Attacks In Cloud Research Articles

Game theoretic modeling of economic denial of sustainability (EDoS) attack in cloud computing

AbstractIn this paper, we develop a novel game theoretic model of the interactions between an EDoS attacker and the defender based on a signaling game that is a dynamic game of incomplete information. We then derive the best defense strategies for the network defender to respond to the EDoS attacks. That is, we compute the perfect Bayesian Nash Equilibrium (PBE) of the proposed game model such as the pooling PBE, separating PBE and mixed strategy PBE. In the pooling equilibrium, each type of the attacker takes the same action and the attacker's type is not revealed to the defender, whereas in the separating equilibrium, each type of the attacker uses different actions and hence the attacker's type is completely revealed to the defender. On the other hand, in the mixed strategy PBE, both the attacker and the defender randomize their strategies to optimize their payoffs. Numerical illustration is also presented to show the efficacy of the proposed model.

Secure VM placement analysis against co-location based attack in cloud

Cloud computing is most popular platform for IT industries provides numerous benefits to cloud computing users. Day by day increasing the number of users on cloud so security is a most important issue. Virtual machine co-residency and resource sharing rise chance to leak sensitive information, lack of restrictions for placement of virtual machine on same host machine, increase the chance for an attacker to conducting co-location based attack on neighbor virtual machine that running on same host machine. Without security scheme placement of VM in cloud environment may increase chance to thieve confidential information by the attackers. In this paper, we analyze the existing VM placement scheme against cross VM side channel attack. We categorized side channel attack (SCA) according to access of hardware and way to extract the confidential information. We have also done comparative study of VM placement scheme on the basis of previous history of user, number of VM placed and average running time of VM on cloud.

Vulnerability Assessment and Penetration Testing Approach Towards Cloud-Based Application and Related Services

Cloud solutions provide a powerful computing platform that enables individuals and Cloud users to perform a wide range of tasks, such as using an online storage system, implementing business applications, developing customized computer software, and establishing a realistic network environment. The number of people using cloud services has increased dramatically in recent years, and a massive amount of data has been stored in cloud computing environments. As a result, data breaches in cloud services are increasing year after year as a result of hackers who are constantly attempting to exploit cloud architecture's security vulnerabilities. In this paper, we investigate and analyse real-world cloud attacks in order to demonstrate the techniques used by hackers against cloud computing systems and how to prevent such malicious activities.

Scaling & fuzzing: Personal image privacy from automated attacks in mobile cloud computing

The mobile cloud computing (MCC) paradigm provides a range of useful services to smart phone users and enhances the user experience significantly. But, as MCC requires the data to be offloaded to an external server, there are serious concerns regarding the privacy of the users’ personal data such as images. For instance, a cloud server could perform image segmentation on user images to extract interesting artifacts such as restaurants, user’s clothing preferences, tourist locations, participation in social events and so on, which characterize the user’s personal life. The leakage of such private information could lead to milder consequences like targeted advertising or more serious consequences like identity theft. In this work, to protect the privacy of user images, we describe a privacy-preserving image filtering for mobile cloud computing that protects against automated inference attacks based on techniques like image segmentation. The key intuition of our approach is to leverage the inherent properties of the discrete Fourier transform (DFT), which transforms each image pixel into a complex value real and imaginary parts which can be processed independently. By dividing the image in this manner, we are able to process distinct parts of the image on different non-colluding servers and aggregate the results at the client. Furthermore, to prevent information leakage at individual servers, we obfuscate the data sent to any given server using an efficient reversible transformation. We prove our approach to be secure under the semi-honest model and non-colluding servers where at least one server does not collude with the rest of the servers. In comparison to the existing paradigm of outsourced privacy preserving computation, i.e., processing encrypted data using homomorphic encryption, our approach employs easy-to-implement obfuscation techniques without any key management overhead at the client. Using experimental evaluation as well as information theoretic leakage evaluation, we show that our approach is efficient and suitable for users of mobile devices.

