## 5 DoS and DDoS Defense
### Attack Mitigation
A node contains the resources (through middleware), the service provides functionality, the event auditor monitors the data to analyze and the storage service uses behavior and knowledge analysis: data mining, artificial neural networks, artificial immunological systems and expert systems. Data from both the logs and the communication systems are used to evaluate the Knowledge-Based System. A series of rules was created to build a security policy that should be respected. IDS and Cloud Fusion Unit. ** [PERSON] et al. [PERSON] et al. (2019) propose a solution to combine IDSs deployed in VMs of the Cloud system with a data fusion methodology at the front-end using the Dempster's combination rule (Dempster-Shafer Theory DST). The IDSs are installed and configured in each VM. A MySQL database is installed in the Cloud Fusion Unit (CFU) of the front-end server. An alert in IDSs will be stored in the database. The Cloud Fusion Unit (CFU) comprises three components: a MySQL database (storing the alerts), basic probabilities assignment calculation operations and attacks assessment. Their solution is not associated with any experimentation. IDS and Queueing Theory. ** [PERSON] et al. [PERSON] et al. (2019) propose an Intrusion Prevention System (IPS) between a Cloud data center and the internet to monitor incoming packets. To mitigate DoS or DDoS attacks on individual Cloud customers, the mechanism will automatically and dynamically allocate extra resources from the available Cloud resources pool. A queuing theory is used to estimate the resource allocation. The mitigation problem is an optimization problem: minimizing the resource investment (CPU, memory, IO, bandwidth) while guaranteeing the average time in the system of packets. However, some statements in the paper are false: (1) the attack capability of a botnet is usually limited. Consequently, the authors find it reasonable to expect that a Cloud can manage its reserved or idle resources to meet demand; (2) all attack packets are filtered and all legitimate packets go through the IPS system. Firewalls. ** [PERSON] et al. [PERSON] et al. (2019) explain that firewalls protect the front access points of Clouds and are treated as the first line of defense. Firewalls filter (1) by inspecting only header information such as source or destination address and the port number; (2) with a state table (request and server responses); and (3) by analyzing the protocol syntax by breaking off the client/server connection. [PERSON] et al. [PERSON] et al. (2019) propose a framework that web servers in virtual machine access by internet gateway and virtual switch. With a covariance matrix of normal traffic, the virtual switch can find the IP addresses from where the attacks originated. Then, the virtual switch blocks the IP addresses that perpetrated the attacks with a honeypot network. The authors suppose that the IP addresses at the origin of the attacks are not spoofing. Clusterized firewall. [PERSON] et al. [PERSON] et al. (2019) propose a clusterized firewall framework for Cloud Computing. They divide the Cloud services into application layers in which the servers are grouped into clusters, for a type of Cloud data service center. Each cluster has a firewall. The firewall for each cluster protects applications according to the arrival rate and thus guarantees QoS for legitimate users. Each cluster can be modeled as an M/G/1 queueing system to obtain the key measures: (1) the request response time and (2) how many resources are needed to guarantee the QoS. These key metrics evaluated the Cloud defense. Statistical machine learning.With statistical machine learning techniques, [PERSON] et al. [PERSON] et al. (2019) propose a Support Vector Machine technique to identify top attacks. It should also warn the system administrators and data owners of the type of attack and suggest possible actions to take. Eventually, customers would be aware of the attack type even if Cloud providers are reluctant to divulge information about the attack. Traceback and Cloud filter.Yang et al. [PERSON] et al.