privacy 2010
52. J. Spring Monitoring cloud computing by layer, part 1 Security & Privacy, IEEE 9 2 2011 66 68
53. F. Rocha, M. Correia, Lucy in the sky without diamonds: stealing confidential data in the cloud, 2011.
54. M. Yildiz, J. Abawajy, T. Ercan, A. Bernoth, A layered security approach for cloud computing infrastructure, 2009.
55. R. Chow, P. Golle, M. Jakobsson, E. Shi, J. Staddon, R. Masuoka, et al., Controlling data in the cloud: outsourcing computation without outsourcing control, 2009.
56. K. Dahbur, B. Mohammad, A.B. Tarakji, A survey of risks, threats and vulnerabilities in cloud computing, 2011.
57. C. Wang, Q. Wang, K. Ren, W. Lou, Ensuring data storage security in cloud computing, 2009.
58. S.H. Shin, K. Kobara, Towards secure cloud storage, Demo for CloudCom2010, 2010.
59. L. Yan, C. Rong, and G. Zhao Strengthen cloud computing security with federal identity management using hierarchical identity-based cryptography Cloud Computing 2009 167 177
60. T. Ristenpart, E. Tromer, H. Shacham, S. Savage, Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds, 2009.
61. Amazon, 2011, Amazon elastic compute cloud (Amazon EC2) retrieved 27 June 2011, from http://aws.amazon.com/ec2/.
62. D. Danchev, 2011, Dancho Danchev's blogmind streams of information security knowledge retrieved 31 May 2011, from http://ddanchev.blogspot.com/.
63. J. Grossman, 2011, Jeremiah Grossman retrieved 19 June 2011, from http://jeremiahgrossman.blogspot.com/.
64. D. Danchev, Coordinated Russia vs Georgia cyber attack in progress, Retrieved October, 25, 2008.
65. D. Danchev, The DDoS attack against CNN. com, 2008.
66. J. Grossman Cross-site scripting worms and viruses Whitehat Security 2006
67. J. Grossman, T. Niedzialkowski, Hacking intranet websites from the outside, Talk at Black Hat USA, 2006.
68. VMware, VMware vSphere hypervisor retrieved 16 July 2011, from https://www.vmware.com/tryvmware/?p=esxi&ie=utf-8&oe=utf-8&aq= t&rls=org.mozilla:en-US:official&client=firefox-a.
69. F. Lombardi, and R. Di Pietro Secure virtualization for cloud computing Journal of Network and Computer Applications 2010
70. M. McDowell, 2009, Understanding denial-of-service attacks retrieved 21 June, 2011, from http://www.us-cert.gov/cas/tips/ST04-015.html.
71. R. McMillan, 2009, Researchers find a new way to attack the cloud retrieved 21 June 2011, from http://www.computerworld.com/s/article/9137507/ Researchersfindanewwaytoattackthecloud.
72. US-CERT, 2011, What is phishing? retrieved 22 June 2011, from http://www.us-cert.gov/nav/reportphishing.html.
73. G.H. John, P. Langley, Estimating continuous distributions in Bayesian classifiers, Paper presented at the Eleventh Conference on Uncertainty in Artificial Intelligence, San Mateo, 1995.
74. R. Lopez, and E. Onate A variational formulation for the multilayer perceptron Artificial Neural NetworksICANN 2006 2006 159 168 (Pubitemid 44561664)
75. J.C. Platt, Fast training of support vector machines using sequential minimal optimization, 1999.
76. J.R. Quinlan C4. 5: Programs for Machine Learning 1993 Morgan Kaufmann San Mateo, CA
77. E. Frank, I.H. Witten, Generating accurate rule sets without global optimization, Paper presented at the Fifteenth International Conference on Machine Learning, 1998.
78. A. James, and J. Barbara The meaning and use of the area under a receiver operating characteristic (ROC) curve Radiology 143 1982 29 36
79. J.A. Hanley, and B.J. McNeil A method of comparing the areas under receiver operating characteristic curves derived from the same cases Radiology 148 1983 839 843 (Pubitemid 13033817)
80. R. Kohavi, and F. Provost Glossary of terms Machine Learning 30 1998 271 274
81. N. Cristianini, and J. Shawe-Taylor An Introduction to Support Vector Machines: and Other Kernel-Based Learning Methods 2006 Cambridge university press
82. R.O. Duda, and P.E. Hart Pattern Classification and Scene Analysis, 1973 1973 Wiley New York
83. V.N. Vapnik Statistical Learning Theory 1998 Wiley-Interscience