AVDR: A Framework for Migration Policy to Handle DDoS Attacked VM in Cloud

Abstract

The recent trends of Distributed Denial of Service (DDoS) attacks in cloud computing have revealed a new menace of DDoS attacks called collateral damages on non-target stakeholders. These stakeholders are victim Virtual Machine (VM), sibling VMs, host physical machine, other host physical machines, VMs on other host machine, users of attacked and co-hosted VMs, cloud providers and cloud customer. The main reason behind these collateral damages are the features of cloud like virtualization, auto-scaling, resource sharing, and migrations. During the DDoS attacks due to the massive number of requests, it will result in host overload situation. In cloud, this overload situation is handled by various existing migration policies. These simple migration policies are not efficient if the attacked VMs are present in the cloud network. Therefore a supporting framework, Attacked VM Detection and Recovery (AVDR) is proposed in this work. Proposed AVDR framework improves the performance of existing migration policies and reduces the collateral damages. The AVDR framework is based on attack strength ‘ $$Y_{as}$$ ’, thus a linear model to evaluate ‘ $$Y_{as}$$ ’ is also proposed. The dataset used for the modeling of ‘ $$Y_{as}$$ ’ is generated over the VM instances created on AWS. It consists of both the attack as well as benign request traces. The results prove the effectiveness of the proposed work.