In the above discussed architecture, there is one to one
relationship between every user and IDS instance assigned to
him i.e. every user will be assigned only one IDS instance by
the IDS controller. But there is many to many relationships
between IDS instance and node controller in cloud i.e. one
IDS instance can be connected to many node controllers and
one node controller can connect through many IDS instance.
Thus if any user uses more than one service in cloud, then he
will be connected to many node controllers through only one
IDS instance. The advantage of this kind of cardinality is that
all patterns of a particular user will be monitored by one
single IDS and hence it will be easier to detect intrusions.
Similarly, even if multiple users connect to the same node
controller, their activities will be monitored by different
instances of IDS and hence one user’s activities will not affect
other user.