By Topic

Detecting anomalies in IaaS environments through virtual machine host system call analysis

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$31 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

2 Author(s)
Alarifi, S.S. ; Dept. of Math., R. Holloway, Univ. of London, London, UK ; Wolthusen, S.D.

Providers and consumers of Infrastructure-as-a-Service (IaaS) virtual machine resources may be the subject of a number of attacks, particularly in public cloud environments. Detecting anomalies is hence critical both to protect against misuse and attacks, but is subject to constraints. These include primarily efficiency, but also legal and contractual restrictions limiting the depth of intrusiveness, which can be achieved by an intrusion detection system. In many cases, the IaaS provider will also have very limited insights into the actual workloads used by clients. In this paper we therefore propose to monitor system calls at the VM host level without requiring any instrumentation within VMs and argue that this level of granularity is sufficient to capture a number of relevant attack classes. This, together with the efficiency and efficacy of the approach is shown through experiments and statistical analysis in a Linux KVM-based reference scenario. The proposed system, unlike other systems such as VM Introspection (VMI), does not require any knowledge about VMs from inside nor requiring any OS or hypervisor modifications.

Published in:

Internet Technology And Secured Transactions, 2012 International Conference for

Date of Conference:

10-12 Dec. 2012