Intrusion detection method based on alert correlation and behavioral clustering in cloud environments

Intrusion detection against botnets is a crucial topic in network security. In this paper, we propose an alert association and behavior clustering-based method for intrusion detection in the cloud environments (ASBCID). The ASBCID method collects intrusion detection evidence based on several typical stages of host infection, develops the alert association strategies, and then designs behavior graph templates based on alert association to represent the behavior of each virtual machine (VM) as a graph. In addition, the ASBCID method divides VMs with similar behavior graphs into the same cluster by K-means clustering algorithm, develops behavior graph templates for each cluster, and employs a distributed architecture to detect Bot in each cluster to improve detection efficiency. At length an intrusion detection mechanism is constructed to achieve the final result by matching the current behavior graph with the behavior graph template by using similarity score and AdaBoost algorithms. We performed a simulation to verify the proposed algorithm compared with BotDet and BotHunter algorithms and the simulation results showed that ASBCID method can effectively reduce the false alarm rate as well as improve the computational efficiency, suitable for cloud environments.