Automating Intrusion Response via Virtualization for Realizing Uninterruptible Web Services

We present a virtualization-based Web server system, a prototype, and experimental results for providing uninterrupted Web services in the presence of intrusion attacks and software faults. The proposed system utilizes replicated virtual servers managed by a closed-loop feedback controller. Using anomaly and intrusion sensor outputs, the controller calculates cost-weighted actions against threats to ensure Web service continuity. We will show that the system can handle broad classes of attacks. Experiment results show that our prototype retains 60% of its peak throughput under 8 DoS attacks per second over extended periods.