Data Sources and Datasets for Cloud Intrusion Detection Modeling and Evaluation

Over the past few years cloud computing has skyrocketed in popularity within the IT industry. Shifting towards cloud computing is attracting not only industry but also government and academia. However, given their stringent privacy and security policies, this shift is still hindered by many security concerns related to the cloud computing features, namely shared resources, virtualization and multi-tenancy. These security concerns vary from privacy threats and lack of transparency to intrusions from within and outside the cloud infrastructure. Therefore, to overcome these concerns and establish a strong trust in cloud computing, there is a need to develop adequate security mechanisms for effectively handling the threats faced in the cloud. Intrusion Detection Systems (IDSs) represent an important part of such mechanisms. Developing cloud based IDS that can capture suspicious activity or threats, and prevent attacks and data leakage from both inside and outside the cloud environment is paramount. One of the most significant hurdles for developing such cloud IDS is the lack of publicly available datasets collected from a real cloud computing environment. In this chapter, we discuss specific requirements and characteristics of cloud IDS in the light of traditional IDS. We then introduce the first public dataset of its kind for cloud intrusion detection. The dataset consists of several terabytes of data, involving normal activities and multiple attack scenarios, collected over multiple periods of time in a real cloud environment. This is an important step for the industry and academia towards developing and evaluating realistic intrusion models for cloud computing.