A Secure Methodology to Detect and Prevent Ddos and Sql Injection Attacks

As most of the applications host on cloud, Security is a major concern for the data owners. The cloud environment has to be secure and protect data owner data from cloud attacks. In this project work, we study about securing firewall against client side attacks namely Denial of firewall and SQL injection attacks. Denial of firewall is nothing but overloading the firewall by bursting n number of requests through vulnerable scripts. SQL injection attack is defined as bypassing the security protocols by malicious scripts. Thus we proposed to design and develop a web application to detect and prevent denial of firewall and SQL injection attacks.
 The denial of firewall attack can be performed using Java environment based servers and prevention can be performed using Digital Signature Algorithm (DSA) in which filter based approach and software puzzle based approach are performed to detect the malicious script based requests. Once the Deep Packet Inspection (DPI): filter based approach and software puzzle based approach are find satisfactory only the request would be processed. If the request is find malicious automatically the requested IP address would be blocked. Various type of SQL injection attacks namely SQL login bypass, Blind injection, SQL sleep attack, Data fetching attack are analysed and performed. The SQL injection attack can be prevented using PREPARE statements. This statements are created to make the SQL queries more efficient and render security benefits. This statement provides effective prevention mechanism against SQL injection attacks. Thus our proposed solution, provides high security against firewall attacks namely denial of firewall and SQL injection securing the data owner files and preventing compromising of firewall

HBRSS: Providing high-secure data communication and manipulation in insecure cloud environments

Cloud storage and cloud services provide a stronger computing power and distributed computing capability for IoT users with a minimal cost. However, the security issues of cloud always limit the development of cloud computing and storage. In the meanwhile, the channel instability and exposure of the public network make the security of data in transmission challenged (HTTPS protocol cannot guarantee the security of data after receiving by servers). Even if homomorphic encryption can protect IoTs’ sensitive data, attackers still can infer sensitive behaviors about users by listening to the frequency of cloud services usage. To solve the above problems, in this paper, we propose a novel data transmission structure named HBRSS for high-security data transmission and data processing in insecure cloud environments and channels. HBRSS harnesses proposed data splitting principle to divide the data into blocks, packages the block data and forms a block ring based on the concept of blockchain to ensure the non-tamperability and non-destructibility of data. In addition, we propose an improved partial homomorphic encryption algorithm, which adds fuzzy processing for the data service functions to improve function-privacy. We also build a virtual mistrusted cloud service scene by using Docker and Kubernetes to evaluate our method’s performance, which can also be utilized as a standard attack drill platform for all researchers to test their own security algorithms. Based on our best knowledge, this platform is the first open-source automatic cloud attack exploitation system that contains attacks against browsers, channels, and servers. The experimental results indicate that our new encryption algorithm brings larger key-space and lower power consumption compared with some encryption algorithms.

Optimized extreme learning machine for detecting DDoS attacks in cloud computing

Distributed denial of service (DDoS) attack is a serious security threat to cloud computing that affects the availability of cloud services. Therefore, defending against these attacks becomes imperative. In this paper, we present a DDoS attack detection system based on an improved Self-adaptive evolutionary extreme learning machine (SaE-ELM). SaE-ELM model is improved by incorporating two more features. Firstly, it can adapt the best suitable crossover operator. Secondly, it can automatically determine the appropriate number of hidden layer neurons. These features improve the learning and classification capabilities of the model. The proposed system is evaluated using four datasets namely, NSL-KDD, ISCX IDS 2012, UNSW-NB15, and CICIDS 2017. It achieves the detection accuracy of 86.80%, 98.90%, 89.17%, and 99.99% with NSL-KDD, ISCX IDS 2012, UNSW-NB15, and CICIDS 2017 datasets, respectively. The experiments show that the performance of the proposed attack detection system is better than the system based on original SaE-ELM and state-of-the-art techniques. However, it shows a longer training time than SaE-ELM based system.

A Double-Blind Anonymous Evaluation-Based Trust Model in Cloud Computing Environments

In the last ten years, cloud services provided many applications in various areas. Most of them are hosted in a heterogeneous distributed large-scale cloud computing environment and face inherent uncertainty, unreliability, and malicious attacks that trouble both service users and providers. To solve the problems of malicious attacks (including solo and collusion deception ones) in a public cloud computing environment, we for the first time propose a double-blind anonymous evaluation-based trust model. Based on it, cloud service providers and users are anonymously matched according to user requirements. It can be used to effectively handle some malicious attacks that intend to distort trust evaluations. Providers may secretly hide gain-sharing information into service results and send the results to users to ask for higher trust evaluations than their deserved ones. This paper proposes to adopt checking nodes to help detect such behavior. It then conducts gain–loss analysis for providers who intend to perform provider–user collusion deception. The proposed trust model can be used to effectively help one recognize collusion deception behavior and allow policy-makers to set suitable loss to punish malicious providers. Consequently, provider-initiated collusion deception behavior can be greatly discouraged in public cloud computing systems. Simulation results show that the proposed method outperform two updated methods, i.e., one based on fail-stop signature and another based on fuzzy mathematics in terms of malicious node detection ratio and speed.

