Automatic Reconfiguration of NIDSs in IaaS Clouds with SAIDS

Infrastructure as a Service (IaaS) clouds are very dynamic with at runtime frequent changes at different levels of the virtual infrastructure. For cloud tenants, this affects the ability of a security monitoring framework to successfully detect attacks. In this paper, we propose SAIDS, a self-adaptable intrusion detection system for IaaS clouds that is able to adapt its components based on dynamic events that occur in a cloud infrastructure. We implemented and experimentally evaluated SAIDS, and show that it is a scalable solution that successfully detects attacks even during the adaptation process while imposing negligible overhead to cloud operations and tenant applications.