A survey on security issues and solutions at different layers of Cloud computing <s> Network level security issues <s> In recent years, distributed denial-of-service (DDoS) and denial-of-service (DoS) are the most dreadful network threats. Single-node IDS often suffers from losing its detection effectiveness and capability when processing enormous network traffic. To solve the drawbacks, we propose grid-based IDS, called grid intrusion detection system (GIDS), which uses grid computing resources to detect intrusion packets. For balancing detection load, score subtraction approach (SSA) and score addition approach (SAA) are deployed. Furthermore, to effectively detect intrusions, a two-phase packet detection process is proposed. The first phase detects logical and momentary attacks. Chronic attacks are detected in the second phase. Experiments are also performed and the results show that GIDS is truly an outstanding system in detecting attacks. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Network level security issues <s> Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To provide secure and reliable services in cloud computing environment is an important issue. One of the security issues is how to reduce the impact of denial-of-service (DoS) attack or distributed denial-of-service (DDoS) in this environment. To counter these kinds of attacks, a framework of cooperative intrusion detection system (IDS) is proposed. The proposed system could reduce the impact of these kinds of attacks. To provide such ability, IDSs in the cloud computing regions exchange their alerts with each other. In the system, each of IDSs has a cooperative agent used to compute and determine whether to accept the alerts sent from other IDSs or not. By this way, IDSs could avoid the same type of attack happening. The implementation results indicate that the proposed system could resist DoS attack. Moreover, by comparison, the proposed cooperative IDS system only increases little computation effort compared with pure Snort based IDS but prevents the system from single point of failure attack. <s> BIB002 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Network level security issues <s> “Cloud Computing”, a new wave in the Internet revolution, transforms the kind of services provided over the Internet. The Cloud Services can be viewed from two perspectives, one as Cloud Service Provider and the other as Cloud Service Consumer. Assurance of security in the Cloud Service is a major challenge for the Providers, as it’s the biggest concern for the Consumers to opt for the service, which in turn decides the prospects of the business in Cloud Service. The Security can be administered in the Cloud at various levels and for several types of attacks. The threats and the attacks on the Cloud service can be common prevailing attacks in the internet or can be cloud specific. This paper deals about the threats and the counter measures of the prevailing DDoS attacks on the Cloud Environment as well as the Cloud Specific Vulnerabilities to these attacks. In specific, HTTP and XMLbased DDoS attacks on the cloud service are experimented under proposed security framework for EDoS Protection. A Cloud Service was hosted on Amazon EC2. The Service was targeted by HTTP, XML DDoS attacks from several nodes, which lead to the scaling of the service by consuming more Amazon EC2 resources, which in turn lead to Economic Denial of Sustainability to the Cloud Service under attack. Thus this paper explores the transformation of traditional Distributed denial-of-service (DDoS) attack into cloud specific Economic Denial of Sustainability (EDoS) attack. <s> BIB003 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Network level security issues <s> In this paper, we survey different intrusions affecting availability, confidentiality and integrity of Cloud resources and services. Proposals incorporating Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in Cloud are examined. We recommend IDS/IPS positioning in Cloud environment to achieve desired security in the next generation networks. <s> BIB004 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Network level security issues <s> Cloud Computing is the newly emerged technology of Distributed Computing System. Cloud Computing user concentrate on API security & provide services to its consumers in multitenant environment into three layers namely, Software as a service, Platform as a service and Infrastructure as a service, with the help of web services. It provides service facilities to its consumers on demand . These service provided can easily invites attacker to attack by Saas ,Paas, Iaas. Since the resources are gathered at one place in data centers in cloud computing, the DDOS attacks such as HTTP & XML in this environment is dangerous & provides harmful effects and also all consumer will be affected at the same time. These attacks can be resolved & detected by a proposed methodology, “Securing cloud from DDOS attacks using intrusion detection system in virtual machine”.In this methodology, this problem can be overcome by using proposed system. The different kinds of vulnerabilities are detected in proposed system. The SOAP request makes the communication between the client and the service provider. Through the Service Oriented Traceback Architecture the SOAP request is send to the cloud. In this architecture service oriented trace back mark is present which contain proxy within it. The proxy that marks the incoming packets with source message identification to identify the real client. Then the SOAP message is travelled via XDetector. The XDetectors used to monitors and filters the DDoS attacks such as HTTP and XML DDoS attack. Finally the filtered real clinet message is transferred to the cloud service provider and the corresponding services is given to the client in secured manner . <s> BIB005
