[1,4]Deepa P Gopinath

[2]Thennal D K

These authors contributed equally to this work.

These authors contributed equally to this work.

These authors contributed equally to this work.

1]Dept. of Electronics and Commn. Engg, Government Engineering College,
Kozhikode, Kerala, India

[2]Dept.of Computer Science, IIIT, Kottayam, Kerala, India

3] State Project Facilitation Unit, Trivandrum, Kerala, India

4]A P J Abdul Kalam Technological University , Kerala, India

5]Product Manager, Trivandrum, Kerala, India

6]Software Developer, Trivandrum, Kerala, India

# IMaSC - ICFOSS Malayalam Speech Corpus

<EMAIL_ADDRESS><EMAIL_ADDRESS>Vrinda V Nair
<EMAIL_ADDRESS>Swaraj K S<EMAIL_ADDRESS>Sachin G
<EMAIL_ADDRESS>[  *  [  [  [  [

###### Abstract

Modern text-to-speech (TTS) systems use deep learning to synthesize speech
increasingly approaching human quality, but they require a database of high
quality audio-text sentence pairs for training. Malayalam, the official
language of the Indian state of Kerala and spoken by 35+ million people, is a
low resource language in terms of available corpora for TTS systems. In this
paper, we present _IMaSC_ , a Malayalam text and speech corpora containing
approximately 50 hours of recorded speech. With 8 speakers and a total of
34,473 text-audio pairs, _IMaSC_ is larger than every other publicly available
alternative. We evaluated the database by using it to train TTS models for
each speaker based on a modern deep learning architecture. Via subjective
evaluation, we show that our models perform significantly better in terms of
naturalness compared to previous studies and publicly available models, with
an average mean opinion score of 4.50, indicating that the synthesized speech
is close to human quality.

###### keywords:

Malayalam Speech Corpus, IMaSC, Text to Speech synthesis, Deep Learning, VITS

##  1 Introduction

Malayalam, one among the 22 scheduled languages111Languages included in the
VIII schedule of the Constitution of India of India, is the official language
of the state of Kerala and union territories Lakshadweep and Puducherry.
According to the Census of India (2011), Malayalam is the native language of
around 35 million people in India. A South Dravidian subgroup of the Dravidian
language family, it is also spoken by bilingual communities in contiguous
parts of Karnataka and Tamil Nadu and by Malayali communities in various parts
of the world (https://www.britannica.com/topic/Malayalam-language)222Total
users in all countries: 37,212,270 (L1: 36,512,270, L2: 700,000). Malayalam
orthogrophy is phonemic, with a one-to-one mapping of graphemes and phonemes
with very few exceptions (Manghat ., 2020). Over the years, it has
incorporated various aspects from other languages, with Sanskrit and later
English being the most noteworthy examples (Bright, 1999). Other major
languages whose vocabulary was integrated over the millennia include Arabic,
Dutch, Hindustani, Pali, Persian, Portuguese, Prakrit, and Syriac (Pillai,
1965).

Like many other Indian languages, Malayalam is also a low resourced language
in terms of availability of text-to-speech corpora. Choudhary et al. has noted
that the information technology support in Indian languages has been lagging
by decades compared to other languages like English, Japanese or Russian,
because of several factors including a lack of sufficient language resources
required for the development of such technology (Choudhary, 2021).

As an agglutinative language, complex words can be formed in Malayalam by
combining smaller words and morphemes (Premjith ., 2018). In Malayalam, there
is no absolute limit on the length and extent of agglutination. This results
in a wide variation in the number of graphemes per word, and inflections at
word or morpheme boundaries. These features engender the formation of a large
vocabulary that necessitates compilation of large corpora for speech related
applications (Srivastava ., 2020).

In this paper we present the Malayalam text and speech corpus created for the
development of TTS in Malayalam with the financial support of the
International Centre for Free and Open Source Software
(ICFOSS)333https://icfoss.in/, an autonomous organization set up by the
Government of Kerala for promoting free and open source software. Curated with
the help of linguists, the corpus consists of 34,473 sentences and 49.63 hours
of speech read in studio conditions by 8 speakers (4 male and 4 female).

Our corpus, named _IMaSC - ICFOSS Malayalam Speech Corpus_ , was evaluated by
building a TTS system for Malayalam based on a deep learning architecture.
Deep learning is opted in this work since techniques based on it have been
state-of-the-art in speech synthesis for many years (Srivastava ., 2020). Deep
learning algorithms learn from the given training data and build models for
achieving the required functionality, and as such the database for training is
critical in the performance of the model. In case of TTS, deep learning
algorithms learn all parameters of the speech, the language and the speaker
including intonation and duration patterns (Tan ., 2021). Deep learning
systems are also known for its data hungry nature (Marcus, 2018). These
factors make a TTS system based on deep learning the best option to evaluate
the sufficiency and quality of a speech corpus. _IMaSC_ is made publicly
available via Kaggle444https://kaggle.com/datasets/thennal/imasc and Hugging
Face555https://huggingface.co/datasets/thennal/IMaSC.

##  2 Related works

###  2.1 TTS corpus in Indian Languages

Owing to the lack of large text-to-speech corpora, the progress of developing
reliable text-to-speech systems for Indian languages has been relatively slow
(Srivastava ., 2020). One of the first efforts in this area is reported by
Prahallad et al. (Prahallad ., 2012). Baby et al. later developed a much
larger resource for Indian languages, IndicTTS, which contains about 8 hours
of speech data for 13 Indian languages (Baby ., 2016). Pradahan et al. used
this corpus to train text-to-speech systems for these 13 languages (Pradhan .,
2015). However, the data provided for each language in IndicTTS is
insufficient for training recent neural-network-based systems that can produce
natural, accurate speech according to Srivastava et al., who presented
IndicSpeech, a large scale text-to-speech corpus for 3 Indian languages aimed
at training neural TTS systems (Srivastava ., 2020). The mean opinion score
obtained for the TTS model trained on Malayalam corpus is lower than those
obtained for Hindi and Bengali corpora, which they attribute to the
fundamental characteristics of Malayalam, such as the morpho-phonemic changes
during word formation. They suggest that one of the solutions would be to
increase the size of the Malayalam corpus to cover a larger vocabulary. He et
al. presented multi-speaker corpora for 6 Indian languages, with approximately
6 hours of data for Malayalam split between 42 speakers (He ., 2020).

###  2.2 TTS corpus evaluation using deep learning models

A TTS speech corpus can be evaluated by testing the quality of synthetic
speech generated with the corpus (Dybkjær ., 2007). Ahmed et al. prepared a
phonetically balanced Bangla corpus and evaluated it using a Bangla neural
synthesizer based on Merlin, an open-source speech synthesis toolkit using
deep neural networks (Ahmad ., 2021). Deep learning architectures based on
Tacotron and Tacotron 2 were used for evaluation of CSS10 (Park Mulc, 2019),
LibriTTS (Zen ., 2019), Latvian corpus created by Dar‘gis et al. (Darg̀is .,
2020), DiDiSpeech (Guo ., 2021), KazakhTTS (Mussakhojayeva ., 2021), and TTS-
Portuguese Corpus (Casanova, Junior ., 2022). FastSpeech was used for the
evaluation of AISHELL-3 (Shi ., 2020) and Didispeech (Guo ., 2021).

Srivastava et al. released IndicSpeech, a corpus curated for 3 Indian
languages—Hindi, Malayalam and Bengali—with Deep Voice 3 models trained to
evaluate the corpus (Srivastava ., 2020). BU-TTS, a bilingual Welsh-English
speech corpus developed by Russell et al., was evaluated by training VITS
models, instead of a two stage architecture comprising of an aligner training
stage and a vocoder training stage like in most other architectures (Russell
., 2022).

