Security and Trustworthiness in Cloud Computing Bruno L. Dalmazo, João P. Vilela, Marília Curado {dalmazo, jpvilela, marilia}@dei.uc.pt CISUC, Department of Informatics Engineering, University of Coimbra Features An O0 O1 O2 O3 O4 ... On A0 A1 A2 A3 A4 An Individual similarity approach for each feature IDS output Alarm database Step 1 F0 F1 F2 F3 F4 Fn Step 2 Clustering relevant features Similarity approach for groups of alarms Features On Step 3 F Poisson Moving Average is based on a statistical model where observations are weighted with a Poisson distribution inside a sliding window 𝑃 𝑁 𝑡 =𝑘 = 𝑒 −𝜆𝑡 (𝜆𝑡) 𝑘 𝑘! A B 𝑆𝑖𝑚 𝐸𝐷 = 𝑖=1 𝑛 ( 𝑥 𝑖 − 𝑦 𝑖 ) 2 𝑆𝑖𝑚 𝑇𝑀 = 𝑖=1 𝑛 𝑥 𝑖 𝑦 𝑖 𝑖=1 𝑛 𝑥 𝑖 2 + 𝑖=1 𝑛 𝑦 𝑖 2 − 𝑖=1 𝑛 𝑥 𝑖 𝑦 𝑖 Reducing the number of messages sent to the server/administrator Using the number of occurrence of these groups to increase the severity of a single alarm Decreasing the network data traffic and its associated transfer costs DyWiSA is a Dynamic Window Size Algorithm focused on providing a standardized approach for evaluating the best candidate predictor models for cloud environments Trustworthiness Security (A) (F) Monitoring i % $ Traffic Predictor Alarm Management (C) i ☼ (3) Sliding Window SMA WMA EMA PMA Dynamic Window Size Algorithm 20 21 8 12 16 26 18 31 9 11 7 3 14 Predicted data flow Original data flow (1) (2) (5) (4) time t time t+1 Predictor Model (B) (E) i n Intrusion Detection System Management Probe Spoofing D-DoS n t (D) E F1 Fn F2 182 85 61 38 68 79 77 . Temporal layers from virtual machines 257 20 03 81 119 36 74 Feature Extraction Approach Feature vector Extracted feature vector C D Anomaly Detection Mechanism Cloud monitoring Event auditor Feature extraction approach SVM model (1) (5) (2) (4) 010 101111 --------------------------------------------- Σ±% Repository of outcomes (3) References [1] Dalmazo B. et al. Performance Analysis of Network Traffic Predictors in the Cloud. Journal of Network and Systems Management. Springer, 2017. [2] Dalmazo B. et al. Online traffic prediction in the cloud. International Journal of Network Management. John Wiley & Sons, 2016. [3] Dalmazo B. et al. Expedite Feature Extraction for Enhanced Cloud Anomaly Detection. IEEE/IFIP NOMS Workshop on Security for Emerging Distributed Network Technologies, 2016.