# A Survey on Intrusion Detection Systems for Fog and Cloud Computing
## 4 Intrusion Detection and Prevention Systems  
### Review of Intrusion Detection and Prevention  
[PERSON] et al. [25] explore how the expansion of the internet has developed into a world of interconnectivity. This expansion has led to malicious attacks against networked systems being more commonplace. These attacks typically begin with an offensive actor using sensors to scan the network, searching for a vulnerable host, then escalating to further breaches on the target network. As the attack progresses, more sophisticated techniques are usually applied. [PERSON] et al. [26] describe advanced techniques for attackers utilizing distributed attack bases and obfuscating their network identifications. Therefore, countermeasures, IDS included, require increasingly sophisticated approaches. For example, [PERSON] et al. [27] consider a machine-learning approach to develop an intrusion detection and prevention system used for wireless sensor networks on the Internet of Things (IoT). While many machine-learning solutions are computationally expensive, they propose an anomalous intrusion detective protocol (AIDP) utilizing a small attack and fault detection system. The protocol works in three stages: learning, trading, and refreshing. The experience values change depending on the cautions (TAFDS) in the learning stage. Every hub sends its experience estimates to its neighbors in the trading stage. Finally, in the refreshing stage, the standing is refreshed depending on the expertise estimates and trust is refreshed according to the new standing. Further work has been produced by [PERSON] and [PERSON] [28], where they investigated the security challenges in adopting IoT for smart networks. These authors highlight different attack methods using a layered approach: the first layer is the 'Perception Layer', which includes physical damage, jamming, and malicious code injection. The 'Network Layer' includes traffic analysis, flooding, spoofing, and router attacks. The 'Application Layer' includes malware attacks, code injection, and social engineering, and finally, the 'Multi-Layer Attacks' include cryptanalytic attacks, spyware, and distributed denial-of-service (DDoS) attacks. In further work [29], [PERSON] et al. present a software-defined intrusion detection system assisted via networking. The intrusion detection system they ran was Snort, and multiple concurrent Snort processes ran on the same infrastructure. It works by forwarding the malicious data into the SDN controller, which moves data to specific points of an SDN in order to inspect it. This SDN device runs through a docker container on the GNS3 virtual machine, handling the connection of different hosts within the SDN. [PERSON] et al. [15] investigate the current state of the art and future challenges with the protocols used for intrusion detection and prevention systems in networks using wireless sensors and their integration into the Internet of Things deployment. Their research examines the many security requirements of wireless sensor networks and IoT, focusing on key security properties, including authentication, integrity, confidentiality, non-repudiation, authorization, freshness, availability, forward secrecy, and backwards secrecy. Moreover, they consider common security attacks in wireless sensor networks and IoT-based communication. They use a layered approach for defining attacks and the study investigates the requirements of deploying an intrusion detection system to mitigate threats in this environment, including successful, careful, and strategic deployment. The overall system should be reliable, producing fewer false negatives and false positives. Hence, the system should not cause harm and expose other vectors of attack. It should also have an economical deployment, not using more network and system resources. [PERSON] et al. [13] examine the current intrusion detection and prevention processes in service-oriented vehicular networks.