Event-driven multi-tenant intrusion detection system

Abstract

Due to the creative services offered on-demand with cost-efficiency and reliability, cloud computing has been used by multi-tenant providers. The tenants share cloud resources, for instance, the IaaS, PaaS, and SaaS. Although these services are easily provided to tenants on-demand with minor infrastructural investment, they are significantly exposed to intrusion attempts because the services are offered under the administration of diverse supervision over the internet. Thus, there is a need to have a security mechanism that is able to protect multi-tenant clouds. With this context, a cloud provider has to provide security mechanisms capable of protecting the tenant’s resources. However, with all existing security approaches, tenants’ requirements have been largely neglected. From these premises, in this thesis, we propose a novel security mechanism named Multi-tenant Intrusion detection System that targets primarily the IaaS cloud. The proposed solution involves: (1) providing an optimized IDS system that first enables tenants to select the security services that meet their needs and second, that automatically adapts to the changes (activating/deactivating the security services) that occur in the tenants’ environments. (2) providing an anomaly-intrusion detection system that is capable of detecting intrusive attacks and ensuring the extraction of valuable information from the monitored network that is used to automatically generate new customized signatures. (3) providing an event-driven real-time anomaly IDS that is able to overcome the limitation of the traditional IDS by enabling continuous update to the anomaly IDS to detect new threats. It enables tenants who have same interests to share new generated anomaly IDS classifiers, which they use to detect new threats.

Date	9 Oct 2019
Original language	American English
Awarding Institution	École de technologie supérieure
Supervisor	Chamseddine Talhi (Supervisor) & Hanifa Boucheneb (Co-supervisor)