Enhancing Private Cloud Security Using Knowledge Understanding Assessment Defense Method for Distributed Denial of Service Attack Mitigation

The development of cloud computing has transformed the landscape of data storage and processing, providing remarkable scalability and cost-effectiveness. This technology allows for flexible data storage and access over the internet, providing users with the ability to retrieve information anytime and from any location. Nonetheless, connectivity through networks poses significant obstacles regarding the safeguarding of data. While conventional methods for encryption and decryption can successfully safeguard data, the decryption phase frequently demands significant computational power and may present possible security weaknesses [1]. At this stage, data is exposed to risks including cyberattacks and unauthorized access. To address these issues, innovative techniques such as homomorphic encryption and secret sharing have been developed as promising approaches. These techniques allow for computations to occur directly on encrypted data, eliminating the necessity for prior decryption and ensuring data confidentiality is preserved during processing in the cloud computing environment. These innovations signify an essential advancement in establishing a secure, efficient, and privacy-preserving cloud infrastructure that can effectively support contemporary digital ecosystems [2]. Furthermore, additional studies have suggested a clear geometric embedding inspired by the Coulomb approach to improve analytical resilience to local noise while maintaining computational efficiency. This method enhances cryptographic techniques by stabilizing data representation, which in turn facilitates more secure and efficient analysis in intricate cloud-based systems [3].

The advancement of data security approaches has resulted in notable progress due to innovations in encryption, decryption, and authentication mechanisms. The ongoing enhancements have strengthened the core of cloud security architecture, facilitated superior safeguarding of sensitive data, and created a more robust environment against emerging cyber threats [4]. Nonetheless, a primary difficulty in data security remains in the utilization of lengthy encryption keys. While extended keys can augment security, they simultaneously prolong encryption duration and diminish overall system performance [5]. Conversely, conventional authentication mechanisms, such as password-based systems, continue to be susceptible to numerous attack vectors, including credential theft and account hijacking. Biometric identification methods provide enhanced security through the use of physical or behavioral traits, although they possess intrinsic limitations. Vulnerabilities to spoofing, diminished accuracy due to alterations in users' physical conditions, and apprehensions regarding the privacy of biometric data pose persistent challenges that must be resolved in the deployment of authentication mechanisms within cloud computing environments [6]. Practical implementations have shown that the coupling of biometric authentication with ECC encryption yields promising results in private cloud computing environments. This hybrid paradigm enhances the secrecy and integrity of stored data while facilitating more rapid encryption and decryption procedures than conventional RSA-based systems [7]. However, the integration of this method into cloud infrastructures requires additional research, especially on scalability and data privacy considerations [8].

Technical issues and cloud computing security also face challenges in detecting and preventing attacks [9]. Conventional Intrusion Detection and Prevention Systems (IDS/IPS) are only effective against known attack patterns, making them less capable of identifying zero-day attacks [10, 11]. Similarly, single-password or unimodal biometric authentication methods remain vulnerable to spoofing and phishing, highlighting the need for multifactor authentication [12]. Furthermore, traditional encryption algorithms are often inefficient on resource-constrained devices, making lightweight encryption approaches increasingly relevant [13]. Emerging technologies such as blockchain and machine learning (ML) are being integrated to enhance cloud security, although challenges remain in terms of scalability and computational complexity [14]. In the context of the Internet of Things (IoT), increasingly complex cyber threats have been addressed through the integration of ML and Deep Learning (DL) within IDS [15]. Therefore, there is an urgent need for adaptive and comprehensive cloud security solutions that combine multiple approaches [16].

Cloud computing serves as a fundamental component of contemporary information technology (IT) infrastructure; however, notable security challenges remain to be resolved [17]. The primary vulnerability of cloud computing is its susceptibility to Distributed Denial of Service (DDoS) attacks, which can disrupt service availability by overwhelming the server with excessive traffic [18]. A significant issue in data security involves the use of insufficient encryption and ineffective key management, which may result in the exposure of sensitive information [19]. Risks are generally mitigated through encryption methods and access control mechanisms as primary strategies [20]. Additionally, the application of attack mitigation strategies in Software-Defined Networking (SDN), applicable to both cloud and IoT infrastructures, can enhance detection and prevention mechanisms [21-23]. Nonetheless, a significant gap persists in the integration of AI-based methods with adaptive cloud security strategies [24]. A combination of behavioral analysis and ML has been proposed as an effective solution for detecting insider threats [25, 26].