##  3 Method

###  3.1 Corpus design

The task of compiling a phonetically rich corpus involves linguistic analysis
of a large raw text corpus, which we did in collaboration with linguists from
the Department of Linguistics, University of
Kerala666https://www.keralauniversity.ac.in/home.

####  3.1.1 Text collection

The text corpus was derived from Malayalam Wikipedia. Launched on December 21,
2002, the Malayalam edition is the leading Wikipedia among other South Asian
language Wikipedias in various quality metrics
(https://ml.wikipedia.org/wiki). It has grown to be a wiki containing 79,510
articles as of October 2022, and ranks 13th in terms of depth among Wikipedias
(https://en.wikipedia.org/wiki/Malayalam_Wikipedia). This choice was made
primarily because the articles of Wikipedia are in public domain and the scale
of the wiki is more than sufficient to compile a phonetically balanced
database. This enabled us to select a set of phonetically balanced sentences,
record the corresponding speech and release it in public domain without any
copyright infringements.

####  3.1.2 Preparation of text corpus

A dump777Dump is a large amount of data moved from one computer system, file,
or device to another of Malayalam Wikipedia was created by scraping888Web
scraping is the method used for extracting data from websites the website.
Preliminary data cleaning was done on the text files created from the dump.
The clean data thus obtained was separated into a set of sentences, and only
sentences composed entirely of Malayalam characters and punctuation were kept.
Sentences were sampled from this set and vetted by linguists for quality in
terms of naturalness, semantics and syntax. The sentences selected were
ensured to constitute a phonetically balanced text corpus.

###  3.2 Speaker selection

People capable of correct pronunciation, pleasing rhythm, and consistent
articulation were engaged for recording speech for TTS. The details of the
spectrum of speakers we engaged for our speech corpus generation are given in
Table 1. People of varying professional experience were selected for achieving
a diverse range of prosody and articulation. In case of multi-speaker TTS
systems, voices with different characteristics is preferable, since it gives
the user a wide spectrum of choices.

Table 1: Details of speakers Speaker | Speaker ID | Profession | Gender | Age
---|---|---|---|---
Joji V. T. | M1 | Linguist | Male | 28
Sonia Jose Gomez | F1 | TV Newsreader | Female | 43
Jijo Joy | M2 | Theatre Artist | Male | 26
Greeshma S. | F2 | Linguist | Female | 22
Anil Arjunan | M3 | Social Activist | Male | 48
Vidya S. | F3 | Theatre Artist | Female | 23
Sonu S. Pappachan | M4 | Political Science Researcher | Male | 25
Simla Mujeeb Rahiman | F4 | Research Assistant | Female | 24
|  |  |  |

###  3.3 Recording of speech

The recording was done in a soundproof recording studio in the Phonetics Lab
of the Department of Linguistics, University of Kerala. A RODE microphone was
used as the recording device, and the recording was sampled at 48 kHz, mono,
with 24 bit depth. The equipment settings were tailored to studio conditions
and the artist in question in order to produce high quality audio. The
distance between the speaker and the microphone was set in the range of 4-6
inches.

The scheme for quality control was formulated after experimentation with the
recording setup and recording process. Speaker F4, who was also a part of the
project team, was engaged for experimentation in this regard. It was found
that close monitoring and support during recording sessions is required to
ensure the consistency of the read speech and to reduce error rate as much as
possible. A project assistant closely monitored the recordings and noted down
discrepancies in comparison with the text, if any. The voice quality was
observed and intermittent breaks were given to the speakers to avoid fatigue.
Multiple sentences were read in one stretch which was later segmented.
Mismatches that occurred were corrected by rerecording the sentence. To ensure
quality recordings, for certain difficult sentences, a trial reading was
carried out before the actual recording. Particularly difficult sentences were
discarded by each speaker when deemed necessary.

###  3.4 Post processing and speech corpus compilation

The recorded voice files were segmented into sentences automatically by
detecting the silence between sentences. The automatically segmented speech
was evaluated and corrected manually. Each audio file was examined in
comparison with the corresponding text and corrections were made wherever
required. All the sentences in the text corpus were uniquely labelled and the
audio files carrying the corresponding speech were saved with a file name
matching the label.

The compiled speech corpus for each of the artists were again vetted by
language experts for mismatches between the articulated phonemes in the audio
file and those in the corresponding text file. Sentences with substantial
mismatches between text and audio were discarded. If the mismatch was slight,
then the text was corrected to match the audio. Through this process it was
ensured that the audio files and the corresponding text matched up to the
phonemic level. The resulting audio files were downsampled and saved as 16
kHz, 16-bit single-channel WAV files.

##  4 Evaluation of the database using a deep learning TTS system

Traditional neural TTS architectures use two separate components for
generative modeling, splitting the process into two stages. The first stage
generates from text an intermediate representation of speech features, such as
mel-spectrograms, using an acoustic model. The second stage synthesizes a raw
waveform from the intermediate representation via a neural vocoder. Those
models are trained separately and then joined for inference. Two-stage
pipelines, however, require a sequential and costlier training procedure, and
their dependence on predefined intermediate features prevents applying learned
hidden representations to improve performance further (Tan ., 2021; Kim .,
2021).

The VITS network is a parallel end-to-end architecture for TTS that
outperforms traditional two-stage architectures, and synthesizes natural
sounding speech extremely close to human quality (Kim ., 2021). VITS
circumvents the issues laden in two-stage pipelines by connecting the two
modules of TTS systems through latent variables to enable efficient end-to-end
learning. It is used as a baseline comparison model for advancements in recent
TTS methods and applications. Rijn et al. used a modified version of VITS for
personalized voice generation (van Rijn ., 2022), while Song et al. used
multi-speaker VITS as a base architecture for talking face generation (Song .,
2022). Casanova et al. modified the network to achieve state-of-the-art
results in zero-shot multi-speaker TTS and zero-shot voice conversion
(Casanova, Weber ., 2022). Russell et al. trained VITS models for evaluating
BU-TTS, a bilingual Welsh-English speech corpus (Russell ., 2022).

Due to its simplified training procedure and improved performance, we decided
to use VITS to evaluate the dataset over older but more common architectures
for TTS systems such as Tacotron or FastSpeech. The model was separately
trained for each of the 8 databases. The trained models were then used for
inference to generate synthetic audio to be evaluated via a mean opinion score
survey.

Figure 1: Word cloud representation of the text in _IMaSC_

##  5 Results

###  5.1 Details of _IMaSC_

Table 2: Details of Speech corpus and corresponding text Speaker | Time (HH:MM:SS) | Sentences | Words | Phonemes
---|---|---|---|---
Total | Unique | Total | Unique
M1 | 06:08:55 | 4,332 | 28,508 | 15,912 | 239,066 | 56
F1 | 05:22:39 | 4,294 | 28,196 | 16,221 | 237,405 | 56
M2 | 05:34:05 | 4,093 | 26,742 | 15,223 | 226,715 | 56
F2 | 06:32:39 | 4,416 | 29,015 | 16,358 | 243,611 | 56
M3 | 05:58:34 | 4,239 | 27,777 | 15,937 | 235,163 | 56
F3 | 04:21:56 | 3,242 | 21,489 | 13,087 | 177,120 | 56
M4 | 06:04:43 | 4,219 | 27,390 | 15,599 | 233,467 | 56
F4 | 09:34:21 | 5,638 | 36,664 | 20,649 | 318,841 | 56
Total | 49:37:54 | 34,473 | 225,781 | 23,604 | 1,911,388 | 56
|  |  |  |  |  |
Figure 2: Logarithmic plot of word rank versus word frequency in the text
corpus of 8 speakers Figure 3: Plot of phoneme rank versus phoneme frequency
in the text corpus of 8 speakers Figure 4: Histogram of the number of words in
each sentence Figure 5: Violin plot indicating the distribution of duration of
audio samples for each speaker

488,249 sentences were obtained from Wikipedia dump, from which 8,853 unique
sentences were obtained after linguistic evaluation and processing as outlined
in sections 3.1 and 3.4. The details of the speech corpus and the
corresponding text of each speaker after quality check and data cleaning is
given in Table 2. The recorded speech of F4 is significantly higher than the
rest of the speakers, since she was engaged in experimental recording sessions
and her recorded speech was analysed for formulating the quality control
process.

