79d6a5f4-d05e-4d57-9bc8-ac1501822d8520250708023259910wseas:wseasmdt@crossref.orgMDT DepositWSEAS TRANSACTIONS ON INFORMATION SCIENCE AND APPLICATIONS2224-34021790-083210.37394/23209http://wseas.org/wseas/cms.action?id=40461720251720252210.37394/23209.2025.22https://wseas.com/journals/isa/2025.phpTanapatAnusas-AmornkulDepartment of Computer and Information Science, King Mongkut’s University of Technology North Bangkok, 1518 Pracharat 1 Road, Wongsawang, Bangsue, Bangkok 10800, THAILANDWarakornSonnuiDepartment of Computer and Information Science, King Mongkut’s University of Technology North Bangkok, 1518 Pracharat 1 Road, Wongsawang, Bangsue, Bangkok 10800, THAILANDChatchaiKhunboaDepartment of Computer Engineering, Faculty of Engineering, Khon Kaen University, Mittraphap Road, Muang, Khon Kaen 40002, THAILANDCloud computing is widely used in government and business sectors. For the business sector, security is one of the most important topics to be considered to protect user and confidential data, especially in a cloud, which cannot manage the infrastructure physically. A private cloud is deployed to utilize only in an organization for all internal users. In addition, a Network Intrusion Detection System (NIDS) is normally used for detecting intruders from outside organizations. However, if an attacker is inside a private cloud, a typical NIDS placement cannot detect this type of attack. Therefore, the objective of this study is to design and analyze the NIDS locations to defend against internal attacks on a private cloud. A private cloud was deployed using OpenStack cloud with 3 physical servers, which were one admin/network node, and two compute nodes. Two types of attacks, DDoS and SSH brute force attacks, were implemented. Three NIDS placement scenarios inside the cloud were proposed and experimented with. The results indicated that NIDS placements on a network node, and compute nodes with a tap port, gave the best performance. In this scenario, NIDS detected all internal attacks, and Application VMs responded to requests up to 79.16% without performance reduction.78202578202550451541https://wseas.com/journals/isa/2025/a805109-019(2025).pdf10.37394/23209.2025.22.41https://wseas.com/journals/isa/2025/a805109-019(2025).pdfThe Most Widely Deployed Open Source Cloud Software in the World. OpenStack Cloud, [Online]. https://www.openstack.org/ (Accessed Date: December 10, 2024). Snort, [Online]. https://www.snort.org/ (Accessed Date: December 10, 2024). 10.1109/icnc47757.2020.9049480Chen Xu, Ruipeng Zhang, Mengjun Xie, Li Yang, "Network Intrusion Detection System as a Service in OpenStack Cloud," 2020 International Conference on Computing, Networking and Communications (ICNC), Big Island, HI, USA, 2020, pp. 450-455, doi: 10.1109/ICNC47757.2020.9049480. 10.1109/snpd.2017.8022709Zhijian Wang, Yanqin Zhu, "A centralized HIDS framework for private cloud," 2017 18th IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD), Kanazawa, Japan, 2017, pp. 115-120, doi: 10.1109/SNPD.2017.8022709. 10.1109/icoict.2016.7571954A. A. Aryachandra, Y. Fazmah Arif, S. Novian Anggis, "Intrusion Detection System (IDS) server placement analysis in cloud computing," 2016 4th International Conference on Information and Communication Technology (ICoICT), Bandung, Indonesia, 2016, pp. 1-5, doi: 10.1109/ICoICT.2016.7571954. 10.1109/inaes.2016.7821908Berkah I. Santoso, M. Rien Suryatama Idrus, Irwan Prasetya Gunawan, "Designing Network Intrusion and Detection System using signature-based method for protecting OpenStack private cloud," 2016 6th International Annual Engineering Seminar (InAES), Yogyakarta, Indonesia, 2016, pp. 61-66, doi: 10.1109/INAES.2016.7821908. 10.1109/atnac.2018.8615255Quentin Schueller, Kashinath Basu, Muhammad Younas, Mohit Patel, Frank Ball, "A Hierarchical Intrusion Detection System using Support Vector Machine for SDN Network in Cloud Data Center," 2018 28th International Telecommunication Networks and Applications Conference (ITNAC), Sydney, NSW, Australia, 2018, pp. 1-6, doi: 10.1109/ATNAC.2018.8615255. 10.1109/candarw53999.2021.00071Kentaro Takeshita, Michiko Harayama, "Improvement of Hybrid NIDS Using Deep Learning for Practical Use," 2021 Ninth International Symposium on Computing and Networking Workshops (CANDARW), Matsue, Japan, 2021, pp. 385-391, doi: 10.1109/CANDARW53999.2021.00071. 10.1109/netsoft.2018.8460090Tuan A Tang, Lotfi Mhamdi, Des McLernon, Syed Ali Raza Zaidi, Mounir Ghogho, "Deep Recurrent Neural Network for Intrusion Detection in SDN-based Networks," 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada, 2018, pp. 202-206, doi: 10.1109/NETSOFT.2018.8460090. 10.1109/comnet47917.2020.9306093Mohd Mat Isa, Lotfi Mhamdi, "Native SDN Intrusion Detection using Machine Learning," 2020 IEEE Eighth International Conference on Communications and Networking (ComNet), Hammamet, Tunisia, 2020, pp. 1-7, doi: 10.1109/ComNet47917.2020.9306093. 10.37394/23207.2022.19.43Nevila Baci, Kreshnik Vukatana, Marius Baci, "Machine Learning Approach for Intrusion Detection Systems as a Cyber Security Strategy for Small and Medium Enterprises," WSEAS Transactions on Business and Economics, vol. 19, pp. 474- 480, 2022, https://doi.org/10.37394/23207.2022.19.43. 10.37394/232018.2024.12.27Nabeel Refat Al-Milli, Yazan Alaya AlKhassawneh, "Intrusion Detection System using CNNs and GANs," WSEAS Transactions on Computer Research, vol. 12, pp. 281-290, 2024, https://doi.org/10.37394/232018.2024.12.27. Locust, An open source load testing toolc https://locust.io/ (Accessed Date: December 21, 2024). Hydra, [Online]. https://www.kali.org/tools/hydra/ (Accessed Date: December 21, 2024).