Detecting Botclouds at Large Scale: A Decentralized and Robust Detection Method for Multi-Tenant Virtualized Environments

Abstract

Cloud computing has gained an important role in providing high quality and cost-effective IT services by outsourcing part of their operations to dedicated cloud providers. If intrinsic security issues of this architecture have been extensively studied, it has recently been considered as a ready-to-use platform able to perform malicious activities, thus offering new targets for indirect threats. However, its large scale, the heterogeneous and dynamic nature of the activities it executes, as well as multitenancy and privacy-related issues, make the security operation complex. Consequently, cloud providers can hardly detect and mitigate malicious activities they unknowingly host. Leveraging the autonomic paradigm represents a promising solution to face such a complexity, but it requires efficient grounded monitoring and analysis functions to efficiently detect malicious activities hidden within the large number of legitimate ones. In this effort, this paper presents a robust and cost-effective solution to detect malicious activities in a public virtualized environment. Its contribution is twofold: (1) a scalable and robust workload estimation of the virtual host activities in a cloud and (2) a detection algorithm able to discriminate infected hosts with low malicious activities hidden within their legitimate workload and potentially scattered on several tenants. For both of these contributions, we establish their theoretical performance, which demonstrates their optimality, and we evaluate their efficiency on a dataset made of real data collected on PlanetLab. Finally, we study the scalability on a large dataset that consists of simulated data resulting from the real dataset modeling. This demonstrates

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

“…To lower the latency when collecting data and to ensure the isolation among network slices, in each region, we deploy a VM monitor for a network slice to collect and store metrics data of VMs in the network slice as a local database. VM monitors resort to the virtualization layer to capture resource metrics of VMs [4], [6]. The resource metrics are related with the CPU usage, memory consumption, disk read/write and network input/output.…”

“…[5]. Existing researches [6], [7], [8] have shown that the abnormal behaviors of VMs usually come with a significant change in resource metrics, so it is a good way to implement anomaly detection for VMs by collecting and analyzing its multi-dimensional resource metrics data. Although there have been many interesting researches for anomaly detection, including statistical and probability methods [9], [10], distance-based methods [11], [12], domain-based methods [13], [14], reconstruction-based methods [15], [16], [17], and information theory based methods [18], as classified in [19], detecting anomalies of VMs in virtualized network slicing environment still faces many challenges:…”

An empirical investigation of botnet as a service for cyberattacks

“…Then, in other work, we proposed an Intrusion Detection System approach for DDoS attacks launched by botclouds. Finally, we proposed a decentralized and distributed source‐based detection protocol to meet the requirements of the cloud infrastructure . However, this approach was designed only for the first case of cloud resources' abuse, namely, where an attacker creates VMs dedicated to the attack activity.…”

“…Finally, we proposed a decentralized and distributed source-based detection protocol to meet the requirements of the cloud infrastructure. 59,60 However, this approach was designed only for the first case of cloud resources' abuse, namely, where an attacker creates VMs dedicated to the attack activity. Thus, all of the activity of the VM is malicious.…”