Cloud VM Attack Detection via Resource Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing architectures face a new security vulnerability due to resource contention management mechanisms, where malicious actors can exploit fluctuations in virtual machine resource consumption to trigger unnecessary migrations, degrading performance and causing security breaches that current detection methods fail to identify.
Innovation Solution
A method involving a detection entity that partitions virtual machines into stable and fluctuating consumption subsets, computes time correlation values, and identifies virtual machines with high correlation as potential attack sources, using algorithms like k-means and canonical correlation analysis to detect and mitigate attacks by managing resource migrations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If resource contention management mechanisms are implemented to balance resource use in real time, then resource allocation efficiency is improved, but virtual machine isolation security deteriorates
Solution Approach 1:
The patent introduces a detection entity as an intermediary component that monitors resource consumption patterns across virtual machines. This mediator detects coordinated fluctuations that indicate attacks before they can exploit the resource contention mechanisms, thereby maintaining both efficient resource allocation and security isolation. The detection entity acts as a buffer between the resource management system and potential attack vectors.
2Adaptability or versatility
If virtual machine migration is used to satisfy increased resource needs, then resource demand responsiveness is improved, but performance stability deteriorates
Solution Approach 1:
The patent applies preliminary action by detecting abnormal resource consumption patterns and identifying potential attacks before migrations are triggered. The detection entity analyzes resource fluctuation patterns in advance, allowing the system to prevent malicious migrations while still permitting legitimate resource adjustments. This early detection ensures that performance stability is maintained while preserving the ability to respond to genuine resource demands.
3Device complexity
If attack detection focuses on directly manipulated resource space, then detection simplicity is improved, but detection coverage deteriorates
Solution Approach 1:
The patent transitions detection from a single-dimensional approach (monitoring only directly manipulated resources) to a multi-dimensional approach by analyzing correlations across multiple virtual machines' resource consumption patterns. The detection entity examines temporal correlations in resource usage across different VMs, adding a temporal and relational dimension to detection. This enables coverage of indirect attacks while maintaining manageable complexity through correlation-based analysis rather than exhaustive monitoring of all possible attack vectors.
Data Source
AI summary
A method and a detection entity for detecting attacks in a system including at least two host servers. Each host server hosts a set of virtual machines. The detection entity performs acts of: detecting that a number of migrations of virtual machines from one server to another during a current time period is greater than a threshold value; partitioning the virtual machines of the system into a first subset having a stable profile of consumption of at least one resource, and into a second subset having a fluctuating profile; calculating, for the pairs of virtual machines of the second subset, a value of temporal correlation between the two profiles of the pair; and identifying in the second subset the virtual machines for which the correlation value is greater than or equal to a threshold correlation value, the machines being identified as constituting the origin of the attack.