Abstract:Edge-assisted Internet of things applications often need to use cloud virtual network services to transmit data. However, the internal threats such as illegal management and configuration to cloud platform intentionally or unintentionally will lead to virtual network security problems such as malicious changes of user network and hijacked data flow. It will eventually affect edge-assisted Internet of things applications. We propose a virtual network internal threat detection method called VNGuarder in a cloud computing environment, which can effectively monitor whether the virtual network configuration of legitimate users under the IaaS cloud platform has been maliciously changed or destroyed by insiders. First, based on the life cycle of cloud virtual network services, we summarized two types of internal attacks involving illegal use of virtualization management tools and illegal invocation of virtual network-related processes. Second, based on normal behavior of tenants, a hierarchical trusted call correlation scheme is proposed to provide a basis for discovering that insiders illegally call virtualized management tools and virtual network-related processes on the controller node of the cloud platform or the network node and compute node. Third, a trace-enable mechanism combining real-time monitoring and log analysis is introduced. By collecting and recording the complete call process of virtual network management and configuration in the cloud platform, and comparing it with the result of the hierarchical trusted call correlation, abnormal operations can be reported to the tenants in time. Comprehensive simulation experiments on the Openstack platform show that VNGuarder can effectively detect illegal management and configuration of virtual networks by insiders without significantly affecting the creation time of tenant networks and the utilization of CPU and memory.

Detecting the run time attacks in the cloud with an evidence collection based approach

A Virtual Machine Migration Strategy Based on the Relevance of Services Against Side-Channel Attacks

Poster: Tracevirt: A Framework For Detecting The Non-Tampering Attacks In The Virtual Machine

Investigating Timing Channel in IaaS

Retrofitting LBR Profiling to Enhance Virtual Machine Introspection

How to Shutdown a Cloud: a DDoS Attack in a Private Infrastructure-As-a-service Cloud.

Detection of Information leakage in cloud

An In-Out-VM measurement architecture against dynamic attacks in clouds

Detecting VMs Co-residency in Cloud: Using Cache-based Side Channel Attacks

Research On Security Of Virtual Cloud

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

Malicious Virtual Machines Detection Through A Clustering Approach

VNGuarder: An Internal Threat Detection Approach for Virtual Network in Cloud Computing Environment

Real-Time Online Detection Method for Web Attack Based on Flow Data Analysis

A Security-Awareness Virtual Machine Management Scheme Based on Chinese Wall Policy in Cloud Computing.

Cross-VM Cache Side Channel Attacks in Cloud: A Survey

An In-VM Measuring Framework for Increasing Virtual Machine Security in Clouds

VMScan: an Out-of-vm Malware Scanner

Kernel Intrusion Detection Method Based on Xen Hypervisor

Cloud Watching: Understanding Attacks Against Cloud-Hosted Services

Optimizing Dynamic Survivability and Security of Replicated Data in Cloud Systems under Co-Residence Attacks.