A centralized HIDS framework for private cloud

Cloud computing is more convenient and efficient than traditional on-premise computing for users, as it provides large scale resources, software, and information to each customer. However, cloud computing systems can be easily threatened by various cyber attacks. Therefore, an Intrusion Detection System (IDS) is very necessary for cloud computing system. There is a serious problem which traditional host-based IDS for cloud computing consumes a large amount of system resources. In this paper, we propose a centralized host-based IDS framework to reduce the use of the resources. Using logstash tool to collect the system logs from each virtual machine, and storing them into elasticsearch cluster centrally. After that, we analyze all these logs in the detection center and send the results to each virtual machine. We have validated our framework in the openstack platform. The results show a good performance in reducing the CPU and memory usage.