{"id":"https://openalex.org/W7125598652","doi":"https://doi.org/10.1145/3787966","title":"EIDS: A Cloud Intrusion Detection System with High Performance and Maintainability","display_name":"EIDS: A Cloud Intrusion Detection System with High Performance and Maintainability","publication_year":2026,"publication_date":"2026-01-24","ids":{"openalex":"https://openalex.org/W7125598652","doi":"https://doi.org/10.1145/3787966"},"language":"en","primary_location":{"id":"doi:10.1145/3787966","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3787966","pdf_url":null,"source":{"id":"https://openalex.org/S193109227","display_name":"ACM Transactions on Computer Systems","issn_l":"0734-2071","issn":["0734-2071","1557-7333"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Computer Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3787966","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101723909","display_name":"Xiaokang Hu","orcid":"https://orcid.org/0000-0002-3643-1668"},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaokang Hu","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0000-0002-3643-1668","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035727373","display_name":"Zhichao Hua","orcid":"https://orcid.org/0000-0002-2211-9120"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhichao Hua","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":"https://orcid.org/0000-0002-2211-9120","affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123728352","display_name":"Naixuan Guan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Naixuan Guan","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0009-0007-6398-0340","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100862052","display_name":"Yun Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yun Xu","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0009-0004-0308-9028","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103244151","display_name":"Yibin Shen","orcid":"https://orcid.org/0009-0009-3447-5577"},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yibin Shen","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0009-0009-3447-5577","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123729636","display_name":"Yang Yu","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Yu","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":"https://orcid.org/0009-0003-5904-5115","affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051857167","display_name":"Zeyu Mi","orcid":"https://orcid.org/0000-0001-8395-1319"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zeyu Mi","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":"https://orcid.org/0000-0001-8395-1319","affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122962904","display_name":"Yubin Xia","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yubin Xia","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":"https://orcid.org/0000-0001-6558-5298","affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ming Wang","orcid":"https://orcid.org/0009-0006-2702-8478"},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ming Wang","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0009-0006-2702-8478","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071999696","display_name":"Jiesheng Wu","orcid":"https://orcid.org/0000-0001-7417-5469"},"institutions":[{"id":"https://openalex.org/I4210095624","display_name":"Alibaba Group (United States)","ror":"https://ror.org/00rn0m335","country_code":"US","type":"company","lineage":["https://openalex.org/I4210095624","https://openalex.org/I45928872"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiesheng Wu","raw_affiliation_strings":["Alibaba Group"],"raw_orcid":"https://orcid.org/0000-0001-7417-5469","affiliations":[{"raw_affiliation_string":"Alibaba Group","institution_ids":["https://openalex.org/I4210095624"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.09018553,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"44","issue":"2","first_page":"1","last_page":"29"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3628000020980835,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3628000020980835,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.29159998893737793,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.15080000460147858,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6873999834060669},{"id":"https://openalex.org/keywords/bottleneck","display_name":"Bottleneck","score":0.6854000091552734},{"id":"https://openalex.org/keywords/virtual-machine","display_name":"Virtual machine","score":0.5796999931335449},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.5490999817848206},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5268999934196472},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.4169999957084656},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.40959998965263367},{"id":"https://openalex.org/keywords/throughput","display_name":"Throughput","score":0.35850000381469727},{"id":"https://openalex.org/keywords/maintainability","display_name":"Maintainability","score":0.34540000557899475}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8694000244140625},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6873999834060669},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.6854000091552734},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.5796999931335449},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.5490999817848206},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5268999934196472},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.45489999651908875},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.4169999957084656},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.40959998965263367},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3864000141620636},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.37549999356269836},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.35989999771118164},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.35850000381469727},{"id":"https://openalex.org/C160713754","wikidata":"https://www.wikidata.org/wiki/Q1389965","display_name":"Maintainability","level":2,"score":0.34540000557899475},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C180591934","wikidata":"https://www.wikidata.org/wiki/Q1253369","display_name":"Downtime","level":2,"score":0.3181999921798706},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.31029999256134033},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.3025999963283539},{"id":"https://openalex.org/C112904061","wikidata":"https://www.wikidata.org/wiki/Q1077480","display_name":"Hypervisor","level":4,"score":0.2944999933242798},{"id":"https://openalex.org/C513985346","wikidata":"https://www.wikidata.org/wiki/Q270471","display_name":"Virtualization","level":3,"score":0.28999999165534973},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.287200003862381},{"id":"https://openalex.org/C123606473","wikidata":"https://www.wikidata.org/wiki/Q907918","display_name":"Complex