The implementation of complex techniques to enhance cloud security presents ongoing challenges, especially regarding personal data protection and cybersecurity issues [27]. Additionally, energy consumption in the implementation of cloud security necessitates careful consideration due to its substantial power usage, which is comparable to that of supercomputing systems. Research on performance and energy efficiency has been carried out utilizing the Exa Mon framework, which employs a compositional methodology [28, 29]. The Improved Bald Eagle Search (IBES) algorithm has been proposed for the optimization of cloud resource allocation, presenting a more efficient alternative to traditional optimization methods [30]. Recent studies point out that cybersecurity is essential for protecting cloud systems against threats, including data ownership inconsistencies and security exploitations [31]. The zero-trust strategy has gained significance in risk management, as it effectively mitigates unauthorized access and privilege escalation [32]. Furthermore, it contributes to shaping positive users. Additionally, it plays a role in influencing favorable user perceptions of the security level associated with cloud services [33]. A promising approach is the application of deep reinforcement learning to enhance access control mechanisms [34]. User trust in cloud service providers is fundamentally influenced by the provider's capacity to manage and safeguard sensitive data [35]. The adoption of more secure cloud solutions is constrained by several factors, including uncertainty, a limited number of competent providers, and inadequate risk management capabilities in both public and private organizations [36]. Recent studies have emphasized the significance of optimization techniques, such as the pre-copy approach, in cloud container migration, as they can decrease service downtime and mitigate security risks during migration processes [37]. This study presents a unique contribution by applying the Knowledge Understanding Assessment Defense (KUAD) framework to a private cloud service utilizing OwnCloud to address Goldeneye DDoS attacks, an area that has not been thoroughly explored thus far. The literature indicates that while many studies have enhanced cloud security via encryption schemes, intrusion detection systems, and AI-driven models, the majority of approaches are confined to either preventive or reactive mechanisms. Limited frameworks offer a cohesive lifecycle that integrates attack detection, forensic analysis, and active recovery into a single workflow. Furthermore, current methodologies frequently neglect the feedback dynamics between forensic investigation and real-time mitigation. This gap leads to the current study, which presents the KUAD framework as a comprehensive method that identifies and analyzes DDoS attacks while also restoring system functionality through adaptive mitigation. This research seeks to fill a methodological gap, contributing to both theoretical and practical advancements in cloud security resilience. This paper is structured as follows. Section 2 outlines the research methodology, detailing the KUAD framework and its integration into the OwnCloud-based private cloud environment. Section 3 presents the experimental setup, attack simulation, and analysis results related to the Goldeneye DDoS mitigation process. Section 4 discusses the disposition phase and its significance in improving post-attack recovery and system resilience. Section 5 concludes the paper by summarizing the key findings and proposing directions for future research. This research introduces a methodological innovation by integrating a mitigation and recovery stage within the KUAD framework, thereby establishing a continuous feedback loop that connects attack detection, forensic validation, and system stabilization. Previous studies utilizing the Network Forensic Development Life Cycle (NFDLC) or related frameworks reach conclusions focused on fact-finding, lacking mechanisms for real-time response or service restoration.

This research simulates an attack on an OwnCloud service hosted on a server operating Ubuntu Server 22.04 at IP address 10.10.10.4. The simulated attack is a DDoS executed using the Goldeneye tool from a computer located on a different network segment than OwnCloud. The simulation aimed to replicate a real-world testing scenario and assess the effectiveness of the proposed framework in mitigating these attacks. During the network forensics stage, the preparation phase for method deployment begins with initiation, as illustrated by the specifications of the equipment in Figure 2.

