Controlled Virtual Resource Access to Mitigate Economic Denial of Sustainability (EDoS) Attacks against Cloud Infrastructures

Abstract

Service providers of the cloud have witnessed a rapidly growing demand to provide services to end-users in a timely manner. Security vulnerabilities against the cloud infrastructure cannot be overlooked. Through exploitation of such weaknesses, the adversary class may disrupt routine cloud operations, and have a debilitating effect on the reputation of the service provider. One attack type specifically affecting cloud services is the Economic Denial of Sustainability (EDoS) attack. Through such a malicious attack, the ability of the service provider to dynamically stretch and accommodate increasing numbers of requests from end-users, is exploited, to make it economically unviable for the service provider to sustain further demand for service from legitimate end-users. In this paper, we propose a novel approach for selectively controlling user requests for service, implemented at the service provider's end. Through this scheme, we reduce i.e mitigate the effects of an imminent EDoS attack against critical cloud resources. Incoming requests are classified into normal or suspicious. Subsequently, further analysis is conducted to ensure that priority to cloud service access is given to those end-users tagged as being legitimate, whereas, suspect users are given lesser priority to service access, until they are eventually removed from the suspect list. Simulations were conducted to study the performance of the scheme, with results showing promise.

DDoS attacks in cloud computing: Issues, taxonomy, and future directions

“…Hidden Servers/ Ports (P2) [37] Moving target approach to hide the servers [32] Secure ephemeral servers with authentication [40] Limits number of connections on hidden ports [41] Moving targets using server replica shuffling [42] Hidden server only visible to benign users [50] Proxy forwards benign requests to the server Restrictive Access (P3) [43] Admission control based on delayed response [44] Human behavior (rate) detection and access [32] Client reputation based prioritized access [40] Admission control puzzles and hidden ports…”

Hierarchical detection of insider attacks in cloud computing systems

“…The extended values are: grep template.properties files, checking the template files or others (Baig and Binbeshr, 2013).…”

“…With a prepared dictionary, the attack is completed by performing the grep command to get specific information. The extended values of this indicator are: virsh command, dump command or string command (Baig and Binbeshr, 2013).…”

“…This information can be gained by using some commands like ping, nslookup, finger, whois and rwho. The extended values of these indicators are; the target is within the company or the target is outside the company (Baig and Binbeshr, 2013). …”

Energy Aware Supervised Pattern Attack Recognition Technique for Mitigation of EDoS Attacks in Cloud Platform

“…It has provided its users to use the data resources with the minimal data overhead. Cloud computing has three service models, four deployment models and five main characteristics [5] . These five characteristics have been shown in Fig.…”