Cross-Layer Hidden Markov Analysis for Intrusion Detection

: Ad hoc mobile cloud computing networks are affected by various issues, like delay, energy consumption, flexibility, infrastructure, network lifetime, security, stability, data transition, and link accomplishment. Given the issues above, route failure is prevalent in ad hoc mobile cloud computing networks, which increases energy consumption and delay and reduces stability. These issues may affect several interconnected nodes in an ad hoc mobile cloud computing network. To address these weaknesses, which raise many concerns about privacy and security, this study formulated clustering-based storage and search optimization approaches using cross-layer analysis. The proposed approaches were formed by cross-layer analysis based on intrusion detection methods. First, the clustering process based on storage and search optimization was formulated for clustering and route maintenance in ad hoc mobile cloud computing networks. Moreover, delay, energy consumption, network lifetime, and link accomplishment are highly addressed by the proposed algorithm. The hidden Markov model is used to maintain the data transition and distributions in the network. Every data communication network, like ad hoc mobile cloud computing, faces security and confidentiality issues. However, the main security issues in this article are addressed using the storage and search optimization approach. Hence, the new algorithm developed helps detect intruders through intelligent cross layer analysis with the Markov model. The proposed model was simulated in Network Simulator 3, and the outcomes were compared with those of prevailing methods for evaluating parameters, like accuracy, end-to-end delay, energy consumption, network lifetime, packet delivery ratio, and throughput. to evaluate parameters, like accuracy, end-to-end delay, energy consumption, network lifetime, packet delivery ratio, and throughput.

Additionally, intrusion detection methods are required to address security issues and confidentiality concerns. The hidden Markov model works with high stability in terms of exact data transition and distributions. This model helps identify and prevent intrusions to address the security issues and confidentiality concerns of adhoc mobile cloud computing networks [5]. Several protocols, like the ad hoc on-demand distance vector, the border gateway protocol, location aided routing, optimized link state routing, open shortest path first, the routing information protocol, and the zone routing protocol, are used to enhance data communication. However, they fail to decrease the routing overhead. Thus, the developed clustering-based storage and search optimization approach model has enhanced adhoc features, such as addressing delay, energy consumption, and flexibility, and our main research analysis is based on the following questions: (1) How can node stability be maintained while transferring data in an adhoc network during failure? (2) How are intruders in the network who are waiting to attack at failure nodes analyzed?

Contribution
In this paper, a new clustering-based storage and search optimization approach using crosslayer analysis based on intrusion detection methods is proposed. To avoid the delay in data packet of the cloud environment and a significant increase in the route efficiency of adhoc mobile cloud computing networks, the following contributions are made in our research work: • First, this research quantification converts individual mobile nodes into mobile cluster nodes using the proposed clustering approach based on the storage and search optimization technique. • Second, this study helps address security issues and improve confidentiality without losing the delay, energy consumption, network lifetime, and link accomplishment characteristics.
• Finally, the hidden Markov model is used for stable data transition and distributions by preventing intrusions. This model helps address the security issues and confidentiality concerns of the adhoc mobile cloud computing network.
The remainder of the paper is organized as follows. In Section 2, the previous clustering approach, the storage and search optimization approach, and the hidden Markov model are discussed. In Section 3, we describe the proposed cross-layer analysis of intrusion detection methods using the clustering approach based on the storage and search optimization approach employed to enhance the adhoc mobile cloud computing network's performance. The experimental results are presented in Section 4, and the conclusions are shown in Section 5.

Related Works
Storage using an autonomous mobile infrastructure-based phoenix technique allows a system to make opportunistic use of mobile computing devices and adhoc networking to provide quick storage services to clients in a localized geographical region. A large amount of potential data is lost due to node mobility. An internode communication system can overcome the potential data loss through distributed communication and a storage protocol.
Pudlewski et al. [6] proposed a cross-layer perspective scheme for video transmission over lossy wireless networks. Li et al. [7] presented the construction of a dynamic cloudlet-assisted energy-saving routing mechanism for mobile adhoc networks. This approach detects the target nodes, where the intrusion is happening in network. Zhang et al. [8] proposed a communication workflow technology known as lightweight service-oriented architecture (SOA)-based multi-engine architecture for mobile smart devices.

