# Securing Infrastructure-as-a-Service Public Clouds Using Security Onion
## 1 Introduction  
Cloud computing is a model for delivering on-demand computing services over the Internet [1]. It allows individuals and businesses to run applications on shared data centers instead of running them in private data centers. These shared data centers can be accessed by connecting to the Cloud network, making the application process starts quicker and more cost effective.  
Although Cloud computing is providing numerous benefits, there are some barriers hindering its complete adoption by most organizations. The main concern of these organizations is the security and privacy of their data and information [2; 3; 4; 5]. Cloud computing is a combination of various other technologies: Virtualization, service-oriented architecture (SOA), and Web 2.0 [6]. As well as the benefits of these underlying technologies, their security limitations are also inherited [7].  
The framework of Cloud computing supports distributed service-oriented models, multi-domain and multi-user administrative infrastructure; as a result, it is very prone to various security threats and vulnerabilities. Because Cloud computing is based on a distributive architecture and is a relatively new computing paradigm, there is a reservation surrounding how security at all level (i.e., network, host, application and data levels) can be achieved [5; 7]. This reservation has led company executives to remark that security of information is the biggest concern with Cloud computing [8].  
A standard security mechanism to protect a Cloud computing environment is by the use of intrusion detection system (IDS). An IDS monitors enterprise computing and network environment and gives alerts on suspicious activities [9]. Traditionally, most IDS are host-based (HIDS) where IDS closely monitor specific host machines in a network. Another type of IDS is the network-based (NIDS) where IDS identifies an intrusion on main network nodes. While the use of an IDS does not guarantee and cannot be considered an absolute defense against intruders, it can play a major role in the security architecture of Cloud computing.  
In this article, we propose and evaluate an approach to secure customer assets (data and information) in a Cloud computing environment by implementing an open-source IDS. In particular, we study how an IDS can be positioned in an Infrastructure as a Service (IaaS) public Cloud to monitor inter-virtual machine (inter-VM) operations. The IaaS public Cloud is the most widely used Cloud model deployment. In a public Cloud, the cloud service provider (CSP) provides different services and facilities to the general public via the Internet. In an IaaS public Cloud, the Cloud user is able to deploy and run any software and operating system (OS) in the Cloud. The user is also able to deploy IDS to add a layer of security to protect its data and information. Security and privacy in public IaaS model are especially a concern due to different users can have their virtual machines (VMs) reside on the same physical machine. We also design and implement a proof-of-concept of the proposed architecture. IaaS public Cloud technologies provide networking mechanisms that are used to configure virtual switches and experiment with new functionalities, such as traffic forwarding. Consequently, we want to assess how different virtual networking techniques can be employed in the context of securing the Cloud environment.  
The remainder of the article is organized as follows. Section 2 provides background information on Cloud computing and Cloud security. Section 3 discusses the related work. In Section 4, we discuss the method implemented in securing Cloud computing with emphasis on IaaS public cloud. In Section 5, the results from our experiments are discussed and evaluated in line with real-world scenarios. In Section 6, we offer our depth analysis on the experiment results. Finally, a conclusion is highlighted in Section 7.