A Study on the Impact of Memory DoS Attacks on Cloud Applications and Exploring Real-Time Detection Schemes

Even though memory denial-of-service attacks can cause severe performance degradations on co-located virtual machines, a previous detection scheme against such attacks cannot accurately detect the attacks and also generates high detection delay and high performance overhead since it assumes that cache-related statistics of an application follow the same probability distribution at all times, which may not be true for all types of applications. In this paper, we present the experimental results showing the impacts of memory DoS attacks on different types of cloud-based applications. Based on these results, we propose two lightweight and responsive Statistical based Detection Schemes (SDS/B and SDS/P) that can detect such attacks accurately. SDS/B constructs a profile of normal range of cache-related statistics for all applications and use statistical methods to infer an attack when the real-time collected statistics exceed this normal range, while SDS/P exploits the increased periods of access patterns for periodic applications to infer an attack. Upon SDS, we further leverage deep neural network (DNN) techniques to design a DNN-based detection scheme that is general to various types of applications and more robust to adaptive attack scenarios. Our evaluation results show that SDS/B, SDS/P and DNN outperform the state-of-the-art detection scheme, e.g., with 65% higher specificity, 40% shorter detection delay, and 7% less performance overhead. We also discuss how to use SDS and DNN-based detection schemes under different situations.

I. Introduction

Commercial cloud providers (e.g., Amazon [12] and Google [19]) provide elastic Infrastructure-as-a-Service (IaaS) for tenants to deploy applications. To maximize the resource utilization, cloud providers use the virtualization techniques (e.g., hypervisors [13], [40], [45]) to place virtual machines (VMs) from different tenants on the same physical machine (PM). Even though current hypervisors can isolate both memory and physical memory pages [51], most of the underlying hardware memory resources of a PM are still shared by its VMs from different tenants.