An intelligent behavior-based intrusion detection method for virtual machines

Today, applications of the virtualization technology are rapidly growing in which setting up and running multiple operating systems on a single physical system. Computational clouds are the most hallmark of this technology. Intrusion detection systems play a key role in protecting cloud resources on virtual machines. Regarding the increasing speed and complexity of these machines, it is necessary to increase the ability and accuracy of intrusion detection systems to identify different types of attacks at the right time. In this regard, the use of behavior-based approaches has attracted more attention due to their high scalability in large networks. The methods for intrusion detection that utilizes network traffic graph clustering do not have the accuracy and appropriateness with the speed of data transfer in the current computer networks. Thus, the solutions can be improved by choosing an appropriate strategy for clustering. In this paper, a new behavior-based method for detecting intrusion in computer networks is presented. To this end, the network data was modeled through the flow of data as a traffic distribution graph and then clustered using an improved Markov-based algorithm. Then, the produced clusters are used to construct an intrusion detection model by analyzing a set of modified statistical criteria. The proposed model was examined and evaluated on the DARPA 99 dataset and compared with seven other robust methods. The results show that the proposed method detects attacks with high accuracy and works better than the methods which do not use the graph clustering.