The attack on the OwnCloud service was carried out from a computer located on a different network segment connected via a MikroTik CCR1016-12G router. The server hosting the OwnCloud service and the computer running Wireshark were connected to the router within the same network segment, utilizing the router’s switch ports to establish a local network. More than 1,000 attack attempts were directed toward the server hosting OwnCloud, and the events were recorded by the Snort intrusion detection system installed on the test server. The attack simulation was executed from an external computer outside the 10.10.10.0 network using a Python script named GoldenEye.py with the command:python3 GoldenEye.py http://8081/OwnCloud/index.php/-w250-s 250.

Figure 2. Devices used in the research

The attack activity was successfully captured by Snort, indicating that the IP address 125.160.99.68 launched an attack against 10.10.10.4, utilizing the Goldeneye tool. It should be noted that there is a discrepancy between the port specified in the simulation command (port 8081) and the port recorded in the log; this is recommended to be reverified in the test configuration. Snort’s detection capability was enhanced through the customization of rules to identify HTTP GET flood patterns and the Goldeneye User-Agent signature. These custom rules were added to the Snort configuration file, allowing the system to automatically recognize the attack pattern and record it in the log swiftly and accurately for validation and mitigation purposes.

The rule was specifically designed to detect HTTP GET flood-type DDoS attacks targeting the OwnCloud service at IP address 10.10.10.4 on port 8081. The detection results from Snort were used as acquisition data and subsequently validated using Wireshark to confirm the involvement of the attacker’s IP address, as illustrated in Figure 3. This research utilized Wireshark on a distinct computer within the same network segment as the server to monitor both inbound and outbound traffic from the cloud server.

Figure 3. Network traffic captures using Wireshark

The data traffic to and from the server hosting the OwnCloud service reflects the communication between cloud users and the active server, which was captured using Wireshark. The attacks on the research object were identified as originating from IP addresses 125.160.99.68 and 182.4.101.198; both addresses were recorded not only by Snort but also detected through Wireshark. The detection data were then validated and presented in tabular form, as shown in Table 1.

The Goldeneye attack's impact on the OwnCloud service was analyzed using nload, a Command Line Interface (CLI)-based bandwidth monitoring tool operating on the Linux system. The execution phase involved simulating an attack in the form of a DDoS aimed at the OwnCloud server. The network activity during the attack was analyzed using Wireshark and Apache2 log records.

Table 1. Attacker data validation

Figure 4. Graphical display of the server’s load monitoring results during the Goldeneye attack

This analysis sought to identify attack patterns, trace attacker IP addresses, and assess the impact on OwnCloud's service performance. Through nload, bandwidth usage could be monitored in real time, facilitating network issue diagnosis and supporting data traffic management. Server performance monitoring utilizing nload was performed as part of the attack impact analysis, with the results presented in Figure 4.

Figure 4 illustrates a significant increase in network traffic during the attack period. The incoming traffic shows a sharp spike compared to normal conditions, while the outgoing traffic remains relatively stable. This pattern indicates an intensification of external communication toward the target server OwnCloud at IP address 10.10.10.4. Traffic measurement was performed using iPerf, where the iPerf server was executed on the OwnCloud server and the iPerf client on a separate computer that also ran Wireshark. The main performance parameter analysed was jitter, representing variations in packet arrival times from the expected interval. This parameter is essential for preserving service quality in latency-sensitive applications, including video conferencing and IP-based voice services. Previous studies addressed packet delay and jitter issues in heterogeneous wireless networks through the Flag-Based Multi-Path Retransmission (FBMRTX) approach [40]. This research calculates the jitter parameter using Eq. (1), and packet loss is calculated using Eq. (2), both referring to the total number of lost packets during transmission. These two parameters are essential indicators for evaluating network quality, especially for continuous data flow applications that require minimal disruption. In the UDP test using iPerf, jitter is computed based on the variation in delay between consecutive packets, as defined in RFC 3550 (RTP/RTCP).