Problem Definition
Panta et al. [9] proposed an opportunistic system combined with mobile computing and ad hoc networking for quick storage services. However, the hidden Markov model suppresses the slope current and interferes with adhoc mobile cloud computing networks [10]. A standard clusteringbased optimization model is required to allow the nodes to recover the original route and energy during transmission. This requirement affects issues, such as delay, energy consumption, network lifetime, and link accomplishment. This paper presents a simple and effective way of solving this problem and improving the cross-layer analysis based on the intrusion detection performance.
The main objectives of the proposed technique are as follows: • To propose a new clustering-based storage and search optimization technique to enhance the delay, the energy consumption, the network lifetime, and the link accomplishment for routing. • To introduce a cross-layer analysis method based on the intrusion detection technique to improve the data transition and distributions and help identify and prevent intrusions.
This article discusses the cross-layer analysis of intrusion detection methods using the clustering approach based on the storage and search optimization approach.
• Clustering-based storage and searching optimization model: we utilize the hybrid storage, search optimization, and clustering technique to maintain the delay, energy consumption, network lifetime, and link accomplishment characteristics.
• Here, the participating mobile nodes are first clustered using clustering-based storage. Then, the destination nodes are searched using the search optimization approach. • The hidden Markov model is used to obtain the required data transition ratio for the entire routing process. The main motivation behind utilizing the hidden Markov model is to improve the identification and prevention of intrusions. • The proposed approach can analyze intruders with a different route. The performance of the proposed approach is compared with that of existing state-of-art techniques in terms of accuracy, end-to-end delay, energy consumption, network lifetime, packet delivery ratio, and throughput.

System Model
In recent years, adhoc mobile cloud computing networks have become an efficient and exciting technology due to the rapid proliferation of communication devices in the wireless medium. Many mobile nodes wish to use adhoc mobile cloud computing network, but only restriction is high CPU power consumption and less battery life [11]. Here, routing protocols can be used to enhance the adhoc network communication, but several security issues remain as the main flaws. Route maintenance is another critical issue faced by adhoc networks and involves route search and storage [12].
Finding and recovering the exact route is challenging, because cross-layer analysis of intrusion detection methods uses Hidden Markov model for identifying and preventing intrusion in network [13]. Also, this method uses the clustering approach to rectify the security and confidentiality issues without losing data packets.
This research developed an innovative cross-layer analysis of intrusion detection methods for transmitting data in adhoc mobile networks. When the communication between nodes starts, cross layer focuses on clustering and route maintenance [14]. The proposed cross-layer analysis using clustering based on the storage and searching optimization approach is shown in Fig. 1 and explained in the following section [15,16].
Clustering can be facilitated by the cluster head nodes, which is energy-consuming, while data are transmitting in a wide range. Hence, a novel clustering algorithm is developed to reduce the energy utilization and improve the network lifetime.

Proposed System Architecture
The proposed adhoc mobile cloud computing network is established using cross-layer analysisbased intrusion detection methods with hidden Markova model [17,18]. This cross-layer analysis runs on cloud computing mechanisms and mobile adhoc networks, which extend the functionality of the analysis. Here, a practical mobile adhoc network denotes data sharing between different mobile nodes on a cloud environment [19]. The node's size is static for fast access between the cluster head and the nodes [20]. Hence, deciding which data should be present in the cloud or the mobile ad hoc network during interaction is crucial. Any mobile node can transfer stored data to the cloud. This facility allows unauthorized data (attacker data) to be stored in the cloud [21]. Each unauthorized data stored in the cloud will have a different token, which must be stored in the cloud [22]. The proposed clustering-based storage and search optimization approach (crosslayer analysis based on intrusion detection methods) was implemented on Network Simulator 3 (NS-3) [23]. This research employed the cross-layer analysis of intrusion detection (CLAID) methods as our key system for transferring and distributing data to the other nodes. Each node is identified by a token of its public/private key [24]. The complete application stack of any nearby node is illustrated in Fig. 2. Fig. 2 describes the complete application stack of the node with smart routing using cloud software codes. These codes helps in verifying detail about any transmission and raise the token [25]. The CLAID cluster tool is used to coordinate nodes between the authorized mobile device and different nodes.