WITHDRAWN: Dynamic and scalable virtual machine placement algorithm for mitigating side channel attacks in cloud computing

This article has been withdrawn: please see Elsevier Policy on Article Withdrawal (https://www.elsevier.com/about/our-business/policies/article-withdrawal). This article has been withdrawn as part of the withdrawal of the Proceedings of the International Conference on Emerging Trends in Materials Science, Technology and Engineering (ICMSTE2K21). Subsequent to acceptance of these Proceedings papers by the responsible Guest Editors, Dr S. Sakthivel, Dr S. Karthikeyan and Dr I. A. Palani, several serious concerns arose regarding the integrity and veracity of the conference organisation and peer-review process. After a thorough investigation, the peer-review process was confirmed to fall beneath the high standards expected by Materials Today: Proceedings. The veracity of the conference also remains subject to serious doubt and therefore the entire Proceedings has been withdrawn in order to correct the scholarly record.

The impact and mitigation of ICMP based economic denial of sustainability attack in cloud computing environment using software defined network

High availability in network services is a crucial requirement for quality of experience. Denial of Service (DoS) and Distribute Denial of Service (DDoS) attacks are under contemplation by many researchers across the globe because these attacks directly target services availability. For this reason, cloud providers use the auto-scaling feature in Cloud Computing Environments (CCE), in which cloud resources scale dynamically on demand. DoS/DDoS attacks on CCE, using auto-scaling, do not deny services but cause high resource usage and substantial financial damages that become an Economic Denial of Sustainability (EDOS) attack. One of the DoS/DDoS attacks, resulting EDOS attack is the Internet Control Messaging Protocol (ICMP) flooding attack. In this paper, a novel technique, ICMP detection and mitigation model (EDOS-IDM) is proposed that can detect and mitigate Volumetric and Normal Behavioral ICMP traffic attacks. The results from the proposed technique are compared with the Normal Behavioral ICMP traffic attack because it causes least resource usage among all the mitigation techniques. According to our study, there is no such technique that can handle normal behavioral ICMP traffic attack. The technique is practically tested and evaluated on OpenStack production Cloud Environment test bed. According to the results, the technique is proved to save extra resource consumption and customer's bills in a cloud computing environment.

Attack and intrusion detection in cloud computing using an ensemble learning approach

The distributed and decentralized nature of cloud computing facilitates its adoption and expansion in different sectors of society such as education, government, information technology, business, and entertainment, etc. Cloud Computing provides a wide information technology landscape. Its existence in every section of society makes this computing paradigm prone to intrusions and attacks. A huge volume of data stored on cloud computing poses a high risk of security and privacy [6]. Therefore it is important to build a network intrusion detection system using an anomaly detection approach for a cloud computing network which can identify as many threats as possible with better assault identification level and less false positives. This paper discusses an effective network-based intrusion detection model utilizing an ensemble-based machine learning approach using four classifiers i.e., Boosted tree, bagged tree, subspace discriminant, and RUSBooted along with a voting scheme. The voting algorithm is incorporated into the framework to obtain a consolidated final prediction. Standard dataset and simulator namely, CICIDS 2017 and CloudSim were used for simulation and testing of the suggested model. The implementation results obtained by employing individual classifiers and combined result of all the four classifiers is compared along with comparing the proposed model with respect to existing Intrusion detection models. Results of implementation demonstrate the ability of the proposed model in the identification of intrusions in the cloud environment with a higher rate of detection and generation of minimal false alarm warnings, which suggests its dominance relative to state-of-the-art approaches. The implementation results show an accuracy of 97.24%.

Network and hypervisor-based attacks in cloud computing environments

Cloud computing (CC) has become one of the most transformative computing technologies and a key business avenue, following in the footsteps of main-frames, minicomputers, personal computers, the Wo...

An Impact Analysis and Detection of HTTP Flooding Attack in Cloud Using Bio-Inspired Clustering Approach

The application layer HTTP flooding attack is the primary threat to web servers hosting web services in the cloud network. Due to varying network changes in the cloud, the traditional security methods are not sufficient to detect the attack. Therefore, a novel approach is proposed, which uses Teacher Learner Based Optimization (TLBO) for clustering to identify the attack requests. In this work, the logs of a web server under attack are collected and pre-processed. Further, Principal Component Analysis (PCA) is used to reduce the dimensionality of the pre-processed data. Thereafter the data is clustered using TLBO clustering, which will separate the application layer HTTP flooding attack in one cluster and rest of the requests in the other cluster. The results prove that the proposed approach performs better than other traditional and bio-inspired clustering techniques. The proposed approach also attains the peak detection rate and lowermost false alarm, which proves the efficacy of the proposed approach among another state of the art approaches.

