# Secure Cloud Infrastructure: A Survey on Issues, Current Solutions, and Open Challenges
## 5 Related Existing Solutions in Cloud Levels
### Solutions at Host Level  
The authors in [89] investigated the virtual machines and hypervisor intrusion detection method, VMHIDS, as a technique in the virtualized cloud environment to detect and prevent hypervisor attacks. This method protected both the hypervisor and virtual machines from cloud environment attacks, either internal or external. The continuous hypervisor or VM monitoring with VMHIDS made it possible to analyze real-time events for automated detection and blocking malicious events. VMHIDS monitors and keeps track of each file and process that interacts with the hypervisor. As VMHIDS is placed on both VMs and hypervisors, it is easy to detect new attacks or suspected attacks on hypervisors for faster prevention. A study in [90] proposed a host-based intrusion detection model that provides security as a service at the host level in the cloud. This model alerts the host to malicious activities inside the system. Furthermore, a KNN classifier has been used to classify the system call traces that allow integration of new training documents. The result showed that the proposed method achieved high detection accuracy. The authors in [91] developed a prevention model for DDOS attacks over hypervisor environments. This model was based on host-based intrusion detection defense system. In other words, the model was based solely on IDS modeling and then incorporated into the hypervisor environment with IPS. To identify and configure the cloud server, the prevention model uses principal component analysis and linear discriminant analysis with a hybrid, nature-inspired metaheuristic algorithm named Ant Lion optimization for feature selection. An artificial neural network is then used as a classifier. The results indicate that the model was able to detect malicious activities and block the malicious IP by sending it to the blacklist. Another study in [92] suggested a framework to decrease the co-located VM attack on the same hypervisor. This was done by implementing virtual machine security policies when an illegal transfer or copy of live VMs into a suspicious hypervisor occurs. The preset data traffic rate monitoring between two VMs and the VSwitch node helped to detect VM confusion at a particular time point. The results show that the framework decreases the risk associated with the VM running upon this suspected hypervisor. This framework, however, focused only on the live migration from one hypervisor to another hypervisor of single VMs. A study in [34] proposed various ways to secure the servers by using IDS, by storing hashed values, as the data in the cloud are naturally plaintext. The study suggested that multiple applications that run on single servers must be separated. Furthermore, the threshold that monitors server load and prevents DOS attacks should be determined. Finally, data replication is necessary to ensure the availability of data and that the server works all of the time. In [93], the authors proposed an in-and-out-of-the-box virtual machine and hypervisor by using a prevention system and intrusion detection. The goal of this work was to detect vulnerabilities including persistent attacks such as DoS attacks and stealthy self-hiding rootkits. The experiments were conducted on the open-source host that is based on IDS, also known as Open-Source Security Event Correlator (OSSEC). The experimental results show that OSSEC IDS effectively detects rootkits and DoS attacks in both Linux and Windows operating systems. A study in [94] discussed the virtualization issues in cloud computing infrastructure. According to the study, the major threats for cloud infrastructure are distributed side-channel attacks that can be used to exploit sensitive information from various parts of a distributed system. Furthermore, they sketched an approach for the reduction in side-channel attacks utilizing an autonomic system. The researchers in [95] suggested a framework that used the VM monitoring script to obtain the status of the VMs to defend the VMs from an attack.