$J=J+\frac{\left|\left(D_{i-1, i}\right)\right|-J}{16}$               (1)

$D_{i-1, i}=\left(t_i-t_{i-1}\right)-\left(T_i-T_{i-1}\right)$                 (2)

$J$ is the current jitter (Eq. (1)) value (ms), $D_{i-1, i}$ is the difference in delay variation between two consecutive packets, $t_i$ is the time the packet is received at the receiver side, and $T_i =$ the timestamp of the packet when it is sent. In Eq. (2), $t_i$ and $t_{i-1}$ denote the actual or observed times at the $i$-th and $(i-1)$ th events, respectively, while $T_i$ and $T_{i-1}$ represent the expected, ideal, or reference times for the same events. The term $t_i-t_{i-1}$ describes the actual time interval between two consecutive events, whereas $T_i-T_{i-1}$ defines the ideal time interval. The resulting value $D_{i-1, i}$ quantifies the difference between these two intervals, where a value of zero indicates perfect alignment, a positive value indicates a delay relative to the reference interval, and a negative value indicates an earlier occurrence than expected. Along with the calculation of the jitter value, which provides insights into the stability of the delay between data packets during the Goldeneye attack, a comparison was also conducted between the number of packets sent and the number of packets received. This comparison, known as Loss/Total Datagram, is calculated using the following Eq. (3):

${Packet\ Loss}(\%)=\frac{N_{ {sent }}-N_{{receive }}}{N_{ {sent }}} \times 100 \%$                (3)

$N_{{sent }}$ is the number of packets sent, and $N_{{receive }}$ is the number of packets received. The jitter and Loss/Total Datagram values were calculated based on ping data collected before and during the Goldeneye attack on the cloud service. The results of these calculations are presented in Table 2 for further analysis.

Table 2. Results of jitter and loss / total datagram calculations

Table 2 presents 16 data rows obtained through iPerf. Data analysis shows that the jitter before the attack ranged from 0.198 ms to 0.185 ms, with an average of 0.156 ms. After the attack occurred, the jitter increased slightly, ranging from 0.146 ms to 0.138 ms, with the average remaining around 0.1519 ms. This increase indicates a higher degree of time fluctuation in the network during the attack, although the difference is not significant. The average jitter under both conditions can be calculated using the standard mean calculation method as follows:

1. Before the attack

• Jitter = 0.1561 ms

• Loss/total = 0.24%

2. After the attack

• Jitter = 0.1519 ms

• Loss/total = 0.89%

Before the attack occurred, the packet loss rate was relatively low, with the Loss/Total Datagram percentage ranging from 0% to 0.15%. After the Goldeneye attack, a significant increase in packet loss was observed, peaking at 1.9% during specific intervals, such as between the 6th and 7th seconds. This condition can be observed in Figure 5.

Figure 5. Graphical representation of jitter and loss/total datagram on the OwnCloud service before

The Loss/Total Datagram values before and after the attack were calculated to illustrate the change in network quality. In terms of jitter, a slight increase was recorded after the attack, although the average value did not show a substantial difference. Conversely, the increase in Loss/Total Datagram was more pronounced, indicating a degradation in overall data transmission quality. While the jitter values remained within acceptable tolerance limits, the rise in packet loss suggests potential issues in data delivery, particularly affecting applications that require high speed and consistency. Figure 5 illustrates the fluctuations of jitter values and the Loss/Total Datagram ratio during the first 16 intervals before the attack, whereas Figure 6 shows the jitter values after the attack, represented by the light blue line.

Figure 6. After the mitigation phase was implemented

The red line indicates the Loss/Total Datagram values prior to the attack, while the orange line illustrates these values subsequent to the attack. The graph indicates that lower values of jitter and Loss/Total Datagram correlate with improved network quality. An increase in these indicators indicates the occurrence of a Goldeneye attack, facilitating effective detection of the attack. In addition to monitoring jitter and Loss/Total Datagram using iPerf, the ping utility was also employed to observe the impact of the attack on the OwnCloud service. These observations confirm that the private cloud used in this research, which employs the OwnCloud service, is vulnerable to Goldeneye attacks, as shown in Figure 7.