Software Defined Network Function Virtualization Framework for Securing Cloud with Data Fusion and Machine Learning Techniques

Computing in the cloud is one of the platforms that may be used to provide distributed computing resources. Supplying and managing cloud resources most effectively is referred to as resource management. A recent development in technology known as fog computing is an example of an expanded and dispersed infrastructure. This architecture maintains application processes between end devices and the network edge to provide more dependable and efficient services. These services include remote data storage, allowing customers to access their data from a distant location. Providing remote storage service is an advantageous function offered by cloud suppliers. On the other hand, the data stored in the cloud is geographically dispersed and kept in various data centers, significantly increasing the risk to users' privacy and security. One of the problems that might arise with privacy is when many data centers store the same information. Many cloud service providers check their customers' data using a Third-Party Auditor (TPA) to address concerns about client privacy and data integrity. Currently, most trusted TPAs only have one validator, making it impossible to expand the data integrity across several data centers. The various verifiers used by TPAs have been reduced in number in response to Man in the Cloud (MiTC) attacks. As a result, they cannot check and authenticate the integrity of data stored in several data centers. A unique Peer to Peer (P2P) authentication protocol with Certificate Authority (CA) and Data Storage Protocol is presented as a solution to the problem that has been outlined above to check for and go around any issues that may arise (DSP). The efficiency of the proposed protocol is demonstrated by the incorporation of TPAs and Certificate Authorities. The proposed protocol has been tested with a single user and a single storage server, as well as multiple storage servers in ownCloud with one backup server, two storage servers, three clients, and two TPAs. The NoSQL server in an organization's cloud is set up to save data to storage servers in the appropriate format. The Amanda backup server is used to back up the mirror copy of the stored data on the storage servers. Automated Validation of Internet Security Protocols with Data Fusion and Applications, or AVISPA for short, is a technology that may be used to verify data stored in the cloud. The findings make it abundantly evident that the suggested protocol is strong enough to guarantee the authenticity of data kept in several data centers.

Detection of DDoS Attacks in OpenStack-based Private Cloud Using Apache Spark

Security is a critical concern for cloud service providers. Distributed denial of service (DDoS) attacks are the most frequent of all cloud security threats, and the consequences of damage caused by DDoS are very serious. Thus, the design of an efficient DDoS detection system plays an important role in monitoring suspicious activity in the cloud. Real-time detection mechanisms operating in cloud environments and relying on machine learning algorithms and distributed processing are an important research issue. In this work, we propose a real-time detection of DDoS attacks using machine learning classifiers on a distributed processing platform. We evaluate the DDoS detection mechanism in an OpenStack-based cloud testbed using the Apache Spark framework. We compare the classification performance using benchmark and real-time cloud datasets. Results of the experiments reveal that the random forest method offers better classifier accuracy. Furthermore, we demonstrate the effectiveness of the proposed distributed approach in terms of training and detection time.

Detecting impersonation attacks in cloud computing environments using a centric user profiling approach

Cloud computing has become the most needed technology for the IT industry. Impersonation attacks are among the most dangerous threats that Clouds face. In this paper, we present an approach to detect masquerade attacks in Clouds. The efficient detection of these attacks should correlate user behaviors in distinct environments and also should apply to several deployment models. We present and evaluate three approaches to detect Impersonation and masquerade attacks. The first approach analyzes sequences of correlated system calls from the VMs operating systems, while the second analyzes the NetFlow data from the network environment. The third approach integrates these two approaches by using a neural network that will produce better detections than any of the first two approaches. To simplify the testing and the evaluation of the three methods, the Cloud Intrusion Detection Dataset (CIDD) is used as a source for cloud audits data. The evaluation has considered alternative deployment models through our two intrusion detection frameworks, CIDS and CIDS-VIRT. The paper also shows that the proposed detection approaches are more accurate and outperform the SWAD-MMD, a recent masquerade detection framework that works in the cloud computing systems. Furthermore, the paper details our experimental results and evaluates the computational performance and the detection accuracy of these approaches.

