1. Security and Trustworthiness in Cloud Computing
Bruno L. Dalmazo, João P. Vilela, Marília Curado
{dalmazo, jpvilela,
CISUC, Department of Informatics Engineering, University of Coimbra
Features An O0 O1 O2 O3 O4
... On A0 A1 A2 A3 A4 An
Individual similarity approach for each feature
IDS output
Alarm database
Step 1 F0 F1 F2 F3 F4 Fn
Step 2
Clustering relevant features
Similarity approach for groups of alarms
Features On
Step 3 F
Poisson Moving Average is based on a statistical model where observations are weighted with a Poisson distribution inside a sliding window
𝑃 𝑁 𝑡 =𝑘 = 𝑒 −𝜆𝑡 (𝜆𝑡) 𝑘 𝑘! A B
𝑆𝑖𝑚 𝐸𝐷 = 𝑖=1 𝑛 ( 𝑥 𝑖 − 𝑦 𝑖 ) 2
𝑆𝑖𝑚 𝑇𝑀 = 𝑖=1 𝑛 𝑥 𝑖 𝑦 𝑖 𝑖=1 𝑛 𝑥 𝑖 𝑖=1 𝑛 𝑦 𝑖 2 − 𝑖=1 𝑛 𝑥 𝑖 𝑦 𝑖
Reducing the number of messages sent to the server/administrator
Using the number of occurrence of these groups to increase the severity of a single alarm
Decreasing the network data traffic and its associated transfer costs
DyWiSA is a Dynamic Window Size Algorithm
focused on providing a standardized approach for evaluating the best candidate predictor models for cloud environments
Trustworthiness
Security
(A)
(F)
Monitoring i % $
Traffic Predictor
Alarm Management
(C) i ☼
(3)
Sliding Window
SMA
WMA
EMA
PMA
Dynamic Window Size Algorithm 20 21 8 12 16 26 18 31 9 11 7 3 14
Predicted data flow
Original data flow
(1)
(2)
(5)
(4)
time t
time t+1
Predictor Model
(B)
(E) i n
Intrusion Detection System
Management
Probe
Spoofing
D-DoS n t
(D) E F1 Fn F2
182 85 61 38 68 79 77 .
Temporal layers from virtual machines
257 20 03 81
119 36 74
Feature Extraction Approach
Feature vector
Extracted feature vector C D
Anomaly Detection Mechanism
Cloud monitoring
Event auditor
Feature extraction approach
SVM model
(1)
(5)
(2)
(4)
010
101111
Σ±%
Repository of outcomes
(3)
References
[1] Dalmazo B. et al. Performance Analysis of Network Traffic Predictors in the Cloud. Journal of Network and Systems Management. Springer, 2017.
[2] Dalmazo B. et al. Online traffic prediction in the cloud. International Journal of Network Management. John Wiley & Sons, 2016.
[3] Dalmazo B. et al. Expedite Feature Extraction for Enhanced Cloud Anomaly Detection. IEEE/IFIP NOMS Workshop on Security for Emerging Distributed Network Technologies, 2016.