# A Survey on Intrusion Detection Systems for Fog and Cloud Computing
## 6 Intrusion Detection Overview
### Providing Strong Intrusion Detection in Edge Computing  
Edge computing is a distributed computing model that delivers computational tasks and data storage closer to data sources. The reason for this innovation in computer science is to improve response times and save bandwidth, making this method of computing highly efficient. In recent academic literature [46], intrusion detection technologies have been observed in edge computing, where the authors propose an intelligent anomaly-based intrusion detection technology for edge computing, known as Passband. The technology aims to be both hosted and executed on a typically used edge device (including an IoT gateway). The authors created a testing environment that consisted of two different scenarios to understand how the technology would behave differently and perform experiments using an IoT environment that simulates a Smart Home automation environment (typically used). After the experiments were performed in the first scenario, Passband was validated to protect all the IoT devices connected to it. In the second scenario, Passband was observed to have the ability to monitor both the incoming and outgoing traffic of all the IoT devices connected to the network. The aim is to investigate potential malicious patterns noticed in the network traffic, as Passband has been executed on the IoT gateway (A Raspberry Pi 3 Model B). Passband has also been tested against four common cyber-attacks, including Port Scanning, HTTP Brute Force, SSH Brute Force, and SYN Flood attack, which highlighted to be that the IDS can achieve scores of higher than 0.9 on some of the attacks, 0.99 in the best case and 0.79 in the worst case. Moreover, in the work of [47], an intrusion detection solution has been discussed, proposing a GAN-based intrusion detection system to provide mitigations in the CEC-based slot. This solution works by extracting network data features and using the proposed intrusion detection method to see various incoming attacks on the system and the network. The authors propose three key phases: feature extraction, an IDS model that focuses on a single attack, and an IDS model that focuses on multiple attacks using various discriminators. The proposed method begins enhancing security by preprocessing the flow and feature extraction. They then design an IDS algorithm focusing on a single attack by GAN--with the combination of multiple IDS models focusing on one attack. They also design an IDS algorithm to counter many attacks based on GAN. The researchers have evaluated their project by implementing it over two particular data sets (CSE-CIC-IDS-2018 and CIC-DDoS-2019). When addressing the results from the simulation, the overall method demonstrates the improvement and accuracy of IDS. The main contributions of the work to the field of IDS are the novel IDS method deployed in GAN, the design of an algorithm to provide high accuracy that can be used to capture different variations of attacks, and the ability to detect new attacks by training and learning of attack types. The researchers look at future research directions into the method--improving the accuracy more in the combination of neural networks and the GAN method to extract more features (spatiotemporal) of network data. The research in [48] conveyed a proposal for an IDS model for edge computing deployment and highlighted the demand for resource allocation. The paper aims to understand the method of achieving fair resource allocation in the IDS technology by covering three crucial topics, such as a virtual security network model for the edge that is made with consideration of the specific network characteristics of edge computing. The proposed model provides a division of edge networks into six layers--(1) User equipment layer; (2) Network layer; (3) Data-processing layer; (4) Detection layer; (5) Analysis layer; and (6) Management layer. Each has its own individual unique functions. The second topic is a proposition of an SDMMF allocation that adapts the characteristics of resource-constrained nodes at the edges.