Open Access

ARTICLE

Adaptive Cloud Intrusion Detection System Based on Pruned Exact Linear Time Technique

by Widad Elbakri¹, Maheyzah Md. Siraj^1,*, Bander Ali Saleh Al-rimy¹, Sultan Noman Qasem², Tawfik Al-Hadhrami³

1 Faculty of Computing, Universiti Teknologi Malaysia, Johor Bahru, Johor, 81310, Malaysia
2 Computer Science Department, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh, 11432, Saudi Arabia
3 School of Science and Technology, Nottingham Trent University, Nottingham, NG11 8NS, UK

* Corresponding Author: Maheyzah Md. Siraj. Email:

(This article belongs to the Special Issue: Multimedia Encryption and Information Security)

Computers, Materials & Continua 2024, 79(3), 3725-3756. https://doi.org/10.32604/cmc.2024.048105

Received 28 November 2023; Accepted 26 March 2024; Issue published 20 June 2024

Abstract

Cloud computing environments, characterized by dynamic scaling, distributed architectures, and complex workloads, are increasingly targeted by malicious actors. These threats encompass unauthorized access, data breaches, denial-of-service attacks, and evolving malware variants. Traditional security solutions often struggle with the dynamic nature of cloud environments, highlighting the need for robust Adaptive Cloud Intrusion Detection Systems (CIDS). Existing adaptive CIDS solutions, while offering improved detection capabilities, often face limitations such as reliance on approximations for change point detection, hindering their precision in identifying anomalies. This can lead to missed attacks or an abundance of false alarms, impacting overall security effectiveness. To address these challenges, we propose ACIDS (Adaptive Cloud Intrusion Detection System)-PELT. This novel Adaptive CIDS framework leverages the Pruned Exact Linear Time (PELT) algorithm and a Support Vector Machine (SVM) for enhanced accuracy and efficiency. ACIDS-PELT comprises four key components: (1) Feature Selection: Utilizing a hybrid harmony search algorithm and the symmetrical uncertainty filter (HSO-SU) to identify the most relevant features that effectively differentiate between normal and anomalous network traffic in the cloud environment. (2) Surveillance: Employing the PELT algorithm to detect change points within the network traffic data, enabling the identification of anomalies and potential security threats with improved precision compared to existing approaches. (3) Training Set: Labeled network traffic data forms the training set used to train the SVM classifier to distinguish between normal and anomalous behaviour patterns. (4) Testing Set: The testing set evaluates ACIDS-PELT’s performance by measuring its accuracy, precision, and recall in detecting security threats within the cloud environment. We evaluate the performance of ACIDS-PELT using the NSL-KDD benchmark dataset. The results demonstrate that ACIDS-PELT outperforms existing cloud intrusion detection techniques in terms of accuracy, precision, and recall. This superiority stems from ACIDS-PELT’s ability to overcome limitations associated with approximation and imprecision in change point detection while offering a more accurate and precise approach to detecting security threats in dynamic cloud environments.

---

Keywords

---