Intrusion Detection on AWS Cloud through Hybrid Deep Learning Algorithm

Round 1

Reviewer 1 Report

1.  The research work drafting with the motivational points provided is appreciable. 

2.  The article provides the good level of information on the research title and the proposed method is clearly depicted.

3.  The proposed method is clearly depicted in Figure 1.

4.  The surveyed contents seem to be good, and data are well written and mapped. 

5.  The result and analysis section and the conclusion of the manuscript is well written with the achieved results which provides the reader with detailed information on the research work. Even though, the details provided are little more than the required level which may the author can look into it.

6.  The grammatical mistakes need to be corrected in the introduction part.

7.  The cloud environment for storing the dataset details should be added in Table 4.

Author Response

Dear Sir / Mam, Thank you for reviewing my research article and for providing the valuable comments for further improvement of research article.

Here, I had done the corrections in the research article as per your suggestions sir/mam. I am attaching the file with the review comments provided and the detailed corrections made on the research article for your kind reference. 

Author Response File: Author Response.pdf

Reviewer 2 Report

The abstract can be more concise. 

Line 92, “the straight away narrow down approach is the ‘improvement of security rather than improving time and space complexity’”, why is this “the straight away narrow down approach” compared to (i) mentioned in Line 89?

It would be great to see a better description of the goal of the research and the proposed model in the introduction.

Some grammar errors:

Line 13: “In the year of 2022 second quarter” should be “In the year 2022 second quarter” or “In the second quarter of the year 2022”

Line 18: 76 fields (not field)

Line 19: have (not has) been categorized

Line 33: nowadays (not now a days)

Line 122: The above techniques which are (not is) mentioned are (not is) also

Line 172: which is fed (not feed)

Line 189: data Table needs (not need) to be

Line 240: how much the cluster has (not have) been learned from the entire data set

Line 394: have (not has) been given in Fig. 3

Line 395: have (not has) been provided

Line 480: show (not shows) the classified attack

Author Response

Dear Sir / Mam, Thank you for reviewing my research article and for providing the valuable comments for further improvement of research article.

Here, I had done the corrections in the research article as per your suggestions sir/mam. I am attaching the file with the review comments provided and the detailed corrections made on the research article for your kind reference. 

Thank You Sir/Mam

Author Response File: Author Response.pdf

Reviewer 3 Report

The paper states on page 11 “The dataset we used is CSE-CIS-IDS-2018 [17, 19] and it is created based on the network traffic and attack generated on AWS cloud in the year 2018.” The correct spelling of this dataset is CSE-CIC-IDS-2018. The paper uses the wrong spelling throughout but for the list of references. This reviewer has not found any mention of the AWS cloud in references [17] and [19]. The paper therefore fails to substantiate the link between the work reported and intrusion detection for the AWS cloud. Title, abstract, and introduction are thus seriously misleading and the paper must be rejected.

The CSE-CIC-IDS-2018 dataset is a synthetic dataset created at the University of New Brunswick. Research on intrusion detection has been using synthetic datasets for a long time, but the use of synthetic datasets has also been viewed critically in the research literature.

For relevant work on the CSE-CIC-IDS-2018 dataset, see Liu, L., Engelen, G., Lynar, T., Essam, D., & Joosen, W. (2022, October). Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018. In 2022 IEEE Conference on Communications and Network Security (CNS) (pp. 254-262). IEEE.

A general analysis of the pitfalls of using machine learning in computer security is given in Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., ... & Rieck, K. (2022, August). Dos and don’ts of machine learning in computer security. In Proc. of the USENIX Security Symposium.

The seminal paper on using machine learning for network intrusion detection is Sommer, R., & Paxson, V. (2010, May). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE symposium on security and privacy (pp. 305-316). IEEE.

This reviewer has no stake in any of the three papers. A research paper must discuss the limitations of the work it presents.  The points made in these three references can provide guidance for such a discussion.

The paper uses but does not define the term ‘routing-based attacks’. It is not clear to this reviewer in which way a botnet attack, for example, is a routing-based attack. The paper switches from data security (in the cloud) to network security. In the security research literature, data security and network security relate to different security challenges.

The text is on occasion difficult to follow. “This long distance of data travel got exposed to routing attacks on the higher possibility” and “it is very much noTable in terms of considering security of data present in the cloud environment” are two examples.

Author Response

Dear Sir / Mam, Thank you for reviewing my research article and for providing the valuable comments for further improvement of research article.

Here, I had done the corrections in the research article as per your suggestions sir/mam. I am attaching the file with the review comments provided and the detailed corrections made on the research article for your kind reference. 

Thank You Sir/Mam

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors have incorporated all my suggestions. The paper can be accepted now.

Author Response

Thank you for the Acceptance Sir

Reviewer 3 Report

The revision has has made some corrections but my major concerns have not been addressed.

I have to apologize for a mistake in my earlier review. Reference [17] does refer to the AWS cloud; the CSE-CIC-IDS2018 dataset was generated in a small test network hosted in the AWS cloud. The creation of this dataset is thus an example for network security research using the AWS cloud as a platform, but the dataset does not capture attacks against the AWS cloud. This dataset is therefore not an appropriate basis for conducting research on cloud security. The remarks on the importance of cloud services and cloud security in Abstract and Introduction are thus irrelevant and misleading.

The paper does not make a contribution to could security but may make a contribtion to network security. My earlier review had listed three papers that would help to put the contribution of this paper into context with the state of the art in intrusion detection and network security. The revised version does not refer to these papers (which is not necessary) and does not explain how it advances the state of the art in network security (which is necessary in a research paper).

The paper still contains many sentences worded too vaguely for a technical research paper, e.g. “the data in real world nowadays has been transferred to a long distance”, “This is also enlightened and made wider by cloud technologies”, and “and it has been cached by the cloud front globally distributed edge locations”.

Author Response

Respected Sir,

Sir, I had made corrections as per your valuable points to improve my research article. Please find the attachment sir for the correction details.

Kindly expecting your acceptance.

Thank You sir.

Author Response File: Author Response.pdf

Round 3

Reviewer 3 Report

The authors’ response has heightened my concerns about this paper. The previous review had stated “the CSE-CIC-IDS2018 dataset was generated in a small test network hosted in the AWS cloud. The creation of this dataset is thus an example for network security research using the AWS cloud as a platform, but the dataset does not capture attacks against the AWS cloud.” This statement was based on “The main objective of this project is to develop a systematic approach to generate diverse and comprehensive benchmark dataset for intrusion detection based on the creation of user profiles which contain abstract representations of events and behaviours seen on the network” from https://www.unb.ca/cic/datasets/ids-2018.html. The authors’ response does not differentiate between traffic generated in the AWS cloud and traffic containing attacks against the AWS cloud.

“When the focus is on to improve the cloud security and to detect the intrusion based attacks” in the paper suggests a focus on cloud security, which is not supported by the explanations given by the creators of the CSE-CIC-IDS2018 dataset.

Regarding the comment in the review “The article does not explain how it advances the state of the art in network security (which is necessary in a research paper)” , the authors’ response states “This existing comparison also had comparison from 2022 research work [1] …” To advance the state of the art, it is rarely sufficient to give a comparison with a single paper. The submission would have to cover the state of the art in network intrusion detection to justify the selection of methods used for comparison.