Addressing memory exhaustion failures in Virtual Machines in a cloud environment

The rapid growth in cloud computing encourages the cloud provider to create more reliable, scalable and efficient cloud environment. For providing such a scalable environment, cloud provider develops large-scale Cloud Data Centers (CDC). Such CDCs consume a large amount of electrical energy for operational purpose and cooling purpose to keep the machines operating at a right temperature, but it also emits a large amount of carbon-dioxide. Thus to decrease the energy consumption, Virtual Machines (VMs) are consolidated to fewer numbers of active servers through VM migration techniques, this leads to Service Level Agreement (SLA) violation and performance degradation. Therefore to retain the energy-performance tradeoff, we should perform an optimum number of VM migrations. There are two cases when the VM migration performed: First when a hot spot is found and Second when a cold spot is found. But in both the cases we do not directly migrate the VM instead first we check whether it is required to migrate the VM. After that, the algorithm finds an appropriate destination host on which the VM will be migrated. In this paper, we implement three approaches to select destination host: First-fit, Best-fit, and Worst-fit. Finally compare the result of a number of VM migration performed, energy consumption and SLA violations with existing one.

Cloud provider (CP) leases various resources such as CPUs, memory and storage in the form of virtual machine (VM) instances to clients over internet. This paper tackles the issue of quality of service (QoS) provisioning in cloud environment. We examine using Q-learning for provisioning VMs in the cloud market. The extracted decision function should decide when rejecting new request for VMs that violate QoS guarantee. This problem requires the reward for CP be maximised while simultaneously meeting a quality of service (QoS) constraints. These complex contradicting objectives are embedded in our Q-learning model that is developed and implemented as shown in this paper. Numerical analysis shows the ability of our solution to earn significantly higher revenue than alternatives.

SummaryThis paper focus on providing a secure and trustworthy solution for virtual machine (VM) migration within an existing cloud provider domain, and/or to the other federating cloud providers. The infrastructure‐as‐a‐service (IaaS) cloud service model is mainly addressed to extend and complement the previous Trusted Computing techniques for secure VM launch and VM migration case. The VM migration solution proposed in this paper uses a Trust_Token based to guarantee that the user VMs can only be migrated and hosted on a trustworthy and/or compliant cloud platforms. The possibility to also check the compliance of the cloud platforms with the pre‐defined baseline configurations makes our solution compatible with an existing widely accepted standards‐based, security‐focused cloud frameworks like FedRAMP. Our proposed solution can be used for both inter‐ and intra‐cloud VM migrations. Different from previous schemes, our solution is not dependent on an active (on‐line) trusted third party; that is, the trusted third party only performs the platform certification and is not involved in the actual VM migration process. We use the Tamarin solver to realize a formal security analysis of the proposed migration protocol and show that our protocol is safe under the Dolev‐Yao intruder model. Finally, we show how our proposed mechanisms fulfill major security and trust requirements for secure VM migration in cloud environments.

Nowadays the safety of computer networks becomes more important than other characteristics. The services which are used by a huge number of users entice hacker. Especially, online payment services are often the main target of malicious software. In the article, the computer virus SpyEye spread via Internet resources is considered. The Petri-object model of propagation process is created with the use of Petri-object simulation software written in Java. The model reproduces the events of damaging website, infecting user’s resource, sending information about vulnerabilities and sending personal data. It was suggested that users are connected when they use the same website. The investigation of the spreading time for different kinds of users’ connections topology is presented. It was considered not only well-known star and chain topologies but also their combinations and the topology with random connections. Simulation results confirm the virus spreading time dependence on user’s connections topology.

Cloud computing is distributed computing, storing, sharing and accessing data over the Internet. It provides a pool of shared resources to the users available on the basis of pay as you go service that means users pay only for those services which are used by him according to their access times. Load balancing ensures that no single node will be overloaded and used to distribute workload among multiple nodes. It helps to improve system performance and proper utilization of resources. We propose an improved load balancing algorithm for job scheduling in the cloud environment using K-Means clustering of cloudlets and virtual machines in the cloud environment. All the cloudlets given by the user are divided into 3 clusters depending upon client’s priority, cost and instruction length of the cloudlet. The virtual machines inside the datacenter hosts are also grouped into multiple clusters depending upon virtual machine capacity in terms of processor, memory, and bandwidth. Sorting is applied at both the ends to reduce the latency. Multiple number of experiments have been conducted by taking different configurations of cloudlets and virtual machine. Various parameters like waiting time, execution time, turnaround time and the usage cost have been computed inside the cloudsim environment to demonstrate the results. Compared with the other job scheduling algorithms, the improved load balancing algorithm can outperform them according to the experimental results.Â

There is an increasing demand of HPC-aware clouds to perform High Performance Computations rather than HPC-unaware clouds. Since renting saves lot of cost and time, people are moving towards cloud environments rather than owning costly supercomputers. There are many cloud providers in the market, and hence there is much of research going on for providing HPC-aware clouds, as HPC applications requires more computations compared to other applications. In this paper we describe an approach to allocate cloud resources by identifying the type of the virtual machine (storage-intensive or compute-intensive). We also present an algorithm which statically schedules the virtual machines (VM) to the CPUs based on CPU affinity. We observed that the performance of HPC applications is consistently better by statically scheduling the VMs allocation, when compared with default host operating system scheduling policy on an environment with multi-tenancy and heterogeneity. We obtain a speedup of upto 10% with our static scheduling when compared with default host operating system scheduling policy.