event processing","level":3,"score":0.2851000130176544},{"id":"https://openalex.org/C105122174","wikidata":"https://www.wikidata.org/wiki/Q322202","display_name":"Garbage collection","level":3,"score":0.2833999991416931},{"id":"https://openalex.org/C206729178","wikidata":"https://www.wikidata.org/wiki/Q2271896","display_name":"Scheduling (production processes)","level":2,"score":0.27889999747276306},{"id":"https://openalex.org/C193519340","wikidata":"https://www.wikidata.org/wiki/Q891179","display_name":"Data loss","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C41661131","wikidata":"https://www.wikidata.org/wiki/Q220764","display_name":"Interrupt","level":3,"score":0.2606000006198883},{"id":"https://openalex.org/C2776303644","wikidata":"https://www.wikidata.org/wiki/Q1020499","display_name":"Interfacing","level":2,"score":0.2556999921798706},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3787966","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3787966","pdf_url":null,"source":{"id":"https://openalex.org/S193109227","display_name":"ACM Transactions on Computer Systems","issn_l":"0734-2071","issn":["0734-2071","1557-7333"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Computer Systems","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3787966","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3787966","pdf_url":null,"source":{"id":"https://openalex.org/S193109227","display_name":"ACM Transactions on Computer Systems","issn_l":"0734-2071","issn":["0734-2071","1557-7333"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Computer Systems","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6983371265","display_name":null,"funder_award_id":"62202289, 62432010, 61925206, 62472279","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W1982063824","https://openalex.org/W2043491664","https://openalex.org/W2077171549","https://openalex.org/W2119982986","https://openalex.org/W2125901106","https://openalex.org/W2129860818","https://openalex.org/W2144006591","https://openalex.org/W2159265516","https://openalex.org/W2164740236","https://openalex.org/W2577489668","https://openalex.org/W2761028280","https://openalex.org/W2761578098","https://openalex.org/W3006578308","https://openalex.org/W3030010279","https://openalex.org/W3157268648","https://openalex.org/W3173427323","https://openalex.org/W4240053329","https://openalex.org/W4292158661","https://openalex.org/W4393165990"],"related_works":[],"abstract_inverted_index":{"Intrusion":[0],"Detection":[1],"Systems":[2],"(IDSes)":[3],"are":[4],"widely":[5,286],"employed":[6],"to":[7,50,165,187,206,214,228,242,301],"identify":[8],"potential":[9],"attacks":[10],"in":[11,144,151,169,196,270,318],"guest":[12,36,73,152],"virtual":[13],"machines":[14],"(VMs).":[15],"Nonetheless,":[16],"traditional":[17,42],"IDSes":[18,43],"fall":[19],"short":[20],"of":[21,24,35,41,233,268],"the":[22,32,39,66,99,107,121,140,149,184,211,216,223,230,305],"demands":[23],"high-performance":[25,46],"clouds.":[26],"First,":[27,128],"monitoring":[28],"VM":[29,104,186,261],"events":[30,168,227],"increases":[31],"tail":[33,244],"latency":[34,245,309],"services.":[37],"Second,":[38,157],"throughput":[40],"cannot":[44],"meet":[45],"cloud":[47,58,87],"requirements,":[48],"leading":[49],"event":[51,238,320],"loss":[52],"and":[53,93,106,115,126,154,236,249,272,290,313],"reduced":[54],"detection":[55],"accuracy.":[56],"Finally,":[57,241],"providers":[59],"typically":[60],"run":[61],"complex":[62,192],"IDS":[63,69,88,174,253,285,319],"tools":[64],"within":[65],"VM.":[67],"Updating":[68],"functionality":[70],"requires":[71],"modifying":[72],"VMs,":[74],"which":[75],"hurts":[76],"maintainability.":[77,95,156],"To":[78],"overcome":[79],"these":[80],"challenges,":[81],"this":[82],"article":[83],"presents":[84],"EIDS,":[85],"a":[86,131,135,145,160,247,266,274,315],"framework":[89],"with":[90,134,180,255,281],"high":[91,173],"performance":[92,280],"good":[94],"We":[96,264,277],"observe":[97],"that":[98,138],"main":[100],"bottleneck":[101],"is":[102],"collecting":[103],"status,":[105,209],"collected":[108],"status":[109,122,132,141,162,193,213,220],"can":[110],"be":[111],"divided":[112],"into":[113],"fundamental":[114,189,212],"supplementary":[116,208],"status.":[117,190],"EIDS":[118,158,269,303],"then":[119],"splits":[120],"collection":[123,142,163,224],"procedure":[124],"spatially":[125],"temporally.":[127],"we":[129],"provide":[130],"monitor":[133],"separate":[136],"architecture":[137],"isolates":[139],"logic":[143,254],"microVM,":[146],"thus":[147],"minimizing":[148],"code":[150],"VMs":[153],"improving":[155],"introduces":[159],"two-phase":[161],"method":[164],"handle":[166],"multiple":[167,226],"batches,":[170],"asynchronously,":[171],"for":[172,225,292],"throughput.":[175,240,322],"A":[176],"tiny":[177],"tracer,":[178],"implemented":[179,265],"eBPF,":[181],"operates":[182],"inside":[183],"user":[185,260],"collect":[188],"The":[191,219,296],"collector":[194,221],"runs":[195],"an":[197,283],"isolated":[198],"microVM.":[199],"It":[200],"utilizes":[201],"Virtual":[202],"Machine":[203],"Introspection":[204],"(VMI)":[205],"gather":[207],"using":[210],"bridge":[215],"semantic":[217],"gap.":[218],"batches":[222],"amortize":[229],"fixed":[231],"overhead":[232,310],"microVM":[234],"switching":[235],"improve":[237],"tracing":[239],"minimize":[243],"overhead,":[246],"fine-grained":[248],"workload-aware":[250],"scheduler":[251],"executes":[252],"small":[256],"time":[257],"slices":[258],"during":[259],"idle":[262],"periods.":[263],"prototype":[267],"Linux-KVM":[271],"conducted":[273],"comprehensive":[275],"evaluation.":[276],"compared":[278,300],"EIDS\u2019s":[279],"Falco,":[282,302],"open-source":[284],"used":[287],"by":[288,311],"Kubernetes":[289],"AWS":[291],"runtime":[293],"security":[294],"monitoring.":[295],"results":[297],"demonstrate":[298],"that,":[299],"reduces":[304],"99":[306],"th":[307],"-percentile":[308],"97%":[312],"achieves":[314],"13.8X":[316],"improvement":[317],"handling":[321]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-01-25T00:00:00"}