Proactive Security Auditing in Clouds

In this chapter, we present an automated learning-based proactive auditing system, namely LeaPS, which automatically learns probabilistic dependencies, and hence, addresses the inefficiencies of existing solutions. To this end, we describe a log processor, which processes (as discussed later) real-world cloud logs and prepares them for different learning techniques (e.g., Bayesian network and sequence pattern mining) to allow capturing dependency relationships. Unlike most learning-based security solutions, since we are not relying on learning techniques to detect abnormal behaviors, we avoid the well-known limitations of high false positive rates; any inaccuracy in the learning phase would only affect the efficiency, as will be demonstrated through experiments later in this chapter. We believe this idea of leveraging learning for efficiency, instead of security, may be adapted to benefit other security solutions. As demonstrated by our implementation and experimental results, LeaPS provides an automated, efficient, and scalable solution for different cloud platforms to increase their transparency and accountability to tenants.