## 3 Cloud Computing Security
### Cloud Intrusion and Detection
The proposed model was designed using three dependent modules: capture, analysis and reporting modules. These three modules identified an efficient matching and analysis of bad packets and CSP-generated alerts. The proposed model's strength was that the multi-threaded approach could handle a large volume of data in the cloud. Secondly, the cloud IDS improved efficiency due to the reduced memory, CPU consumption, and packet loss. A limitation to the proposed model was the introduction of third-party control over the multi-threaded approach. The issue of high compromise can arise because of the single point of failure and bottleneck. The use of ML algorithms drives solutions to the problems of analysing huge data network traffic and realising better performance optimisation for detection [68]. [PERSON] et al. [68] proposed an Improved Self Adaptive Bayesian Algorithm (ISABA) for cloud-based intrusion detection. The Adaptive Bayesian Algorithm generates a function from the training dataset. This function estimates the conditional class probabilities for each attribute based on their frequencies over the weights, putting a match of the same class in the same training dataset. For improvement to this (ISABA), given any intrusion training data, the weights are initialised for each \(W_{i}\) set to 1.0. Then, the prior probability is estimated by summing the weights of how often each class occurs in the training data. When there is misclassification in training, the prior and conditional probabilities are recomputed using the training examples, and then the weights are updated. The continuous iteration of these processes achieved target accuracy. Experimental results proved that the ISABA outperformed the SVM, NB and NN for training and testing and classification rates. Further research on the ISABA will apply domain knowledge security in improving its detection accuracy. [PERSON] et al. [72] proposed an intrusion detection system that was tested on three different ML algorithms, namely: SVM, naive Bayes and random forest. Experimental analysis was carried out for accuracy, recall and precision on normal packets and DDoS packets. After proper training using the three ML algorithms, SVM depicted greater precision and accuracy than the other classification algorithms. The limitation was the inability to detect some well-known Intrusion Detection attacks, such as zero-day attacks and zombie attacks. [PERSON] et al. [73] argued that it is relevant to test an ID system with a different dataset to create effective detection attacks. Therefore, the authors proposed training supervised ML algorithms such as SVM, logistic regression, decision tree and naive Bayes with two different datasets, UNSW and ISOT, using the WEKA tool. At the end of the experiment, it was found out that SVM and decision tree both averagely performed better than the remaining algorithms. The claims of [PERSON] et al. were right in the sense that one particular algorithm did not outperform the remaining algorithms in both datasets, implying that there is an imbalance between supervised learning algorithms. This may be because these algorithms perform better with a large number of negative and positive samples. The works of [73] create new ideas for training models for detection, which means there is a need to train a model with multiple datasets before validating the efficiency of that model. [PERSON] [74] proposed an NN model that is trained based on users timing vectors from keystroke properties extracted from users inputs login name and password strokes. After the training, when a login name and password is entered, the user's timing vector is applied to the NN. The resulting input-output difference is compared using the predetermined threshold, and access is denied at any instance where the difference is larger than the threshold. [PERSON] et al. [75] proposed an ensemble-based method that implements the multi-filter feature selection to combine the output results of four different filter methods to achieve maximum results.