Virtual Machine Attack Detection and Migration Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing architectures, attacks on virtual machines can lead to uncontrolled migrations, impacting host servers and co-tenant virtual machines, causing performance issues and potential unavailability, which is detrimental to the guaranteed availability and pricing contracts for multiple customers.

Innovation Solution

A method that detects attacks by migrating the virtual machine to a dedicated security environment for processing, avoiding successive uncontrolled migrations and reducing network performance impacts, using a local security virtual machine to trigger the migration to a specialized security server with dedicated resources, and then returning the virtual machine to its original cluster once the attack is processed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If virtual machine migration is used to balance resource distribution and ensure availability, then service availability is improved, but uncontrolled successive migrations can occur under attack conditions causing system instability

Engineering Contradiction:

Improveservice availabilityVSAvoidsystem stability

Core Design Contradiction:

ReliabilityVSStability of the object's composition

Solution Approach 1:

The patent implements a feedback mechanism by monitoring migration patterns and detecting when a virtual machine undergoes multiple migrations within a time window. This feedback triggers an intervention to prevent further migrations, thus stabilizing the system while maintaining the availability benefits of migration-based load balancing.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent applies preliminary anti-action by proactively preventing further migrations when an attack pattern is detected. The system anticipates that continued migrations under attack conditions will cause system instability, and takes preventive action by blocking additional migration attempts before they can occur, thereby protecting system stability while preserving availability through the already-performed migrations.

Inventive Principle:

Principle #9Preliminary anti-action

2Adaptability or versatility

If virtual machine migration is performed frequently to handle load increases, then resource allocation flexibility is improved, but network performance deteriorates due to repeated data transmission

Engineering Contradiction:

Improveresource allocation flexibilityVSAvoidnetwork performance

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The monitoring mechanism provides feedback on migration frequency and triggers prevention actions when excessive migrations are detected within a time window, thereby reducing unnecessary network traffic while preserving the flexibility to perform migrations when genuinely needed for load balancing.

Inventive Principle:

Principle #23Feedback

3Reliability

If migration constraints are enforced to ensure proper virtual machine placement, then migration reliability is improved, but the number of possible migration targets is reduced

Engineering Contradiction:

Improvemigration reliabilityVSAvoidmigration target options

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the migration decision-making process into two independent parts: (1) constraint validation to ensure migration reliability, and (2) prevention logic to block excessive migrations. This segmentation allows the system to maintain strict constraint enforcement while adding a higher-level control mechanism that doesn't interfere with the fundamental migration constraints but prevents their abuse under attack conditions.

Inventive Principle:

Principle #1Segmentation

4Reliability

If resource balancing is performed to ensure service availability, then customer service level agreements are met, but attack impact propagates across multiple host servers through successive migrations

Engineering Contradiction:

Improveservice level agreement complianceVSAvoidattack propagation

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The system monitors migration patterns and detects when a virtual machine is being migrated repeatedly under attack conditions. This feedback triggers a prevention mechanism that blocks further migrations, thereby containing the attack impact to the affected virtual machine and preventing propagation across multiple host servers while preserving service availability through the initial migration.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent extracts the problematic aspect (excessive migrations under attack) from the beneficial aspect (resource balancing for availability) by implementing a prevention mechanism that selectively blocks only the harmful migrations while allowing legitimate load-balancing migrations to proceed, thus containing attack impact while maintaining service level agreements.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentEP2724509B1Method of detection and protection against attacks

Publication Date: 2017.02.01 ORANGE SA

AI summary

The invention relates to a method for detecting attacks and for protecting a set of virtual machines in a system (11) including at least one first host server (11-1) hosting said set of virtual machines, characterised in that it includes the steps of: receiving (E2) a message for detecting an attack against a virtual machine (VM11); triggering (E4) a first migration of the virtual machine from the first host server to a security system (OSS); and receiving (E6) a message for processing the attack against the migrated virtual machine.