## 3 Cloud Computing Security
### Cloud Intrusion and Detection
From Equation (4), if we assume that the probability of the data \(P(D)\) is constant because of its dependency on the hypothesis \(h\), then \(P(D|h)\) is called the Maximum Likelihood (ML) hypothesis, shown in Equation (5). \[BR:P(h|D)=\frac{P(D|h)P(h)}{P(D)}\] (3) \[h_{mps}\equiv argmax_{h\epsilon H}P(h|D)\] (4) \[=argmax_{h\epsilon H}\frac{P(h|D)P(h)}{P(D)}=argmax_{h\epsilon H}P(D|h)P(h)\] \[h_{ml}\equiv argmax_{h\epsilon H}P(D|h)\] (5)
4. Naive Bayesian (NB): NB is a probabilistic approach very similar to the Bayesian Rule. It computes the probability of each class and then determines which attributes to classify and learn to predict the new class. Given a vector V represented by n different variables \(V=\{V_{1},V_{2},V_{3}\ldots V_{n}\}\) assigned to probability instances \(P=\{Ck|V_{1},V_{2},V_{3}\ldots V_{n}\}\) for every \(k\) possible results or classes \(Ck\), the conditional probability can be formulated, as shown in Equation (6). \[P(Ck|V)=\frac{P(V|Ck)P(Ck)}{P(V)}\] (6) where \(P(Ck|V)=\) Posterior Probability, \(P(V|Ck)=PriorProbability\), \(P(Ck)=\) Likelihood and \(P(V)=\) Evidence. The joint computation can then be written as follows \[P(Ck)=\prod_{i=1}^{n}P(v_{i}|Ck)\] (7)
5. Support Vector Machines (SVM): SVM is a numerical learning model centred on a data-mining approach. It was initially introduced for only data classification, but with the advance of complex situations, it has now been fully implemented for clustering tasks and regression analysis. There are different notions about the performance level of SVM compared to neural networks. Still, many authors from the literature agree that SVM performs better than the multi-layer perceptron as a result of its reversed neural network design [69]. The SVM can also be used in spam filtering pattern recognition and anomaly network detection [70]. Training data usually achieve the near precise SVM classification to classify unidentified samples given training model data. SVM has the advantage of finding an optimum global result by performing linear separation in a hyperplane to two separate classes. After this separation, the closest data to the hyperplane are classified as the correct class. Considering a training dataset \(D_{l}=\{x_{i},y_{i}\}_{i=l}^{l}\), \(x_{i}=i_{th}\) input vector for \(x_{i}eR^{n}\), \(y_{i}e[+1,-1]\), where \(l\) = total number of input vectors, and \(n\) = dimension of the input vector space. Assuming the relationship between \(x\) and \(y\) be \(y=Sgn(f(x)+\epsilon)\), where \(Sgn(x)=i\) if \(x\geq 0\) and \(Sgn(x)=i\) if \(x<0\). Then, the task to uncover \(f\) is called the _Classification Function_. SVM evaluates Equation (8) to create a trade-off between complexity and empirical error of the hypothesis space, where C = the regularisation parameter that will control the identified trade-offs of the used hypothesis space. \[\min_{f}\lVert f\rVert_{k}^{2}+C\sum_{i=1}^{l}\lvert 1-y_{i}f(\mathbf{X}_{i})\rvert \tag{8}\]  
Providing security measures for distributed models such as cloud environment entails more than just passwords for user authentication or digital certificates for confidentiality when transmitting information [71]. The distributed model nature of the cloud has made it highly vulnerable and prone to sophisticated distributed intrusion attacks such as Cross-Site Scripting (XSS) and Distributed Denial of Service (DDOS). Before the widespread use of machine learning applications. Traditional IP and packet filtering approaches were implemented to handle significant network control over accessed traffic. Authors such as [71] proposed a multi-threaded distributed cloud IDS to mitigate against large data flow of packets, analyse the packet and efficiently generate reports by integrating knowledge and behaviour analysis to detect intrusions. The multi-threaded architecture was monitored and administered by a third-party monitoring service in their implemented mechanism. The third-party monitoring service then generates alerts and mitigation control for CSPs.