Network Security Analytics on the Cloud: Public vs. Private Case

Our networks, PCs, tablets, mobile phones, and other devices are exposed to security risks and attacks executed by cybercriminals on daily bases. The detection and prevention of cyber threats are done by IDS/IPS systems but they are not flexible enough when it comes to using threat models. The threat intelligence frameworks on the other hand typically require significant computational power. All these requirements can be fulfilled by contemporary cloud technologies, but in many cases, public clouds are not acceptable due to privacy, security, and efficiency concerns. This article presents an implementation of a framework for security analytics in the area of detection of unauthorized intrusions using the technology of the private cloud. It has many of the advantages of the big public clouds but fundamentally differs from them when it comes to data management, operation interoperability, and costs. It is suitable for small and medium data centers and large companies, which prefer to keep the data on their premises or to isolate the operations within managed servers on their private clouds hosted by public data centers.