The word cloud representation of the 36,589 words in the text corpus of
_IMaSC_ is given in Fig. 1. The word cloud indicates the most frequent words
and provides a broad visual description of the words in the database. A close
look into the word cloud reveals that the number of characters per word varies
widely, indicating the agglutinative nature of Malayalam.

The frequency of the words in the text corpus for each speaker and its
corresponding rank was found. The logarithmic plot of the word rank versus
frequency is given in Fig. 2. It can be observed that the plot follows Zipf’s
law, which states that the frequency of any word is inversely proportional to
its rank (Sicilia-Garcia ., 2002). A plot of phoneme rank versus phoneme
frequency, given in Fig. 3, also follows a power law.

A histogram of the number of words per sentence read by the 8 speakers is
given in Fig. 4. It shows that more than 30% of the sentences are 6 words
long. It can be noted that F4 has spoken the longest sentences in terms of
number of words (14 words).

The distribution of duration of audio samples for each speaker is given in
Fig. 5. It can be seen that the duration of the audio samples in general lie
between 2s to 8s. The minimum variation is for speaker F1 (approximately 2s to
9s) and maximum for F4 (approximately 1s to 15s). Longer duration audio is to
be expected for F4 as she has spoken comparatively longer sentences. The
variation of distribution of duration between the speakers is due to diversity
in the manner of articulation and variation in the set of sentences read by
the speakers.

The scatterplot of the text length (number of characters) in each sentence and
the duration of its corresponding audio is given in Fig. 6. The text length
for each sentence correlates linearly with corresponding audio duration as per
the scatterplot. It also shows that text length mostly ranges between 40 to
100 and the corresponding duration between 2s to 8s. F4 has the audio sample
with the maximum text length (160). The range of duration values as seen in
this plot is in tune with that of the violin plot in Fig. 5.

Figure 6: Scatterplot of number of characters in each sentence and the
duration of its corresponding audio Figure 7: Scatterplot of number of words
in each sentence and the duration of its corresponding audio

The number of words in the sentence also correlates similarly with audio
duration as per the scatterplot in Fig. 7, though with significantly more
variation. This is again a consequence of agglutination in Malayalam, with the
length of a word varying widely. For example, in the case of sentences with 6
words, the duration varies from 2s to 10s. It is noted that F4 has more
instances of longer sentences in terms of duration and number of words. The
same fact is also seen in Fig. 5 and Fig. 6.

The analysis of the corpus shows that _IMaSC_ has covered a large variety of
words and consists of speech with different articulation styles. These
features can make it a suitable candidate for training a deep learning TTS
system with multiple speakers and speaking styles.

###  5.2 Evaluation of _IMaSC_ using VITS

We used the public VITS implementation available at Coqui
TTS999https://github.com/coqui-ai/TTS. The character set for Malayalam,
including punctuation, was directly tokenized as Malayalam characters have
close to a one-to-one correspondence with phonemes. Tokenized raw text and the
corresponding speech were used for training. A separate model for each speaker
was trained to evaluate their datasets individually. Each model was trained
for 60k steps on a Tesla P100 GPU.

In TTS, the input character sequences and the output audio sequences are of
different length, and VITS uses duration modeling and encoder-decoder
attention mechanisms to capture the duration of influence of each character.
In order to transform a sequence of characters $c$ to a larger sequence of
latent variables representing speech $z$, an alignment between the two
sequences are required. In VITS, the alignment is a hard monotonic attention
matrix with $|c|\times|z|$ dimensions representing how long each input
character expands to be time-aligned with the target speech.

The visualized attention matrices of the trained models for synthesis of a
sample sentence from the test set is given in Fig. 8. We observe that the
attention matrices look approximately diagonal, indicating that the sequence
of latent variables is properly aligned with the sequence of input characters.

Figure 8: The attention matrix visualized as a binary heatmap.

####  5.2.1 Mean Opinion Score

We conducted a crowd-sourced Mean Opinion Score (MOS) test with 20
participants for evaluating the models. 10 sentences were randomly selected
from the test dataset to be synthesized, and 2 sentences, along with their
corresponding audio, were chosen for evaluating ground truth. In the survey,
each speaker thus had 12 text-audio pairs to be evaluated, repeated for all 8
speakers for a total of 96 questions. The different audio samples were each
scored on a 5-point scale for naturalness, with 5 being excellent, 4 being
good, 3 being fair, 2 being poor, and 1 being bad.

Table 3 gives the score obtained for each of the 8 speakers. The MOS for
ground truth and synthesized speech for each speaker is detailed in the table.
A comparison between our models and previous TTS systems for Malayalam is
given in Table 5.

Table 3: Mean Opinion Score of the speech synthesized from recorded database of each of the 8 speakers and average MOS Speaker | Synthesized Speech | Ground Truth
---|---|---
M1 | $4.60\pm 0.09$ | $4.75\pm 0.19$
F1 | $4.48\pm 0.11$ | $4.75\pm 0.19$
M2 | $4.38\pm 0.11$ | $4.58\pm 0.23$
F2 | $4.55\pm 0.10$ | $4.65\pm 0.26$
M3 | $4.46\pm 0.12$ | $4.68\pm 0.23$
F3 | $4.58\pm 0.10$ | $4.90\pm 0.14$
M4 | $4.46\pm 0.12$ | $4.55\pm 0.26$
F4 | $4.54\pm 0.11$ | $4.58\pm 0.23$
Average MOS | $\boldsymbol{4.50}\pm\boldsymbol{0.04}$ | $\boldsymbol{4.68}\pm\boldsymbol{0.08}$
|  |

###  5.3 Comparison of _IMaSC_ with other TTS corpora

Table 4 provides a comparison of _IMaSC_ with other publicly available
Malayalam TTS corpora. We note that _IMaSC_ is significantly larger than
previous corpora both in number of sentences and hours of recorded audio.
IndicSpeech employs a single female speaker while Baby et al. employs one male
and one female, as compared to our 4 male and 4 female speakers. He et al.
uses crowdsourcing to record audio and thus has 42 speakers (18 male and 24
female), but with only 5.51 hours of total speech, each speaker has an average
of less than 8 minutes of speech. A single-speaker TTS system is thus
infeasible. We also note that in contrast to the crowdsourcing approach, our
speaker selection is deliberate and intended to represent a range of prosody
and articulation styles while maintaining clear and comprehensive speech, as
detailed in Section 3.2.

The aforementioned corpora each have TTS systems trained on them, and we
compare their reported MOS scores to our own in Table 5. Our TTS system
performs significantly better, with an average MOS score extremely close to
ground truth. We note that He et al. trains two different multi-speaker TTS
models for male and female speakers, and we average their separately reported
MOS scores and confidence intervals.

