An Anomalous Behavior Detection Model in Cloud Computing

• Published in: Tsinghua science and technology 2016-06, Vol.21 (3), p.322-332
• Main Author: Xiaoming Ye Xingshu Chen Haizhou Wang Xuemei Zeng Guolin Shao Xueyuan Yin Chun Xu
• Format: Article
• Language: English
• Subjects: LAAS; 安全问题; 异常行为; 控制网络系统; 检测模型; 网络流量; 虚拟机; 计算
• ISSN: 1007-0214; 1878-7606; 1007-0214
• DOI: 10.1109/TST.2016.7488743

This paper proposes an anomalous behavior detection model based on cloud computing. Virtual Machines （VMs） are one of the key components of cloud Infrastructure as a Service （laaS）. The security of such VMs is critical to laaS security. Many studies have been done on cloud computing security issues, but research into VM security issues, especially regarding VM network traffic anomalous behavior detection, remains inadequate. More and more studies show that communication among internal nodes exhibits complex patterns. Communication among VMs in cloud computing is invisible. Researchers find such issues challenging, and few solutions have been proposed--leaving cloud computing vulnerable to network attacks. This paper proposes a model that uses Software-Defined Networks （SDN） to implement traffic redirection. Our model can capture inter-VM traffic, detect known and unknown anomalous network behaviors, adopt hybrid techniques to analyze VM network behaviors, and control network systems. The experimental results indicate that the effectiveness of our approach is greater than 90%, and prove the feasibility of the model.