## 3 Cloud Computing Security
### Cloud Intrusion and Detection  
There exist different methods in detecting and preventing intrusion and detection attacks in the cloud, such as statistical analysis, data mining and machine learning algorithms. Statistical analysis detection methods detect anomaly behaviours through computational analysis of the network. The advantage of this approach is the lack of training or prior understanding of the security risks involved in the network traffic. Its limitation is its inefficiency in detecting anomaly behaviours due to incomplete knowledge [67]. The data mining method uses the concept of classification, association, and clustering rules to detect anomalies. This approach can be very flexible and easy to deploy. Still, its disadvantage is its inaccuracy in parameter manipulation, which can alter privacy settings and security protocols. Machine learning algorithms can improve computational performance by learning or training parameters involved in the computation. This approach can create a system that will enhance the performance of a program through a learning process that will improve on previous results. Another exciting feature of this approach is its ability to learn more information from previous results to improve future performance. The introduction of machine learning as a control for Intrusion Detection has made the IDS implementation efficient and scalable. The network can be correctly trained to detect intrusions. For a given intrusion sample set, the network learns to identify behavioural patterns in the model. With an extensive training dataset of attacks, the network can identify a broader range of unknown attacks. Machine learning algorithms such as Support Vector Machines, Artificial Neural Network, Data Mining and Fuzzy logic have been adopted in cloud computing for intrusion detection attacks. The use of ML algorithms drives solutions to the problem of analysing massive data network traffic and realising better performance optimisation for detection [68]. The machine learning classifiers are stated below. 1. Decision Tree Algorithm: This technique is implemented through the concept of game theory. The DT algorithm is implemented in Intrusion Detection Systems by choosing splitting attributes with the highest information gain using Equation (1), because the probability of occurrence of an attribute is based on the amount of information that can be associated with the attribute. Let the \(D\) and \(H(D)\) be the data in a given dataset, and \(C\) be the associated class, then \[Gain(D,S)=H(D)-\sum_{i=1}^{S}p(D_{i})H(D_{i})\] (1)  
Quantifying the information gain of an attribute is achieved through the concept of entropy by measuring the level of randomness in a dataset, as shown in Equation (2). If the data belongs to a single dataset with no uncertainty, then the entropy is zero, as established in Equation (2). \[Entropy:H(p_{1},p_{2},\ldots,p_{s})=\sum_{i=1}^{S}(p_{i}[log(1/p_{i})])\] (2) One main advantage of the DT classifier is that it constantly partitions the given dataset into subsets for all elements, where final subsets belong to the same class. 2. K-Nearest Neighbour (KNN): The KNN algorithm is based on distance measures between classes. It seeks to find \(k\) attributes in the training data, which seem to be closest to the test example [68]. After which, it assigns the most frequent label among these examples to the new model. Whenever any classification is made, it first calculates its distance to each attribute contained in the dataset and only k closest ones are considered. 3. Bayes Rule (BR): BR calculates the probability of a hypothesis based on prior probability, as depicted in Equation (3). Given an observed dataset D and any form of initial knowledge, the best possible hypothesis will be the most probable one. Given that \(h=hypothesis\), \(P(h|D)=posterior\), \(p(h)=priorprobability\). In some cases where we are most interested in calculating the most probable hypothesis (\(h\epsilon H\)), this is defined as the Maximum Posterior Hypothesis (MPH), defined in Equation (4).