Figure 1: Proposed cross-layer analysis intrusion detection model
CLAID is the content-addressable cloud environment's transmission model. This model is used to maintain the data transaction within the linked node on the cloud environment and unify all data transactions that link to the decentralized peer-to-peer cloud system [26]. Whenever the decentralized peer-to-peer cloud system receives a request from the clustering-based search optimization, the hidden Markov model first handles this request [27]. Further, CLAID forwards the request to the clustering-based storage and search optimization for the allocation of the route in the adhoc mobile cloud computing network. Later CLAID replies to its route history in network [28]. The data communication between the two authorized mobile devices is processed using the route request/route response (RREQ/RRES) signal. This system is distinguished for the hidden Markov Model based on the intrusion detection system's cross-layer analysis [29,30]. The route between the source node and the destination/target node is connected by the cloud head for the clustering-based storage and search optimization [31][32][33]. This storage model allows decentralized routing peer-to-peer applications based on the following key terms: • Clustering-based Storage: Data is stored in the interaction history.
• Clustering-based Searching: The content is store and organized during routing. The result based on the clustering-based storage is returned. • Optimization model: Optimization is a data rendering tool through which users perform query operations.

Clustering-Based Storage and Search Optimization Model
The model is an automatic process in router configuration that allows the tokens from one source node to another neighbor node to be used securely within an adhoc mobile cloud computing network [34]. When a token is generated, the individual routing identification related to any route interaction in the CLAID must be stored inside the adhoc mobile cloud computing network history. This approach helps improve the node routing integrity and security [35]. Conventionally, the actual route is generally referred to as the "authorized mobile device communication." Given that the proposed model calculates each node's distance in the network for transmitting data, the proposed cluster and route maintenance sets the distance between nodes to 0.2 which is next nearest value for alternate route calculation [36]. If the distance is greater than the condition, then the nodes are ignored [37,38]. Current routing activities are stored in the decentralized peer-to-peer system to be publicly accessible to the routing process for efficiency. Neighbor node token verification and route detection can decrease the waiting time for precise route confirmation [39]. In last few decades the decentralized peer-to-peer system helps to scale intruders by allowing suspectable attackers to form an unauthorized data transmission through the clustering-based storage and search optimization protocol.
The storage and search optimization algorithm can find nearby nodes by intending (route) to move toward a specific new_next_route node [40]. Search optimization equates the route nodes to the new_next_route nodes of the cloud server's cluster. If the storage and search optimization ends with the specific target discovery, then the remaining data are transferred to the nearby nodes. This process helps increases the data transmission speed and the routing efficiency [41][42][43].
The processing time of storage and search optimization is taken and compared with the transmission and RREQ/RRES times. Moreover, the adhoc mobile cloud computing network is a separate routing network connected to its source cluster using two-way communication. This communication is considered as the future communication, which allows node tokens and some other node properties to be used securely from source to destination. Fig. 3 represents how data is stored in CLAID using two-way communication [44].  [45,46]. This method checks whether the communicating node is active or not. If the node is inactive, then transmission overload occurs in the routing path; otherwise, temporal death occurs. This process results in imperfect packet broadcasting. The intrusion node suddenly changes in performance and reduces the packet delivery ratio.

Anomaly Detection with the Hidden Markov Model
Identification of abnormal behaviors: Identifying abnormalities is disturbed by detecting an anomaly as per the standard routing behaviors. A broad range of techniques, like clusteringbased storage and search optimization, adhoc mobile cloud computing network, and hidden Markov models, have been prospected as distinct ways of accepting an anomaly identification challenge. Established attacks provide outlier-based elucidation to avoid interruption in the realtime networks. It also helps to examine the procedure-based attacks and multidimensional routing traffic in networks.
The hidden-Markov-models-based identification of abnormalities in connection with CLAID-HMM creates two premises.
• First, all the mobile nodes count actual conditions in the cloud environment depending merely on the initial condition, forming a complex structure in the cloud environment. • Second, the efficiency of metrics depends on the authenticated source node hidden in the cloud server. This efficiency of metrics must account for this route history statement's incredibly low validity. • CPU utilization: According to the percentage of availability in utility of CPU, the collection of CPU utilization, interpretation of quantitative sending data and probability of expected outcome route to estimate population parameters are calculated for usage.
CUnode refers to the CPU utilization nodes, MSnode refers to the memory (stored data) node, and CCERREQ: RRES is the Cluster_count_Entry (RREQ/RRES). MS node is a threedimensional vector that represents the observed current state of Observe Storage, where 0 denotes a normal route and 1 denotes an abnormal route.
The crucial findings such as height of performance indicators causing anomalous conditions does not appear rapidly. Before performances achieved, the proportions of resource usage increase slowly toward the next_route point and it has potential for anomaly increases. A simple simulation scheme for changing the sampling distances dynamically depending on the degree of risk is introduced. The next _route _point is defined as follows: (Eq.

