How to Cite This Article
Abstract
Cloud computing has emerged as a fundamental architecture to store data, deploy applications and provide scalable digital services. Due to the distributed nature of cloud computing, resource sharing, and dynamic workload conditions, there are substantial security issues associated with cloud computing; especially in terms of detecting and responding to complex network-based intrusions. Conventional intrusion detection systems are generally limited by maintaining high levels of detection accuracy with short response times and providing understandable explanations of their decisions. This research will address the balance of detection accuracy and response time through the use of an explainable artificial intelligence (XAI)-based cloud intrusion detection framework. We propose a conceptual framework that combines machine learning-based anomaly detection, real-time event processing, and explainability methods to detect suspicious activity and enable timely responses to potential security incidents. We plan to utilize lightweight feature selection, optimized model inference, and explanation generation as complementary elements for increasing operational efficiency. In addition to our conceptual framework, we intend to utilize evaluation metrics such as accuracy, precision, recall, F1-score, false-positive rate, detection latency, and explanation overhead to assess the performance of our framework. Our research will investigate the relationship between predictive performance, computational resources needed, and interpretability in order to create a systematic method for assessing the performance of AI-powered cloud security systems. Our goal is to develop a transparent, timely, and dependable intrusion detection system without sacrificing security functions. To validate the viability of our conceptual framework in real world cloud settings, experimental evaluations using representative cloud intrusion data sets and realistic workloads will be conducted.
Keywords
Explainable AI, Cloud Security, Intrusion Detection, Machine Learning, Detection Accuracy, Response Time, Anomaly Detection, Feature Selection, Real-Time Processing, Cybersecurity.
- [1] Aldweesh, A., Derhab, A. and Emam, A.Z. (2020) ‘Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues’, Knowledge-Based Systems, 189, article 105124.
- [2] Buczak, A.L. and Guven, E. (2016) ‘A survey of data mining and machine learning methods for cyber security intrusion detection’, IEEE Communications Surveys & Tutorials, 18(2), pp. 1153–1176.
- [3] Chandola, V., Banerjee, A. and Kumar, V. (2009) ‘Anomaly detection: A survey’, ACM Computing Surveys, 41(3), article 15.
- [4] Chio, C. and Freeman, D. (2018) Machine Learning and Security: Protecting Systems with Data and Algorithms. Sebastopol, CA: O’Reilly Media.
- [5] Diro, A.A. and Chilamkurti, N. (2018) ‘Distributed attack detection scheme using deep learning approach for Internet of Things’, Future Generation Computer Systems, 82, pp. 761–768.
- [6] Ferrag, M.A., Maglaras, L., Moschoyiannis, S. and Janicke, H. (2020) ‘Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study’, Journal of Information Security and Applications, 50, article 102419.
- [7] Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G. and Vázquez, E. (2009) ‘Anomaly-based network intrusion detection: Techniques, systems and challenges’, Computers & Security, 28(1–2), pp. 18–28.
- [8] Goodfellow, I., Bengio, Y. and Courville, A. (2016) Deep Learning. Cambridge, MA: MIT Press.
- [9] Gunning, D. and Aha, D. (2019) ‘DARPA’s explainable artificial intelligence (XAI) program’, AI Magazine, 40(2), pp. 44–58.
- [10] Han, J., Kamber, M. and Pei, J. (2012) Data Mining: Concepts and Techniques. 3rd edn. Waltham, MA: Morgan Kaufmann.
- [11] Hochreiter, S. and Schmidhuber, J. (1997) ‘Long short-term memory’, Neural Computation, 9(8), pp. 1735–1780.
- [12] Khraisat, A., Gondal, I., Vamplew, P. and Kamruzzaman, J. (2019) ‘Survey of intrusion detection systems: Techniques, datasets and challenges’, Cybersecurity, 2, article 20.
- [13] Kim, G., Lee, S. and Kim, S. (2014) ‘A novel hybrid intrusion detection method integrating anomaly detection with misuse detection’, Expert Systems with Applications, 41(4), pp. 1690–1700.
- [14] LeCun, Y., Bengio, Y. and Hinton, G. (2015) ‘Deep learning’, Nature, 521, pp. 436–444.
- [15] Lundberg, S.M. and Lee, S.-I. (2017) ‘A unified approach to interpreting model predictions’, in Advances in Neural Information Processing Systems 30. Red Hook, NY: Curran Associates, pp. 4765–4774.
- [16] Moustafa, N. and Slay, J. (2015) ‘UNSW-NB15: A comprehensive data set for network intrusion detection systems’, in 2015 Military Communications and Information Systems Conference (MilCIS). Piscataway, NJ: IEEE, pp. 1–6.
- [17] Patcha, A. and Park, J.-M. (2007) ‘An overview of anomaly detection techniques: Existing solutions and latest technological trends’, Computer Networks, 51(12), pp. 3448–3470.
- [18] Ribeiro, M.T., Singh, S. and Guestrin, C. (2016) ‘“Why should I trust you?” Explaining the predictions of any classifier’, in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, pp. 1135–1144.
- [19] Ring, M., Wunderlich, S., Scheuring, D., Landes, D. and Hotho, A. (2019) ‘A survey of network-based intrusion detection data sets’, Computers & Security, 86, pp. 147–167.
- [20] Sarker, I.H. (2021) ‘Machine learning: Algorithms, real-world applications and research directions’, SN Computer Science, 2, article 160.
- [21] Scarfone, K. and Mell, P. (2007) Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. Gaithersburg, MD: National Institute of Standards and Technology.
- [22] Sommer, R. and Paxson, V. (2010) ‘Outside the closed world: On using machine learning for network intrusion detection’, in 2010 IEEE Symposium on Security and Privacy. Piscataway, NJ: IEEE, pp. 305–316.
- [23] Shone, N., Ngoc, T.N., Phai, V.D. and Shi, Q. (2018) ‘A deep learning approach to network intrusion detection’, IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), pp. 41–50.
- [24] Sharafaldin, I., Lashkari, A.H. and Ghorbani, A.A. (2018) ‘Toward generating a new intrusion detection dataset and intrusion traffic characterization’, in Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP). Setúbal: SciTePress, pp. 108–116.
- [25] Tjoa, E. and Guan, C. (2021) ‘A survey on explainable artificial intelligence (XAI): Toward medical XAI’, IEEE Transactions on Neural Networks and Learning Systems, 32(11), pp. 4793–4813.
- [26] Sommer, R. and Paxson, V. (2010) ‘Outside the closed world: On using machine learning for network intrusion detection’, Proceedings of the IEEE Symposium on Security and Privacy, pp. 305–316.
- [27] Vinayakumar, R., Alazab, M., Soman, K.P., Poornachandran, P. and Venkatraman, S. (2019) ‘Robust intelligent malware detection using deep learning’, IEEE Access, 7, pp. 46717–46738.
- [28] Xu, W., Wang, J., Zhang, Y. and others (2019) ‘A survey on deep learning for network intrusion detection’, IEEE Access, 7, pp. 1–20.
- [29] Zhou, Y., Cheng, G., Jiang, S. and Dai, M. (2020) ‘Building an efficient intrusion detection system based on feature selection and ensemble classifier’, Computer Networks, 174, article 107247.
- [30] Zolanvari, M., Teixeira, M.A., Gupta, L., Khan, K.M. and Jain, R. (2019) ‘Machine learning-based network vulnerability analysis of industrial Internet of Things’, IEEE Internet of Things Journal, 6(4), pp. 6822–6834.