CloudMon: a resource‐efficient IaaS cloud monitoring system based on networked intrusion detection system virtual appliances

Abstract

The networked intrusion detection system virtual appliance (NIDS-VA), also known as virtualized NIDS, plays an important role in the protection and safeguard of IaaS cloud environments. However, it is nontrivial to guarantee both of the performance of NIDS-VA and the resource efficiency of cloud applications because both are sharing computing resources in the same cloud environment. To overcome this challenge and trade-off, we propose a novel system, named CloudMon, which enables dynamic resource provision and live placement for NIDS-VAs in IaaS cloud environments. CloudMon provides two techniques to maintain high resource efficiency of IaaS cloud environments without degrading the performance of NIDS-VAs and other virtual machines (VMs). The first technique is a virtual machine monitor based resource provision mechanism, which can minimize the resource usage of a NIDS-VA with given performance guarantee. It uses a fuzzy model to characterize the complex relationship between performance and resource demands of a NIDS-VA and develops an online fuzzy controller to adaptively control the resource allocation for NIDS-VAs under varying network traffic. The second one is a global resource scheduling approach for optimizing the resource efficiency of the entire cloud environments. It leverages VM migration to dynamically place NIDS-VAs and VMs. An online VM mapping algorithm is designed to maximize the resource utilization of the entire cloud environment. Our virtual machine monitor based resource provision mechanism has been evaluated by conducting comprehensive experiments based on Xen hypervisor and Snort NIDS in a real cloud environment. The results show that the proposed mechanism can allocate resources for a NIDS-VA on demand while still satisfying its performance requirements. We also verify the effectiveness of our global resource scheduling approach by comparing it with two classic vector packing algorithms, and the results show that our approach improved the resource utilization of cloud environments and reduced the number of in-use NIDS-VAs and physical hosts

Toward a flexible and fine‐grained access control framework for infrastructure as a service clouds

“…We slightly modify the permission assignment part of iVIC to implement type‐to‐role assignment and type‐type permission matrix. Because both malware detection and intrusion detection are supported in iVIC, we take their results as event input to drive our permission transition model. KVM is used as the underlying virtualization infrastructure of iVIC.…”

iHAC: A Hybrid Access Control Framework for IaaS Clouds

“…We slightly modify the permission assignment part of iVIC to implement Type-to-Role assignment and TypeType permission matrix. Since both malware detection [8] and intrusion detection [9] are supported in iVIC, we take the results of both of them as event input to drive our permission transition model. KVM is used as the underlying virtualization infrastructure of iVIC.…”

Cloud incident handling and forensic‐by‐design: cloud storage as a case study

“…Incident handling is a general strategy that guides an organisation in dealing with crises, and generally describes the types of incident, identifies the relevant person in‐charge, and outlines the action strategy. Both Cloud Service Providers (CSP) and Cloud Service Users (CSU) may find that ‘traditional’ incident handling procedures are not fit‐for‐purpose because of the challenges posed by the nature of cloud infrastructure . Furthermore, the requirements and challenges of the incident handling principles faced by CSUs and CSPs are likely to differ (e.g.…”