Study of Danger-Theory-Based Intrusion Detection Technology in Virtual Machines of Cloud Computing Environment
2
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
In existing cloud services, information security and privacy concerns have been worried, and have becomeone of the major factors that hinder the popularization and promotion of cloud computing. As the cloudcomputing infrastructure, the security of virtual machine systems is very important. This paper presents animmune-inspired intrusion detection model in virtual machines of cloud computing environment, denoted IVMIDS,to ensure the safety of user-level applications in client virtual machines. The model extracts systemcall sequences of programs, abstracts them into antigens, fuses environmental information of client virtualmachines into danger signals, and implements intrusion detection by immune mechanisms. The model iscapable of detecting attacks on processes which are statically tampered, and is able to detect attacks onprocesses which are dynamically running. Therefore, the model supports high real time. During the detectionprocess, the model introduces information monitoring mechanism to supervise intrusion detection program,which ensures the authenticity of the test data. Experimental results show that the model does not bring muchspending to the virtual machine system, and achieves good detection performance. It is feasible to apply IVMIDSto the cloud computing platform.
Abstract
In existing cloud services, information security and privacy concerns have been worried, and have becomeone of the major factors that hinder the popularization and promotion of cloud computing. As the cloudcomputing infrastructure, the security of virtual machine systems is very important. This paper presents animmune-inspired intrusion detection model in virtual machines of cloud computing environment, denoted IVMIDS,to ensure the safety of user-level applications in client virtual machines. The model extracts systemcall sequences of programs, abstracts them into antigens, fuses environmental information of client virtualmachines into danger signals, and implements intrusion detection by immune mechanisms. The model iscapable of detecting attacks on processes which are statically tampered, and is able to detect attacks onprocesses which are dynamically running. Therefore, the model supports high real time. During the detectionprocess, the model introduces information monitoring mechanism to supervise intrusion detection program,which ensures the authenticity of the test data. Experimental results show that the model does not bring muchspending to the virtual machine system, and achieves good detection performance. It is feasible to apply IVMIDSto the cloud computing platform.
참고문헌 (24)
- Z. Y. Qin, "Survey on virtual machine system security", Application Research of Computers, 29(5), pp.1618~1622 (2012)
- L. M. Cao, "Security detection of virtual machine process in private cloud platform", Application Research of Computers, 30(5), pp.1495~1499 (2013)
- P. Barham, "Xen and the art of virtualization", Proceedings of the 19th ACM Symposium on Operating Systems Principles, pp.164~177 (2003)
- D. Chisnall, "The Definitive Guide to the Xen Hypervisor" (2007), Prentice-Hall
- P. Matzinger, "The danger model: a renewed sense of self", Science, 296(5566), pp.301~305 (2002)[DOI]
- A. Haeberlen, "Accountable virtual machines", Proceedings of 9th USENIX Symposium on Operating Systems Design and Implementation, pp.119~134 (2010)
- B. D. Payne, "Lares: an architecture for secure active monitoring using virtualization", Proceedings of the IEEE Symposium on Security and Privacy, pp.233~247 (2008)
- M. Sharif, "Secure in-VM monitoring using hardware virtualization", Proceedings of the 16th ACM Conference on Computer and Communications Security, pp.477~487 (2009)
- Z. Wang, "Countering kernel rootkits with lightweight hook protection", Proceedings of the 16th ACM Conference on Computer and Communications Security, pp.545~554 (2009)
- O. S. Hofmann, "Ensuring operating system kernel integrity with OSck", Proceedings of the 16th International Conference on Architectural Support for Programming Languages and Operating Systems, pp.279~290 (2011)
- A. Baliga, "Detecting kernel-level rootkits using data structure invariants", IEEE Transactions on Dependable and Secure Computing, 8(5), pp.670~684 (2011)[DOI]
- S. Bharadwaja, "Collabra: a Xen hypervisor based collaborative intrusion detection system", Proceedings of the 8th International Conference on Information Technology: New Generations, pp.695~700 (2011)
- A. Srivastava, "Operating system interface obfuscation and the revealing of hidden operations", Proceedings of the 8th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp.214~233 (2011)
- J. Szefer, "Eliminating the hypervisor attack surface for a more secure cloud", Proceedings of the 18th ACM Conference on Computer and Communications Security, pp.401~412 (2011)
- H. Benzina, "Some ideas on virtualized system security, and monitors", Proceedings of the 5th International Workshop on Data Privacy Management, pp.244~258 (2010)
- L. Wang, "Detecting and managing hidden process via hypervisor", Journal of Computer Research and Development, 48(8), pp.1534~1541 (2011)
- D. Fang, "DAS-VMP: a virtual machine-based software protection method for defending against semantic attacks", Journal of Sichuan University (Engineering Science Edition), 49(1), pp.159~168 (2017)
- X. Liang, "Cross-VM cache side channel attacks in cloud: a survey", Chinese Journal of Computers, 40(2), pp.317~336 (2017)
- M. Zhu, "The security research of virtualization software stack", Chinese Journal of Computers, 40(2), pp.481~504 (2017)
- S. Forrest, "Self-nonself discrimination in a computer", Proceedings of the IEEE Symposium on Research in Security and Privacy, pp.202~212 (1994)
- X. Tian, "Anomaly Detection of Program Behaviors Based on System Calls and Homogeneous Markov Chain Models", Journal of Computer Research & Development, 44(9), pp.1538~1544 (2007)[DOI]
- D. Y. Li, "Artificial intelligence with uncertainty", Journal of Software, 15(11), pp.1583~1594 (2004)
- S. C. Woo, "The SPLASH-2 programs: characterization and methodological considerations", Proceedings of the 22nd Annual International Symposium on Computer Architecture, pp.24~36 (1995)
- J. P. Singh, "SPLASH: Stanford parallel applications for shared-memory", ACM SIGARCH Computer Architecture News, 20(1), pp.5~44 (1992)[DOI]