Figure 7. The impact of the attack as observed through packet loss during the ping process

Based on the observations, a mitigation phase is required to restore the jitter and Loss/Total Datagram values to their pre-attack conditions. This recovery is achieved by blocking the IP addresses identified as sources of the Goldeneye attack using Wireshark. The mitigation phase serves as an active defense mechanism within the developed framework. Once the attacker IP addresses have been validated through data analysis from Wireshark and Snort, the system provides a “Block All” function that enables administrators to block all IP addresses or subnets involved in the attack directly. The blocking process is executed through a shell script using the iptables DROP command. This IP blocking procedure constitutes a crucial component of the KUAD method implemented in this research. The impact of this blocking demonstrates that the OwnCloud service condition can be restored to its pre-attack state, as shown in Figure 8.

Figure 8. The impact of Goldeneye attack mitigation as observed through packet loss during ping testing

The final stage of this research focuses on the preparation of a comprehensive disposition document, which follows a standardized format previously applied in related published studies. This stage is crucial as it integrates all research findings, analytical results, and recommendations obtained from the experimental phase. The disposition is not merely a summary of results but functions as a strategic guideline that can be adopted by decision-makers and system administrators in designing effective policies for IT management.

This research offers actionable insights for preventive and corrective measures to improve the security posture of private cloud environments. It provides a systematic method for identifying vulnerabilities, executing mitigation strategies, and assessing recovery processes following an attack. The documentation highlights the necessity of ongoing monitoring and adaptive defense mechanisms, essential for sustaining service reliability and system performance during and following cyberattacks, exemplified by the Goldeneye denial-of-service (DoS) incident.

Moreover, this framework highlights the role of proactive risk assessment and incident response planning as integral components of organizational resilience. By integrating these strategies, organizations can ensure that their IT infrastructure remains stable, secure, and capable of sustaining operational efficiency even under potential attack scenarios. Ultimately, the disposition developed in this research not only serves as a practical tool for operational improvement but also contributes to the broader academic discourse on cybersecurity resilience in cloud computing systems. It provides a reproducible model that other researchers and practitioners can adapt to evaluate and strengthen their own defensive architectures against evolving threats.

SDN has been widely adopted as a standard approach for mitigating DDoS attacks due to its centralized control and dynamic traffic management capabilities. SDN-based mitigation frameworks typically rely on flow-level monitoring and controller-driven policies to detect and block malicious traffic in real time. These approaches are effective in large-scale and highly dynamic networks; however, they introduce architectural complexity and dependency on a centralized controller, which may itself become a target during an attack. Although the experimental evaluation in this research primarily focuses on descriptive performance metrics such as jitter and packet loss, the results can be contextualized with respect to existing DDoS mitigation frameworks. DeepDefend and SDN-based models, for instance, rely heavily on predefined learning patterns or flow-based policies to detect and neutralize attacks. In contrast, the KUAD framework, see Table 3, adopts a feedback-oriented approach that not only detects anomalies but also triggers immediate corrective actions through its integrated mitigation phase. This adaptive mechanism minimizes system downtime without requiring extensive model retraining or centralized controller dependency.

Table 3. Comparison between SDN and KUAD

From a performance perspective, SDN-based frameworks prioritize rapid traffic rerouting and filtering, whereas KUAD focuses on stabilizing service-level parameters such as jitter and packet loss after an attack is identified. Experimental results demonstrate that KUAD effectively restores network performance close to normal operating conditions following a Goldeneye DDoS attack. Although KUAD does not provide global traffic optimization as in SDN architectures, it offers a lightweight, adaptive, and evidence-oriented mitigation mechanism suitable for private cloud environments. The mitigation process in KUAD functions as a closed-loop control system that dynamically stabilizes network parameters, including jitter and packet loss, during active attacks. Subsequent research could improve this study by performing comparative benchmarking between KUAD and established frameworks to measure its benefits in terms of response time, recovery efficiency, and mitigation accuracy.

This research examines the feasibility and effectiveness of the KUAD framework through the application of fundamental mitigation techniques and a restricted set of performance metrics. Future research will enhance the evaluation by integrating advanced mitigation mechanisms, utilizing larger datasets, exploring multiple attack scenarios, and conducting thorough statistical benchmarking against established frameworks, including SDN-based mitigation models.