A Framework for the Attack Tolerance of Cloud Applications Based on Web Services

Abstract

Information systems of companies and organizations are increasingly designed using web services that allow different applications written in different programming languages to communicate. These systems or some parts of them are often outsourced on the cloud, first to leverage the benefits of cloud platforms (e.g., scalability) and also to reduce operational costs of companies as well. However, web services as well as cloud platforms may be the target of attacks that alter their security, and the security of web services is not completely addressed. The solutions proposed in the literature are sometimes specific to certain types of attacks and they cannot ensure the attack tolerance of web services. Attack tolerance can be defined as the capability of a system to function properly with minimal degradation of performance, even if the presence of an attack is detected. As such, we claim that, to achieve attack tolerance, one should detect attacks by a continuous monitoring and mitigate the effects of these attacks by reliable reaction mechanisms. For this aim, an attack tolerance framework is proposed in this paper. This framework includes the risks analysis of attacks and is based on diversification and software reflection techniques. We applied this framework to cloud applications that are based on web services. After describing the core foundation of this approach, we express such cloud applications as choreographies of web services according to their distributed nature. The framework has been validated through an electronic voting system. The results of these experiments show the capability of the framework to ensure the required attack tolerance of cloud applications.

Data security techniques in cloud computing based on machine learning algorithms and cryptographic algorithms: Lightweight algorithms and genetics algorithms

“…Data duplication is the process of eliminating multiple copies of repeated data 30,32 By making sure the duplication takes place when the correct amount of file copies is required, this assault is lessened. Application‐based attacks : The application running in the cloud may experience a number of attacks that degrade its functionality and result in the disclosure of information for nefarious intentions. Malware infusion and stenography attacks, shared designs, online services, and convention‐based attacks are the three main applications‐based threats 57 …”

A Review on Challenges in Cloud Computing Security and Recent Researchs

“…Literatürdeki çalışmaların çoğu belirli bir saldırı tipine yönelik yapılmış olup, web hizmetlerinin saldırı toleransları açıkça ortaya konmamıştır. Çalışmada [3] çeşitlendirme ve yansıtma tekniklerine dayalı, risk analizi de içeren bir saldırı tolerans çerçevesi sunulmuştur. Uygulama güvenliği kapsamında yapılan bir diğer çalışmada [4] ise uygulama tasarımı aşamasında kullanılmak üzere, bulut güvenlik metriklerini de içerecek şekilde çalışabilen bir risk değerlendirme çerçevesi sunulmuştur.…”

Cyber-Resilience Evaluation of Cyber-Physical Systems

“…Other diversity solutions may work also in a detection-reaction manner. For example, Ouffoué et al [110,178] use diversification to create attack tolerant web services. They modeled the services to extract different implementations using variation in style, encoding, and language.…”