# Enhancing Cloud Computing Analysis: A CCE-Based HTTP-GET Log Dataset
## 2 Background
### Dataset Representations
#### 2.4.3 Hybrid Representation  
The hybrid representation combines the characteristics of both network-traffic-based and log-based representations by merging two or more datasets to evaluate the IDSs. These datasets may use the same category of representation or a different category. However, this approach has some disadvantages, such as potential conflicts in the detection systems due to the heterogeneity of the data types.  
Each representation has its advantages and disadvantages. Table 1 highlights their pros and cons to comprehensively overview the three dataset representations.  
A detection system that uses network-traffic-based and hybrid-based representations can identify various types of attacks on CCEs, including HTTP-GET flood DDoS attacks. However, these systems can be inefficient and sluggish due to the large traffic volume to be inspected. On the other hand, log-based representations also comprise information to detect attacks, especially HTTP-GET flood DDoS attacks on CCEs. Therefore, log-based datasets can help detect HTTP-GET flood DDoS attacks and generate similar attack indicators but are faster than network-traffic-based ones. Therefore, a log-based representation is preferable for detecting this type of attack in the CCE security domain.  
Considering the limitations of network-traffic-based and hybrid-based representations and the capabilities of log-based representation, we decided to use a log-based representation to create the proposed datasets for HTTP-GET flood DDoS attacks on CCEs.  
\begin{table}
\begin{tabular}{p{56.9 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Representation** & **Advantage** & **Disadvantage** \\ \hline Network-Traffic-based & - Data for the detection system are readily available, making preprocessing unnecessary. & - The detection system must inspect every packet received; it requires preprocessing to produce flows. \\  & & - It exposes confidential packet information, and fewer packet details are available. \\  & & - It is impossible to match attack signatures with encrypted payload cases, making it ineffective for attack detection. \\  & & - In the case of massive datasets, representing CCE traffic is difficult. \\  & & - It is unable to represent enough relevant (valuable) information for all attacks. \\  & & - Can be extensive in size. \\ \hline Log-based & - Data for the detecting system are readily available, making preprocessing unnecessary. & - Can be extensive in size. \\  & - Generally contains more information, which includes more attack features. & - Can be extensive in size. \\  & - There are no privacy issues. & - Scalable and adaptable in high-speed CCEs. \\  & - No encrypted data or payload to affect the detection system’s operation. & - Represents relevant (valuable) information for attacks. \\ \hline Hybrid-based & - Includes more attack features. & - Conflict in detection systems from two different types of representation. - Increased computation load in detection systems to process two types of representation. - High False Positive rate and low True Negative rate in detection systems. - Conflict and complexity in most attacks’ relevant (valuable) information. - Can be extensive in size. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison between network-traffic-based, log-based, and hybrid-based representations.