## 3 Proposed Framework for Cloud Multi-Factor Multi-Layer Authentication
### Cloud MFA Algorithm for Intrusion Detection
The percentages of false-positive and false-negative rates during the manipulation of the MFA layers are used to calculate the outcomes, together with the execution duration of the generated multi-factor layers. ### Execution Time for Multi-Factor Authentication Layer

In this stage, authentication layers using the nested multi-factor methods are developed and implemented. The goal of this step is to measure the overall execution time for verifying cloud computing users based on the six major layers: factor length checking, validity of factor, factor value, checking the suspected table, user location, and browser name checking. The execution time is measured per millisecond for a different number of users per each experiment. As shown in Figure 3, the execution time for the first factor that checks the factor length increases linearly with the increasing number of users. The execution time was 218 ms with 50 users, while the time was 278 ms with 1



also showed a linear increase from 50 users to 500 users. After 500 users, the time relatively decreased, then increased again, and recorded 263 ms and 237 ms for 1000 users for both user location and browser name factors. ### Detection Performance

For most security applications and methodologies that apply different methods of protection and authentication, the measurement of detection performance is considered a major reference and guide for the efficiency of the proposed algorithms. In this section, the false-positive (FP) and false-negative (FN) rates are measured, where the false-positive rate reflects the percentage of detecting normal users as intruders, while the false-negative rate reflects the percentage of intrusions that succeed in penetrating the cloud computing services for disclosing confidential information from the cloud service platform. As presented in Figure 4, the user location and browser name recorded 2% FP for 50 users, while the remaining factors recorded 0% false alarms. With a number of 100 users, the FP percentage recorded only 1% for both factor length and factor validity. This is due to the incorrect detection of location and browser names for the users. These factors still recorded FP alarms when the number of users increased from 50 to 1000 users. For 500 users, the user location check recorded 0% FP, while the browser name recorded 0.4% FP. When the number of users increased from 600 to 1000 users, the FP rate recorded false alarms from 0.1% to a maximum of 1%. This is due to the efficiency and flexibility of the MFA methods that can correctly verify normal users. As presented in Figure 5, the false-negative (FN) percentage refers to the successful attack percentage that succeeds in disclosing secret information from the cloud service platform. As explained, the FN rate was 0% with all MFA methods for 50 users. When the number of users increased to 100, the FN rate was 0% for the four factors: factor length, factor validity, suspected table, and user location, while the FN was 1% for the factor value and browser name. For 500 users, the accuracy of the MFA methodology showed a low FN rate, with 0.4%, 0.2%, 0.8%, 0.2%, 0.2%, and 0.2% for all authentication factors. For 800 users, the accuracy also showed a low FN rate, with 0.63%, 0.25%, 0.38%, 0.25%, 0.13%, and 0.75% for all authentication factors. The remaining experiment recorded a low rate of FN for 900 and 1000 users, with the highest FN of 0.78% for the browser name check and 0.7 with the factor length check. In general, the proposed methodology and algorithm using

Figure 3: Time performance for multi-factor authentication layers. The performance evaluation of the proposed MFA framework and algorithm are conducted based on quantitative and qualitative measures to assess the success rate of attack prevention. Regarding quantitative measures, false-positive (FP) and false-negative (FN) rates are measured to identify the overall performance of the proposed MFA framework and algorithm. In addition to these quantitative metrics, Table 4 shows the following qualitative factors.