Table 4: Comparison of _IMaSC_ with other TTS corpora in terms of text size Database | Sentences | Total Words | Hours | Number
---|---|---|---|---
|  |  |  | of speakers
Baby et al. | 11,300 | 58,098 | 17.89 | 2
IndicSpeech | 19,954 | 109,245 | 29.1 | 1
He et al. | 4,126 | 25,330 | 5.51 | 42
IMaSC | 34,473 | 225,781 | 49.63 | 8
|  |  |  |
Table 5: Comparison of _IMaSC_ with other TTS corpora in terms of average MOS score of TTS built on each of these Model | Mean Opinion Score
---|---
Public API | $3.32$
IndicSpeech | $3.87$
He et al. | $4.01\pm 0.13$
IMaSC | $\boldsymbol{4.50}\pm\boldsymbol{0.04}$
|

##  6 Conclusion

In this work, we presented _IMaSC_ , a Malayalam text and speech corpora that
aims to address the lack of publicly available data for TTS applications. With
49 hours and 37 minutes of audio, 8 speakers and 34,473 text-audio pairs,
_IMaSC_ is larger than any other public Malayalam text and speech corpus by a
wide margin, with proper care taken for quality control. We trained end-to-end
TTS models for each speaker based on the VITS architecture to evaluate the
database, and conducted a subjective MOS survey with 20 participants. We
reported an average MOS score of 4.50 for speech synthesized with our models,
close to the ground truth of 4.68. With an average of more than 6 hours per
speaker across 8 speakers, _IMaSC_ will enable the development of multi-
speaker text to speech synthesis systems, which provides the user with a
choice of selecting synthesized speech with prosody and other voice qualities
of their choice.

Acknowledgments

We would like to thank the International Centre for Free and Open Source
Software (ICFOSS), an autonomous organization set up by the Government of
Kerala for promoting free and open source software for funding the project. We
also acknowledge the support rendered by Shijith S. and other linguists at
Department of Linguistics, University of Kerala in different stages of the
database creation.

## References

  *   * Ahmad . (2021) ahmad2021sustAhmad, A., Selim, M.R., Iqbal, M.Z. Rahman, M.S.  2021\.  SUST TTS Corpus: A phonetically-balanced corpus for Bangla text-to-speech synthesis SUST TTS Corpus: A phonetically-balanced corpus for Bangla text-to-speech synthesis.  Acoustical Science and Technology426326–332.
  * Baby . (2016) baby2016resourcesBaby, A., Thomas, A.L., Nishanthi, N., Consortium, T. .  2016\.  Resources for Indian languages Resources for Indian languages.  Proceedings of Text, Speech and Dialogue. Proceedings of text, speech and dialogue.
  * Bright (1999) bright1999reBright, W.  1999\.  RE Asher & TC Kumari, Malayalam.(Descriptive grammars.) London & New York: Routledge, 1997. Pp. xxvi, 491. RE Asher & TC Kumari, Malayalam.(Descriptive grammars.) London & New York: Routledge, 1997. Pp. xxvi, 491.  Language in Society283482–483.
  * Casanova, Junior . (2022) casanova2022ttsCasanova, E., Junior, A.C., Shulby, C., Oliveira, F.S.d., Teixeira, J.P., Ponti, M.A. Aluísio, S.  2022\.  TTS-Portuguese Corpus: a corpus for speech synthesis in Brazilian Portuguese TTS-Portuguese Corpus: a corpus for speech synthesis in Brazilian Portuguese.  Language Resources and Evaluation1–13.
  * Casanova, Weber . (2022) casanova2022yourttsCasanova, E., Weber, J., Shulby, C.D., Junior, A.C., Gölge, E. Ponti, M.A.  2022\.  Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone Yourtts: Towards zero-shot multi-speaker tts and zero-shot voice conversion for everyone.  International Conference on Machine Learning International conference on machine learning ( 2709–2720).
  * Choudhary (2021) choudhary2021ldcChoudhary, N.  2021\.  LDC-IL: The Indian repository of resources for language technology LDC-IL: The Indian repository of resources for language technology.  Language Resources and Evaluation553855–867.
  * Darg̀is . (2020) dargis2020developmentDarg̀is, R., Paikens, P., Gruzitis, N., Auziņa, I. Akmane, A.  2020\.  Development and Evaluation of Speech Synthesis Corpora for Latvian Development and Evaluation of Speech Synthesis Corpora for Latvian.  Proceedings of the 12th Language Resources and Evaluation Conference Proceedings of the 12th language resources and evaluation conference ( 6633–6637).
  * Dybkjær . (2007) dybkjaer2007evaluationDybkjær, L., Hemsen, H. Minker, W.  2007\.  Evaluation of text and speech systems Evaluation of text and speech systems ( 38).  Springer Science & Business Media.
  * Guo . (2021) guo2021didispeechGuo, T., Wen, C., Jiang, D., Luo, N., Zhang, R., Zhao, S.others  2021\.  Didispeech: A large scale mandarin speech corpus Didispeech: A large scale mandarin speech corpus.  ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) Icassp 2021-2021 ieee international conference on acoustics, speech and signal processing (icassp) ( 6968–6972).
  * He . (2020) he-etal-2020-openHe, F., Chu, SH.C., Kjartansson, O., Rivera, C., Katanova, A., Gutkin, A.Pipatsrisawat, K.  202005\.  Open-source Multi-speaker Speech Corpora for Building Gujarati, Kannada, Malayalam, Marathi, Tamil and Telugu Speech Synthesis Systems Open-source Multi-speaker Speech Corpora for Building Gujarati, Kannada, Malayalam, Marathi, Tamil and Telugu Speech Synthesis Systems.  Proceedings of The 12th Language Resources and Evaluation Conference (LREC) Proceedings of the 12th language resources and evaluation conference (lrec) ( 6494–6503).  Marseille, FranceEuropean Language Resources Association (ELRA).  https://www.aclweb.org/anthology/2020.lrec-1.800
  * Kim . (2021) kim2021conditionalKim, J., Kong, J. Son, J.  2021\.  Conditional variational autoencoder with adversarial learning for end-to-end text-to-speech Conditional variational autoencoder with adversarial learning for end-to-end text-to-speech.  International Conference on Machine Learning International conference on machine learning ( 5530–5540).
  * Manghat . (2020) manghat2020malayalamManghat, S., Manghat, S. Schultz, T.  2020\.  Malayalam-English Code-Switched: Grapheme to Phoneme System. Malayalam-English Code-Switched: Grapheme to Phoneme System.  INTERSPEECH Interspeech ( 4133–4137).
  * Marcus (2018) marcus2018deepMarcus, G.  2018\.  Deep learning: A critical appraisal Deep learning: A critical appraisal.  arXiv preprint arXiv:1801.00631.
  * Mussakhojayeva . (2021) mussakhojayeva2021kazakhttsMussakhojayeva, S., Janaliyeva, A., Mirzakhmetov, A., Khassanov, Y. Varol, H.A.  2021\.  Kazakhtts: An open-source kazakh text-to-speech synthesis dataset Kazakhtts: An open-source kazakh text-to-speech synthesis dataset.  arXiv preprint arXiv:2104.08459.
  * Park Mulc (2019) park2019css10Park, K. Mulc, T.  2019\.  Css10: A collection of single speaker speech datasets for 10 languages Css10: A collection of single speaker speech datasets for 10 languages.  arXiv preprint arXiv:1903.11269.
  * Pillai (1965) skunjanpillaiPillai, S.K.  1965\.  Malayalam Lexicon Malayalam Lexicon.  University of Kerala.
  * Pradhan . (2015) pradhan2015buildingPradhan, A., Prakash, A., Shanmugam, S.A., Kasthuri, G., Krishnan, R. Murthy, H.A.  2015\.  Building speech synthesis systems for Indian languages Building speech synthesis systems for Indian languages.  2015 Twenty First National Conference on Communications (NCC) 2015 twenty first national conference on communications (ncc) ( 1–6).
  * Prahallad . (2012) prahallad2012iiitPrahallad, K., Kumar, E.N., Keri, V., Rajendran, S. Black, A.W.  2012\.  The IIIT-H Indic speech databases The IIIT-H Indic speech databases.  Thirteenth annual conference of the international speech communication association. Thirteenth annual conference of the international speech communication association.
  * Premjith . (2018) premjith2018deepPremjith, B., Soman, K. Kumar, M.A.  2018\.  A deep learning approach for Malayalam morphological analysis at character level A deep learning approach for Malayalam morphological analysis at character level.  Procedia computer science13247–54.
  * Russell . (2022) russell2022buRussell, S.J., Jones, D.B. Prys, D.  2022\.  BU-TTS: An Open-Source, Bilingual Welsh-English, Text-to-Speech Corpus BU-TTS: An Open-Source, Bilingual Welsh-English, Text-to-Speech Corpus.  LREC 2022 Workshop Language Resources and Evaluation Conference 20-25 June 2022 Lrec 2022 workshop language resources and evaluation conference 20-25 june 2022 ( 104).
  * Shi . (2020) shi2020aishellShi, Y., Bu, H., Xu, X., Zhang, S. Li, M.  2020\.  Aishell-3: A multi-speaker mandarin tts corpus and the baselines Aishell-3: A multi-speaker mandarin tts corpus and the baselines.  arXiv preprint arXiv:2010.11567.
  * Sicilia-Garcia . (2002) sicilia2002extensionSicilia-Garcia, E.I., Ming, J., Smith, F.J. .  2002\.  Extension of Zipf’s law to words and phrases Extension of Zipf’s law to words and phrases.  COLING 2002: The 19th International Conference on Computational Linguistics. Coling 2002: The 19th international conference on computational linguistics.
  * Song . (2022) song2022talkingSong, HK., Woo, S.H., Lee, J., Yang, S., Cho, H., Lee, Y.Kim, Kw.  2022\.  Talking Face Generation with Multilingual TTS Talking Face Generation with Multilingual TTS.  Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Proceedings of the ieee/cvf conference on computer vision and pattern recognition ( 21425–21430).
  * Srivastava . (2020) srivastava2020indicspeechSrivastava, N., Mukhopadhyay, R., Prajwal, K. Jawahar, C.  2020\.  Indicspeech: text-to-speech corpus for Indian languages Indicspeech: text-to-speech corpus for Indian languages.  Proceedings of the 12th language resources and evaluation conference Proceedings of the 12th language resources and evaluation conference ( 6417–6422).
  * Tan . (2021) tan2021surveyTan, X., Qin, T., Soong, F. Liu, TY.  2021\.  A survey on neural speech synthesis A survey on neural speech synthesis.  arXiv preprint arXiv:2106.15561.
  * van Rijn . (2022) van2022voicemevan Rijn, P., Mertes, S., Schiller, D., Dura, P., Siuzdak, H., Harrison, P.Jacoby, N.  2022\.  VoiceMe: Personalized voice generation in TTS VoiceMe: Personalized voice generation in TTS.  arXiv preprint arXiv:2203.15379.
  * Zen . (2019) zen2019librittsZen, H., Dang, V., Clark, R., Zhang, Y., Weiss, R.J., Jia, Y.Wu, Y.  2019\.  LibriTTS: A corpus derived from LibriSpeech for text-to-speech LibriTTS: A corpus derived from LibriSpeech for text-to-speech.  arXiv preprint arXiv:1904.02882.