Detection and mitigation of fraudulent resource consumption attacks in cloud using deep learning approach

Fraudulent Resource Consumption (FRC) attacks can be synthesized by subtly consuming metered resources of the cloud servers over a sustained period of time. The objective of the attacker in such attacks is to exploit the utility pricing model by fraudulently consuming cloud resources. This skillful over-consumption of resources results in a considerable financial burden to the client. These attacks are characterized by low-intensity HTTP requests per hour, akin to requests by legitimate users. Hence, the attack requests differ in intent but not in content, which makes FRC attacks hard to detect. In this paper, we propose P-estimation detection scheme to effectively detect these attacks. This is accomplished by training several deep learning LSTM models based on the web server logs. An estimate of attack percentage is calculated and then used to deploy the appropriate detection model. This technique takes into account the dynamic nature of websites where the popularity of web pages can change with time, by retraining and updating the detection models periodically. To the best of the authors’ knowledge, this technique outperforms all the existing FRC detection techniques with a False Negative Rate (FNR) and False Positive Rate (FPR) of 0.0059% and 0.0% respectively. The proposed technique is able to detect attacks as low as 2% intensity. In addition to the detection scheme, this paper also delivers a mitigation and attribution technique to identify such attackers and block them.

A Bayesian Q-Learning Game for Dependable Task Offloading Against DDoS Attacks in Sensor Edge Cloud

To enhance dependable resource allocation against increasing distributed denial-of-service (DDoS) attacks, in this article, we investigate interactions between a sensor device–edgeVM pair and a DDoS attacker using a game-theoretic framework, under the constraints of the task time, resource budget, and incomplete knowledge of the processing time of machine learning tasks. In this game, the sensor device expects an edgeVM to cooperate and choose its resource allocation strategy with the objective of satisfying the minimum resource required of machine learning tasks at the corresponding sensor device. Similarly, the attacker’s objective is to strategically allocate resources so that the resource constraint of the machine learning tasks is not satisfied. Owing to a lack of complete information of the processing time of the machine learning tasks, this strategic resource allocation problem between the two players is modeled as a Bayesian $Q$ -learning game, in which the optimal strategies of the sensor device–edgeVM pair and the attacker are analyzed. Furthermore, probability distributions are employed by the corresponding players to model the incomplete nature of the game and a greedy $Q$ -learning algorithm is proposed to dependable resource allocation against DDoS attacks. Numerical simulation results demonstrate that the proposed mechanism is superior to other dependable resource allocation mechanisms under incomplete information for DDoS attacks in the sensor edge cloud.

Separating Monitoring from Control in SDN to Mitigate DDoS Attacks in Hybrid Clouds

Background & Objective: Detecting and mitigating Distributed Denial of Service (DDoS) attacks is a serious problem. In addition, new features and network deployments such as Software- Defined Networking (SDN) may open the door for new threats that did not previously exist. : Recent publications and patent are reviewed to find new techniques developed for integrating different mechanisms to secure networks against DDoS. Methods: This work presents a simple model for integrating different mechanisms to secure both SDN and legacy network in a hybrid cloud environment, it is called FocusON. It aims at mitigating DDoS attacks of a victim network. In addition, separating network monitoring from its control aims at mitigating DDoS attacks of a victim network. Traffic pattern analysis is apart from attack detection mechanism that gives a conceptual representation of a specific kind of DDoS attacks. DDoS detection is a completely automated process. Once called, for the reaction, the active response will be taken against the real IP source of the attacker. : The communication time overhead was tested in order to evaluate the remote server response time in case of deploying our proposed model mechanisms and without our proposed model. : Here we introduce a response mechanism that consists of an analysis of event logs, traffic patterns, and IP traceback. The proposed model categorizes the underlying network according to the location into a victim network and the source of attack (public cloud). Results & Conclusion:: The proposed model implemented in a hybrid cloud environment using the network of SDN and legacy network. The experimental setup was built using our network lab connected to the Amazon public cloud.

An optimistic technique to detect Cache based Side Channel attacks in Cloud

Data security is the most critical field in Cloud Computing. The Critical data can leak through unpredictable side channels, posing very risky threats to information security. The Cache-based Side Channel Attacks (CSCAs) is one of the most challenging attacks. Different secure cache architectures have been proposed to defend against these attacks. But these solutions are not reliable to detect and prevent those attacks. Detection of CSCAs is a very important research-related problem. In this paper we demonstrated the detection of CSCAs. We measured the vCPU cycle, virtual memory utilization and cache miss rate to detect the attackers. We illustrated Prime + Probe attack, Flush + Flush attack, and Flush + Reload attack on the AES cryptosystem. Our detection technique is compared with the existing detection solution to demonstrate the accuracy. Our proposed work is achieved 92.5% accuracy to detect the CSC attacks. With the help of our proposed system the Cloud Service Providers(CSPs) can identify the attackers of VMs and host machines to safe guard victim users from the CSCA.