The network is the backbone of Cloud, and hence vulnerabilities in network directly affect the security of Cloud. As shown in Fig. 4 , security issues at network level should be considered in terms of both external and internal networks. An adversary outside the Cloud network often performs DoS or DDoS attacks to affect the availability of Cloud services and resources. DoS/DDoS attacks reduce the bandwidth and increases the congestion causing poor service to the users. Due to the distributed nature of the Cloud, it is hard to prevent DoS/DDoS and Economic Denial of Sustainability (EDoS can be called as HTTP and XML based DDoS) BIB003 attacks. Some common attacks at the network layer are DNS poisoning attack, Sniffer attack, Port scanning, Cross site scripting, ARP spoofing, IP spoofing, and phishing attack, which are executed to gain access of Cloud resources. Internal network attacker (authorized users or users within the cloud network) can easily get access to other user's resources without being detected. An insider has higher privileges and knowledge (related to network, security mechanism, and resources to attack) than the external attacker. Therefore, it is easy for an insider to penetrate an attack than external attackers. Major security issues at network level include vulnerabilities in Internet protocols, authorization, and authentication, intrusions, backdoor attack, session hijacking, and clear data transmission. To address some of the issues at the network level, major Cloud providers (like Amazon, Window Azure, Rack Space, Eucalyptus, etc.) are running their applications behind firewall. However, it only provides security at boundary of network and cannot detect the internal attacks. Network based intrusion detection system (NIDS) can be integrated to address some of the security issues. However, a NIDS should be configured for detecting external intrusions as well as internal intrusions. It should also be capable of detecting intrusions from encrypted traffic. In the following, we see the existing research efforts to address network security issues in Cloud. Through experiments and implementation, the authors in  surveyed about the security solutions that can be applied to detect ARP spoofing attacks. They concluded that XArp 2 [70] tool is an efficient security solution that can accurately detect ARP spoofing attacks. In BIB004 , we discussed existing NIDS approaches to Cloud. For example, Lo et al. BIB002 introduced a snort based intrusion detection system framework BIB002 for Cloud system. As shown in Fig. 5 [30] , an IDS module is installed on each region of Cloud environment. If an intrusion is detected at any region, it alerts other regions by using a cooperative agent. Other regions cooperatively compute severity of that and then differentiate it as an attack or normal activity based on a threshold. This approach is suitable for preventing Cloud system from single-point-of-failure caused by DDoS attack. However, it needs substantial computational effort. Bakshi and Yogesh BIB005 proposed a method to secure VMs in Cloud from DDoS attack using an IDS. In this approach, Snort based NIDS tool is installed on the VM. If any suspicious activity is detected, it notifies the source IP of that activity and blocks packets coming from that IP. If DDoS attack is found, it transfers the service running on affected VM to another VM and blocks all the packets. Mazzariello et al.  presented Snort based misuse detection in open source Eucalyptus Cloud environment. In this approach, Snort is deployed at a primary controller managing cloud instances called cloud controller as well as on the physical machines (hosting virtual machines) to detect intrusions coming from external networks. This approach solves the problem of deploying multiple instances of IDS. Although it is a fast and cost effective solution, it can only detect known attacks since only Snort is involved. Sandar et al. BIB003 introduced a new type of DDoS attack, called Economic Denial of Sustainability (EDoS) in Cloud services and proposed a solution framework for EDoS protection. EDoS attack can be called as HTTP and XML based DDoS attack. EDoS protection framework uses firewall and puzzle server to detect EDoS attack. A firewall is used to detect EDoS at the entry point of Cloud, whereas the puzzle server is used to authenticate the user. In this work, the authors demonstrated the EDoS attack in Amazon EC2 Cloud. However, it is not an efficient solution since it uses only traditional firewalls. Research is still needed to detect EDoS attacks in the Cloud. Lue et al. BIB001 integrate an intrusion detection system into a Grid, which uses existing grid resources for detecting strong DDoS attacks. In this approach, traffic from multiple switches is collected by multiple dispatchers and is sent for intrusion detection using scheduler. Scheduler forwards that traffic to the intrusion detector, if load on any detector is low. This solution is used to overcome possible performance bottlenecks and deals with the distribution of load, which requires several nodes to be utilized. To overcome limitations existing in above presented approaches, further work related to NIDS is needed to provide fully secure network environment in the Cloud. One another challenging problem related to the Cloud-NIDS is the monitoring and capturing of the network traffic. This is due to the multi-tenancy and distributed nature of Cloud computing.