Determining Training Needs for Cloud Infrastructure Investigations using
I-STRIDE Joshua I. James, Ahmed F. Shosha, Pavel Gladyshev 11institutetext:
Digital Forensic Investigation Research Group: ASP Region
Soon Chun Hyang University
Shinchang-myeon, Asan-si, South Korea
22institutetext: Digital Forensic Investigation Research Group: Europe
University College Dublin
Belfield, Dublin 4, IE

# Determining Training Needs for Cloud Infrastructure Investigations using
I-STRIDE

Joshua I. James 11 Ahmed F. Shosha 22 Pavel Gladyhsev 22

###### Abstract

As more businesses and users adopt cloud computing services, security
vulnerabilities will be increasingly found and exploited. There are many
technological and political challenges where investigation of potentially
criminal incidents in the cloud are concerned. Security experts, however, must
still be able to acquire and analyze data in a methodical, rigorous and
forensically sound manner. This work applies the STRIDE asset-based risk
assessment method to cloud computing infrastructure for the purpose of
identifying and assessing an organization’s ability to respond to and
investigate breaches in cloud computing environments. An extension to the
STRIDE risk assessment model is proposed to help organizations quickly respond
to incidents while ensuring acquisition and integrity of the largest amount of
digital evidence possible. Further, the proposed model allows organizations to
assess the needs and capacity of their incident responders before an incident
occurs.

###### Keywords:

Digital Forensic Investigation; Incident Response; Capability Assessment;
Cloud Forensics; I-STRIDE; Asset-based Risk Assessment; Security Policy

##  1 Introduction

New concepts in cloud computing have created new challenges for security teams
and researchers alike Vouk2008 . Cloud computing service and deployment models
have a number of potential benefits for businesses and customers, but security
and investigation challenges – some inherited from ‘traditional’ computing,
and some unique to cloud computing – create uncertainty and potential for
abuse as cloud technologies proliferate.

According to a survey from Ponemon Institute Ponemon2011 , only 35% of IT
respondents and 42% of compliance respondents believe their organizations have
adequate technologies to secure their Infrastructure as a Service (IaaS)
environments. The report shows that respondents believe IaaS is less secure
than their on-premise systems, however, “[m]ore than half (56 percent) of IT
practitioners say that security concerns will not keep their organizations
from adopting cloud services”. A drive towards cloud service offerings is
reiterated by Gartner Gartner2012 , who forecasts that spending on cloud
computing at each service model layer will more than double by 2016. At the
same time Ernst and Young EY2011  found that there is a perceived increase in
risk by adopting cloud and mobile technologies, and many respondents believe
that these risks are not currently being adequately dealt with. However, North
Bridge Skok2012  suggests that confidence in cloud computing is increasing,
even though maturity of the technologies remains a concern.

An increased confidence in cloud computing and a drive to improve business
processes while reducing costs are leading to security of such systems
sometimes being a secondary concern. This attitude has somewhat been carried
over from traditional computing, which could possibly result in the same, or
similar, security challenges, such as those presented by the Computer Research
Association CRA2003  in the Four Grand Challenges in Trustworthy Computing. If
both security and insecurity from traditional computing are inherited by cloud
computing, both may be augmented with the increased complexity of the cloud
model, the way that services are delivered, and on-demand extreme-scale
computing. Each cloud deployment and service model has its own considerations
as far as security and liability are concerned. For example, in a private,
single-tenant cloud where all services may be hosted on-premise, the risks are
similar to on-premise, non-cloud hosting. The organization has end-to-end
control, can implement and target security systems, and can control critical
data flow and storage policies. A challenge with this model is that the
organization must have the capability to be able to create, implement, and
maintain a comprehensive security strategy for increasingly complex systems.

Several works have previously examined some cloud security concerns
Armbrust2009 ; Jansen2011 ; Balduzzi2012 ; Kui2012 ; Zissis2012 ; Dykstra2012
; Ruan2013 . This work, however, is concerned with an organization’s ability
to assess the investigation and response capability of their investigators
considering the organization’s unique needs. Security groups, such as the
National Institute of Standards and Technology, have previously called for
digital forensic readiness to be included in incident response planning
Kent2006 . However, determining the required capabilities of investigators has
not been directly addressed. Prior works, such as Kerrigan Kerrigan2013
proposed a capability maturity model for digital investigations. Such maturity
models essentially focus on assessing how standardized knowledge and processes
are in a particular organization, and how well these organizations actually
conform to these standards. While technical capability of digital
investigators is a factor, this model does not include assessment of specific
technical needs of an organization. Pooe and Labuschange Pooe2012  proposed a
model for assessing digital forensic readiness that includes identification of
more specific technical challenges; however, this model too does not help
guide an organization in specifically defining their internal digital
investigation capability needs in regards to the technical skills.