Result and Discussion
The developed clustering-based storage and search optimization approach (cross-layer analysis based on intrusion detection methods) is simulated using NS-3 to calculate the performance parameters, like the end-to-end delay, the energy consumption, the network lifetime, the packet delivery ratio, and the throughput. The simulation details using the proposed CLAID methods by the clustering approach based on the storage and search optimization approach are provided in Tab. 1.

Performance Metrics
The existing approaches such as MZBIDS [47] and EA-ICA [48] are compared with proposed CLAID technique which is based on storage and search optimization. CLAID calculates the QoS performance, such as the end-to-end delay, the energy consumption, the network lifetime, the packet delivery ratio, and the throughput. In addition, the area under the curve (AUC) is plotted for binary classification problems. AUC is the measure of a router's ability to distinguish between routes and summarize the score chart.
AUC Chart: An accurate system will detect the chart's intrusion, showing different values and stating the entire false positive and true positive rate (Fig. 4). In addition, the system also provides the accuracy of the proposed algorithm stated on the chart. With this data, the number of packets containing intrusion attacks is identified. To describe the efficiency established by CLAID methods', fine-tuned accuracy is evaluated based on the following action to achieve an accurate result [49].  Tab. 2 proves that the proposed CLAID method can achieve a high packet delivery ratio. The evaluated measures indicate that the existing MZBIDS obtains 92% in packet delivery ratio, whereas CLAID obtains 97% in packet delivery ratio. Furthermore, a high PDR value of 97.856% was obtained by the proposed method, which is more powerful than the other methods ( Fig. 6) [50].  Tab. 3 shows the throughput value of the proposed CLAID (Fig. 7). Throughputs of approximately 30 and 43 kbps are achieved through existing approaches, such as MZBIDS and EA-ICA. The efficiency of the proposed CLAID is also higher than the throughput performance of nearly 121 kbps. Fig. 8 and Tab. 4 describe the adequate energy used for any node in the transmission path and show the measured values. Furthermore, the comparisons between energy usage and current approaches are based on the comparison in Fig. 8.    The energy consumption of the nodes is estimated depending on the simulation time. The proposed CLAID model consumes minimal energy due to the minimal, efficient route. In an adhoc mobile cloud computing network, one of the required metrics to achieve successful connectivity is network lifetime. When the nodes' energy consumption is high, connecting with nodes to impact the network's lifespan is impossible. The energy consumption is minimal in this suggested method, indicating that the network's lifespan increased. Fig. 8 and Tab. 5 describe the network lifetime for many nodes and the testing with predominant approaches. When sending messages across 60 nodes, the existing MZBIDS and EA-ICA have network lifetimes of 220 and 350 s, but the proposed CLAID method's maximum network lifetime 627.133 s. The delay is measured to identify the time required to reach the destination of the transmitted data. The ratio of time consumed for receiving packets to the time consumed by the transmitted packets is measured using Eq. (6).
End-to-end delay = Time Duration (Received data packet) Time Duration (Transmitted data packets) End-to-end delay value of the proposed CLAID method and compares the value with those of existing techniques. Here, MZBIDS and EA-ICA obtain delay values of approximately 59 and 43 s, respectively. The proposed CLAID method also obtains a delay value of 14 ms. In comparison, the proposed CLAID obtains a lower delay value of 0.6 s when transmitting 10 nodes.

Conclusion
Adhoc mobile cloud computing networks face various issues, like delay, energy consumption, flexibility, infrastructure, network lifetime, security, stability, data transition, and link accomplishment issues. This research proposes the CLAID methods using the clustering approach based on the storage and search optimization approach to overcome the above issues against the routing in the cloud environment. These approaches are formed by cross-layer analysis is based on intrusion detection methods for clustering and route maintenance in an adhoc mobile cloud computing network. Hence, the developed clustering-based storage and search optimization approach model was evaluated using NS-3, and the outcomes were compared with those of existing methods, such as MZBIDS and EA-ICA, to evaluate parameters, like accuracy, end-to-end delay, energy consumption, network lifetime, packet delivery ratio, and throughput.

Conflicts of Interest:
The authors declare that they have no conflicts of interest to report regarding the present study.