###  1.1 Contribution

This work proposes a method to guide organizations in determining the
technical skills needed for incident response and digital investigations that
are tailored specifically to the organization. The proposed method uses an
extension of a previously known asset-based risk assessment model to help
guide an organization and prepare for digital investigations, including
determination of technical training that is specifically required for
investigators within the organization.

The remainder of this paper first discusses related prior work for assessing
risk to cloud infrastructure. After, a method is described for assessing
investigation capability based on an organizational risk assessment. A case
study is then given applying the proposed model to cloud infrastructure. In-
house knowledge can be questioned based on the identification and
prioritization of risks, and gaps in knowledge may be identified from which
specified training areas can be defined. Finally, conclusions are given and
potential future work is discussed.

##  2 Assessing Risk to Cloud Infrastructure

To help in the identification of threats, their impact on a system, potential
evidential traces and technical skill needed by investigators, an extension to
the six-category, threat categorization model – ‘Spoofing, Tampering,
Repudiation, Information Disclosure, Denial of Service, and Elevation of
Privilege’ (STRIDE) Swiderski2004  – is proposed. The STRIDE model is a threat
categorization model that can be used to help understand the impact of a
specific threat being exploited in a system MSDN2005 . It helps to determine
vectors of attack, the impact of an attack on data, and the overall impact to
the organization due to the altered - or loss of - data. The STRIDE model has
previously been applied to probabilistic risk assessment in cloud environments
Saripalli2010 , threat modeling using fuzzy logic Sodiya2007 , among others.

James, Shosha et al. James2013  previously proposed an extension to the STRIDE
model beyond risk assessment and potential exploitation results, to add the
identification of possible investigation-relevant traces produced by the
exploitation, named the “Investigation STRIDE model”, or I-STRIDE.

Figure 1: The I-STRIDE process model for risk assessment, mitigation and
investigation

As shown in Figure 1, the I-STRIDE process is conducted by first
deconstructing a service into its dependent components. A risk assessment is
conducted per component, and risk mitigation techniques are derived. Each risk
identified by I-STRIDE has associated investigation-relevant data sources.
When a threat to a component has been identified, an investigator may
determine what data is likely to be effected by the threat. From this subset
of affected data, specific data sources that may be of evidential value can be
identified. These potential evidential data sources may then be used for pre-
investigation planning and data targeting purposes.

Determining forensic investigation knowledge required to investigate a
particular threat can be modeled using risk analysis and assessment
techniques. In particular, risk assessment models such as Root Cause Analysis
(RCA) Stephenson2003  can be used to help identify required training. Broadly
speaking, RCA is used to identify the root cause of an event that causes a
phenomena of interest. Thus, RCA in combination with the proposed I-STRIDE
model can be used as a basis to identify training related to the investigation
of identified threats (Figure 2).

Figure 2: Root Cause Analysis to guide forensic investigation training
Stephenson, Peter. ”Modeling of post-incident root cause analysis.”
International Journal of Digital Evidence 2.2 (2003): 1-16.

Utilizing methodologies such as RCA benefits not only the process of training
identification, or gaps in knowledge, but also training efficacy. When
considering investment in training, organizations attempt to determine whether
a specific training meets their unique needs. By identifying gaps in knowledge
related to prioritized organizational risks, training can be more focused at
areas the organization specifically needs. As such, training can be audited
according to the identified training objectives and scope based on the needs
of the organization.

##  3 Incident Response Planning and Capability Assessment

An important step in Incident Response – if not the most important – is the
readiness phase. In the integrated digital investigation process (IDIP) model,
Carrier and Spafford Carrier2003  state that “the goal of the readiness phases
is to ensure that the operations and infrastructure are able to fully support
an investigation”. The operations readiness phase involves the on-going
training of personnel, such as first responders and lab technicians, and the
procurement and testing of equipment needed for the investigation. However,
while general training may be applicable to each organization, an organization
may have specific training needs that need to be identified.

For example, operational readiness in cloud environments should include
education in cloud-related technologies, such as hypervisors, virtual machines
and cloud-based storage, but may specifically depend on what services the
organization is providing. Personnel should have general knowledge of how to
interact with cloud technologies at the infrastructure, platform and software
layers, and understand the effect their actions have on the environment. They
should understand the methods and tools available to collect investigation-
relevant data in each layer of the cloud. Different Cloud Service Providers
(CSP) may have proprietary systems, so training on the use and investigation
of these proprietary systems should be considered. However, determination of
exactly what skills and knowledge are necessary to ensure quality
investigations may be difficult. Further, identifying what technologies should
be the focus of technical training may not be fully known.

The training of personnel, identification of potential risks, and
identification of potential data sources before an incident occurs can greatly
help in efficient incident response, and with the timely and sound acquisition
of relevant data. For this reason this work recommends organizations model
threats, their potential impact, and potential evidential trace data sources
before an incident occurs. This will assist the CSP in preserving potential
evidence during incident response, and will help law enforcement have a better
idea of what data will be available, and how to handle such data, if a
particular incident occurs.

##  4 Methodology

The proposed knowledge identification method is broken into two areas of
assessment: Technology (security) risk and Knowledge (training/education)
risk. Assessment of ‘knowledge risk’ is necessary because simply knowing a
technical vulnerability exists will not aid in incident response or
investigation unless the responder/investigator has knowledge of concepts such
as where relevant evidential data may exist and how to properly acquire such
data. Below are both the Technology risk and knowledge risk assessment
processes.

  * •

Technology Risk Assessment (I-STRIDE)

    1. 1.

Identify Assets

    2. 2.

Identify Threats to Assets

    3. 3.

Determine Potential Threat Impact

    4. 4.

Determine Potential Evidential Data Sources (Pre-Investigation)

    5. 5.

Prioritize Threats

       * –

Organizational needs

       * –

Common Vulnerability Scoring System (CVSS) NIST

  * •

Knowledge Risk Assessment

    1. 1.

Identify required investigation knowledge

    2. 2.

Assess current in-house knowledge

       * –

Knowledge of the collection/analysis of associated evidential data sources

    3. 3.

Compare in-house knowledge with risk prioritization

Knowledge risk in this case can be assessed based on Bloom’s Taxonomy
Anderson2005a . Using Bloom’s Taxonomy in-house knowledge could be assessed,
either through self-assessment or a more formal process. The Taxonomy would
allow an organization to understand the level of knowledge they possess about
the investigation of breaches caused by the specific vulnerability.

Bloom’s Taxonomy has 6 ‘verbs’ that correspond to a level of knowledge:
remembering, understanding, applying, analyzing, evaluating, and creating.
Knowledge of a vulnerability or evidential data sources can be assessed based
on these levels of knowledge. As such, a score can be assigned to each level
(1 - 6), which can be considered the knowledge risk score. Such a score
implies that higher-level knowledge such as an ability to analyze and evaluate
a topic is preferred over simple remembering.

If an organization is also using a threat prioritization metric – such as the
CVSS – then these scores can be combined to create a ‘knowledge
prioritization’ model. For example, with CVSS a score of 1 indicates a low
risk, where a score of 10 indicates a high risk. In Bloom’s taxonomy a score
of 1 indicates low knowledge, and a score of 6 indicates higher-level
knowledge. Assume CVSS is used to assess the severity of a threat (1 being
least severe, 10 being the most severe). Bloom’s taxonomy measures can be
scaled to the same scale as CVSS, and the knowledge risk can be subtracted
from the technology risk as so:

$T_{s}-((K_{s}\div K_{max})\cdot T_{max})$

where:

  * •

$T_{s}$ is the technology risk score

  * •

$K_{s}$ is the knowledge risk score

  * •

$K_{max}$ is the maximum knowledge risk score

  * •

$T_{max}$ is the maximum technology risk score

In this case, if the technology risk score is high (10 out of 10), and the
knowledge risk score is also high (6 out of 6), then the knowledge priority
will be low (0) in terms of training or education needs. If the technology
risk score is low (2 out of 10), and the knowledge risk score is also low (1
out of 6), then the overall knowledge priority will still remain low (0.33).
The threats with the highest priority will be high-scoring technology risks
that the organization has little knowledge about. Further, as knowledge is
updated (either gained or lost) knowledge risk can also be updated to reflect
the current state of knowledge in the organization.

Again, this prioritization is used to identify areas where investigation
education or training is lacking and supplementation may be necessary due to
technology risk, not to imply that a high knowledge of a vulnerability will
reduce an organization’s risk of that vulnerability being exploited.

##  5 Case Studies

To show the applicability of the I-STRIDE model for determining training
needs, assessment of cloud computing infrastructure based on Eucalyptus
Eucalyptus2013  and OpenStack will be given as examples.

###  5.1 Case 1: Eucalyptus Cloud

This case will specifically look at a deployed Eucalyptus Cloud. The
components of this platform will be explained, and an analysis using the
I-STRIDE model will be conducted against this deployment.

The Eucalyptus architecture is composed of five high-level components that are
essentially standalone web services. These components include:

  * •

Cloud Controller (CLC): The cloud controller is the main entry point for the
cloud environment. CLC is responsible for “exposing and managing the
underlying virtualized resources”.

  * •

Cluster Component (CC): CC is responsible for managing the execution of VM
instances.

  * •

Storage Controller (SC): Provides block-level network storage that can be
dynamically attached by VMs instances.

  * •

Node Controller (NC): Executed on every node that is designated for hosting
and allows management of VM instances.

  * •

Walrus: Allows the storage and management of persistent data.

Figure 3 shows the Eucalyptus components and their connection and
communication channels.

Figure 3: Deployed Eucalyptus Architecture

The scope of this case will be limited to asset-centric threat modeling. The
assets in this case will be defined as each of the Eucalyptus components which
can be thought of as the Cloud Service Provider (CSP), and will also include a
cloud client. In this case, threats (Table 1) were identified and exploited in
the deployed Eucalyptus architecture. Per the I-STRIDE model, an analysis of
affected assets was conducted. An investigation was then conducted to
determine potential evidential data sources. Identified threats, the threat
description, the affected asset, the impact on the asset, and the location of
potential evidential data sources are listed in Table 1. Information in this
table may normally be used to assess threats, and, if a threat is exploited,
help to collect potential evidential traces during the incident response
phase.

Threat Description Asset Threat Impact Potential Evidential Sources XML Denial
of Service Attacker crafts XML message with a large payload, recursive content
or with malicious DTD schema. Cloud Controller, Cloud Client Denial of Service
XML parser logs at the cloud controller Replay Attack Flaws Attacker could
issue recurrence overloaded Simple Object Access Protocol (SOAP) messages over
HTTP to overwhelm the CSP and stop the service Cloud Controller, Cloud Client
Denial of Service SOAP message timestamp and message payload to identify the
message flaws WSDL Parameter Tampering Attacker could embed command line code
into WSDL documents or command shell to execute the command Cloud Controller,
Cluster Controller, Node Controller, Cloud client Denial of Service Detailed
investigation of WSDL file could identify parameter tampering Schema Poisoning
Attacker could compromise the XML schema grammar and manipulate the data Cloud
Controller, Cloud Client Denial of Service Detailed investigation of XML
parser logs at the cloud controller may contain evidence of XML schema
tampering

Table 1: Identified threats, the estimated threat impact and potential
evidential data sources identified for a Eucalyptus that is the result of the
proposed I-STRIDE model

Using the I-STRIDE model could help CSPs and law enforcement identify an
investigation starting point during Incident Response (IR). This level of
readiness would potentially allow for improved pre-planning, first response
and cooperation once an incident occurred. While I-STRIDE may help to
determine data sources interesting to an investigation, this information is
only useful if the responders understand how to properly access, acquire and
preserve such data. The output of the I-STRIDE model can be considered the
knowledge the organization needs. For example, if the Cluster Component is
compromised then incident responders need knowledge of the Cluster Component
to be able to make use of the knowledge of associated evidential data sources.
The I-STRIDE model can be used to guide training and education development
plans based on the needs of an assessed organization.

####  5.1.1 Case 1: Knowledge Prioritization

Consider again Table 1. If denial of service was found to be a priority risk
in an organization, then at least 4 threats have an impact defined as denial
of service. The threat vector, and already known potential evidential sources
can be used to define the type of training necessary to thoroughly investigate
breaches using such vectors of attack. For example, the first priority threat
as shown in Table 2 uses XML as an attack vector. XML parser logs were
identified as potential evidential sources at the cloud controller.

The organization can apply the methodology described in Section 4 to determine
knowledge risk. Notice, in table 2 the organization did not use CVSS, but
instead chose a low-medium-high technology risk prioritization scheme. In this
case, since each technology risk is a high priority (3 out of 3), the
organization can now assess their knowledge about the investigation of each
technology risk. For this case, let’s assume that the organization has a great
understanding of XML attack vector investigations (5 out of 6), and very
little knowledge of SOAP exploit prevention and investigation (1 out of 6).
Knowledge prioritization can then be assessed as follows

  * •

XML investigation training priority: $3-((5\div 6)\cdot 3)=0.5$

  * •

SOAP investigation training priority: $3-((1\div 6)\cdot 3)=2.5$

If an organization can answer questions about in-house knowledge for high
priority technology risks, then the organization can identify associated
knowledge risk, and invest in training of personnel more effectively based on
their unique needs. Once these knowledge priority areas have be en identified,
they can be fed directly into training development models such as the
Successive Approximation Model Allen2006  for rapid training development. This
will allow organizations to quickly target and close gaps in knowledge based
on prioritized organizational risks.

Priority Threat Asset Threat Impact Potential Evidential Sources Knowledge
High XML Denial of Service Cloud Controller, Cloud Client Denial of Service
XML parser logs at the cloud controller XML attack vector investigation High
Replay Attack Flaws Cloud Controller, Cloud Client Denial of Service SOAP
message timestamp and message payload to identify the message flaws SOAP
exploit prevention and investigation High WSDL Parameter Tampering Cloud
Controller, Cluster Controller, Node Controller, Cloud client Denial of
Service Detailed investigation of WSDL file could identify parameter tampering
WSDL Security and Investigation High Schema Poisoning Cloud Controller, Cloud
Client Denial of Service Detailed investigation of XML parser logs at the
cloud controller may contain evidence of XML schema tampering XML attack
vector investigation

Table 2: Threat prioritization (in this case, based on the organization’s
subjective decision) and required investigation knowledge identification based
on identified threats that cause a particular class of threat impact

###  5.2 Case 2: OpenStack

The next case concerns the assessment of OpenStack, an open source cloud
infrastructure project. This example will use vulnerabilities identified in
CVE Details MITRE_CVE , along with the threat’s identified CVSS score. From
CVE, an organization running OpenStack may assess their specific technology
and knowledge risk in relation to new vulnerabilities.

Threat Description Asset Threat Impact CVSS Potential Evidential Sources
Knowledge Issue requests with an old X-Timestamp value Authenticated attacker
can fill an object server with superfluous object tombstones Swift Cluster
Denial of Service 4.0 Tombstone files Swift Object Servers Re-auth deleted
user with old token When an actor claims to have a given identity, the
software does not prove or insufficiently proves that the claim is correct.
Keystone Security Bypass 6.0 Instance and user logs Swift Proxy Generate
unparsable or arbitrary XML responses Unchecked user input in Swift XML
responses Swift account servers Security Bypass 7.5 Account server logs
Account server

Table 3: Identified threats, the estimated threat impact and potential
evidential data sources identified for OpenStack that is the result of CVE
details and the I-STRIDE model

The knowledge required for each of the technology risks identified in Table 3
can be identified using the I-STRIDE process, and specifically by simulating
an incident and determine where data relevant to the investigation may be
found. In this case, the required knowledge has been defined as parts of the
swift architecture.

The CVSS in this case represents the technology risk if the vulnerability has
not been patched yet, or for some reason cannot be. The organization must
conduct an internal knowledge risk assessment based on the identified
knowledge areas for newly identified vulnerabilities. In this case, assume an
organization has moderate (3 out of 6) knowledge about swift proxy and account
servers, and little (1 out of 6) knowledge of swift object servers. The
investigation knowledge priority for each threat can be calculated as so:

  * •

Object server investigation training priority: $4-((1\div 6)\cdot 10)=2.33$

  * •

Proxy server investigation training priority: $6-((3\div 6)\cdot 10)=1$

  * •

Account server investigation training priority: $7.5-((3\div 6)\cdot 10)=2.5$

In this case, because the account server has the highest technology risk and
the organization only has a moderate level of knowledge about the
investigation of such a risk, it is given the highest priority. It is then
followed by a technology risk that is relatively low, but is a risk which the
organization does not have much knowledge about.

##  6 Conclusions

Cloud computing has a number of benefits, such as high availability,
potentially lower cost, and potentially improved security. However, cloud
computing also has a number of associated risks. Some of these risks have been
inherited from traditional computing models, while the cloud business model
introduces others. As more businesses and end users move their data and
processing to cloud environments, these environments will increasingly become
the target, or even the originator, of malicious attacks. By taking an asset-
based risk assessment approach, and specifically using the I-STRIDE model,
organizations can identify and prioritize threats, determine threat impact and
potential evidential sources, and ultimately identify gaps in investigator
knowledge before a threat is exploited. By implementing the proposed
technology and knowledge risk assessment metrics, and organization can at
least be better positioned to make training and education investment decisions
based on observed deficiencies. I-STRIDE can act as a base for CSPs and law
enforcement to more effectively work together before and during the
investigation of incidents in cloud environments, and not only in the
discussion of vulnerabilities but in the discussion of required knowledge.

While this work proposed a naive model for determining investigator training
needs specific to the organization, future work will attempt to evaluate the
model with real organizations rather than a researcher-created case study. For
example, the model, as proposed, integrates prevention (security) and
investigation (post incident) to attempt to improve both. However, such a
model takes a considerable amount of effort and pre-planning to implement. In
large organizations, even communication between investigators and security
officers may be difficult. Such real-world case studies are needed to evaluate
the practicality of the proposed training-guidance method.

## References

  * [1] Michael W. Allen.  Creating successful e-learning: a rapid system for getting it right the first time, every time.  Pfeiffer & Co., 2006.
  * [2] Lorin W. Anderson, David R. Krathwohl, and Benjamin Samuel Bloom.  A taxonomy for learning, teaching, and assessing.  Longman, 2005.
  * [3] Michael Armbrust, Armando Fox, Rean Griffith, Anthony D Joseph, Randy H Katz, Andrew Konwinski, Gunho Lee, David A Patterson, Ariel Rabkin, Ion Stoica, and Matei Zaharia.  Above the Clouds: A Berkeley View of Cloud Computing.  Science, 53(UCB/EECS-2009-28):07–013, 2009.
  * [4] Marco Balduzzi, Jonas Zaddach, Davide Balzarotti, Engin Kirda, and Sergio Loureiro.  A security analysis of amazon’s elastic compute cloud service, 2012\.
  * [5] Brian D Carrier and Eugene H Spafford.  Getting physical with the digital investigation process.  International Journal of Digital Evidence, 2(2):1–20, 2003.
  * [6] CRA and Computing Research Association.  Four Grand Challenges in Trustworthy Computing.  Technical report, 2003.
  * [7] Josiah Dykstra and Alan T Sherman.  Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques.  Digital Investigation, 9:S90–S98, August 2012.
  * [8] Eucalyptus.  Eucalyptus: The Open Source Cloud Platform, 2013.
  * [9] EY and EYGM Limited.  Into the cloud, out of the fog: Ernst & Young’s 2011 Global Information Security Survey.  Technical report, 2011.
  * [10] Gartner.  Forecast: Public Cloud Services, Worldwide, 2010-2016, 2Q12 Update.  Technical report, 2012.
  * [11] Joshua I James, Ahmed F Shosha, and Pavel Gladyshev.  Digital Forensic Investigation and Cloud Computing.  In Keyun Ruan, editor, Cybercrime and Cloud Forensics: Applications for Investigation Processes, pages 1–41. IGI Global, 2013.
  * [12] W A Jansen.  Cloud Hooks: Security and Privacy Issues in Cloud Computing.  pages 1–10. IEEE, 2011.
  * [13] Karen Kent, Suzanne Chaevalier, Tim Grance, and Hung Dang.  Guide to Integrating Forensic Techniques into Incident Response.  Technical Report SP800-86, 2006.
  * [14] Martin Kerrigan.  A capability maturity model for digital investigations.  Digital Investigation, 10(1):19–33, March 2013.
  * [15] Ren Kui, Wang Cong, and Wang Qian.  Security Challenges for the Public Cloud.  Internet Computing, IEEE, 16(1):69–73, 2012.
  * [16] MITRE.  OpenStack Security Vulnerabilities.
  * [17] MSDN.  The STRIDE Threat Model, 2005.
  * [18] NIST.  Common Vulnerability Scoring System.
  * [19] Ponemon and L L C Ponemon Institute.  The Security of Cloud Infrastructure: Survey of U.S. IT and Compliance Practitioners.  Technical report, 2011.
  * [20] Antonio Pooe and L Labuschagne.  A conceptual model for digital forensic readiness.  In 2012 Information Security for South Africa, pages 1–8. IEEE, August 2012.
  * [21] Keyun Ruan, Joe Carthy, Tahar Kechadi, and Ibrahim Baggili.  Cloud forensics definitions and critical criteria for cloud forensic capability: An overview of survey results.  Digital Investigation, 10(1):34–43, June 2013.
  * [22] P Saripalli and B Walters.  QUIRC: A Quantitative Impact and Risk Assessment Framework for Cloud Security.  pages 280–288. Ieee, 2010.
  * [23] Michael J Skok.  Future of Cloud Computing 2012, 2012.
  * [24] Adesina Simon Sodiya, Saidat Adebukola Onashoga, and Beatrice Oladunjoye.  Threat modeling using fuzzy logic paradigm.  Journal of Issues in Informining Science and Technology, 4(1):53–61, 2007.
  * [25] Peter Stephenson.  Modeling of post-incident root cause analysis.  International Journal of Digital Evidence, 2(2):1–16, 2003.
  * [26] F Swiderski and W Snyder.  Threat modeling.  Microsoft Press Redmond, WA, USA, 2004.
  * [27] M A Vouk.  Cloud computing-Issues, research and implementations.  pages 31–40. IEEE, 2008.
  * [28] Dimitrios Zissis and Dimitrios Lekkas.  Addressing cloud computing security issues.  Future Generation Computer Systems, 28(3):583–592, 2012.