Information technology (IT) providers should use cloud-based services due to their flexibility, reliability, and scalability to handle the rising requirement for processing capacity. The maintenance of dependable services between cloud providers and their customers in a cloud environment, on the other hand, depends on Quality of Service (QoS) assurance. Virtual machine (VM) consolidation is nondeterministic polynomial time (NP) hard issue, and numerous heuristic techniques have been suggested to solve it. In this work, the suggested VM consolidation technique takes into account both current and future uniform distribution elephant herding optimization (UDEHO) based VM consolidation approaches for resource utilization via host overload detection (utilization prediction based potential overload detection (UP-POD)) and host underload detection (UP-PUD). A UDEHO method efficiently predicts resource use in the future. Depending on the power utilization and the number of migrations, a power-saving value is advised for identifying under-loaded hosts. Furthermore, the CloudSim toolkit is used to construct and test these techniques using the same experimental parameters. Lastly, the findings demonstrate that the suggested methodologies considerably decrease the number of VM migrations by about 0.073%, the energy usage of about 11%, and SLA violations by 6.15% while retaining QoS guarantees when compared to conventional techniques.

Infrastructure as a Service (IaaS) cloud has been attracting more and more customers as it provides the highest level of flexibility by offering configurable virtual machines (VMs) and computing infrastructures. Public VM images are usually available for customers to customize and launch. However, the 1 to N mapping between VM images and running instances in IaaS makes vulnerabilities propagate rapidly across the entire public cloud. Besides, IaaS cloud naturally comes with a larger and more stable attack surface and more concentrated target resources than traditional surroundings. In this paper, we first identify the threat of exploiting prevalent vulnerabilities over public IaaS cloud with an empirical study in Amazon EC2. We find that attackers can compromise a considerable number of VMs with trivial cost. We then do a qualitative cost-effectiveness analysis of this threat. Our main result is a two-fold observation: in IaaS cloud, exploiting prevalent vulnerabilities is much more cost-effective than traditional in-house computing environment, therefore attackers have stronger incentive; Fortunately, on the other hand, cloud defenders (cloud providers and customers) also have much lower cost-loss ratio than in traditional environment, therefore they can be more effective for defending attacks. We then build a game-theoretic model and conduct a risk-gain analysis to compare exploiting and patching strategies under cloud and traditional computing environments. Our modeling indicates that under cloud environment, both attack and defense become less cost-effective as time goes by, and the earlier actioner can be more rewarding. We propose countermeasures against such threat in order to bridge the gap between current security situation and defending mechanisms. To our best knowledge, we are the first to analyze and model the threat with prevalent known-vulnerabilities in public cloud.

Cloud computing is distributed computing, storing, sharing and accessing data over the Internet. It provides a pool of shared resources to the users available on the basis of pay as you go service that means users pay only for those services which are used by him according to their access times. This research work deals with the balancing of work load in cloud environment. Load balancing is one of the essential factors to enhance the working performance of the cloud service provider. It would consume a lot of cost to maintain load information, since the system is too huge to timely disperse load. Load balancing is one of the main challenges in cloud computing which is required to distribute the dynamic workload across multiple nodes to ensure that no single node is overwhelmed. It helps in optimal utilization of resources and hence in enhancing the performance of the system. We propose an improved load balancing algorithm for job scheduling in the cloud environment using load distribution table in which the current status, current package, VM Capacity and the number of cloudlets submitted to each and every virtual machine will be stored. Submit the job of the user to the datacenter broker. Data center broker will first find the suitable Vm according to the requirements of the cloudlet and will match and find the most suitable Vm according to its availability or the machine with least load in the distribution table. Multiple number of experiments have been conducted by taking different configurations of cloudlets and virtual machine. Various parameters like waiting time, execution time, turnaround time and the usage cost have been computed inside the cloudsim environment to demonstrate the results. The main contributions of the research work is to balance the entire system load while trying to minimize the make span of a given set of jobs. Compared with the other job scheduling algorithms, the improved load balancing algorithm can outperform them according to the experimental results.

In nowadays cloud computing systems, leveraging the virtualization technology, the customer's requested data computing or storing service is accommodated by a set of mutual-communicated Virtual Machines (VM) in a scalable and elastic manner. These VMs are placed in one or more datacenter nodes according to nodes' capacities, failure probabilities, etc. The VM placement availability refers to the probability that at least one set of the whole customer's requested VMs operates during the entire requested lifetime. The placed VMs should obey the agreed-upon availability, otherwise the cloud provider may face revenue loss. In this paper, we study the problem of placing at most H sets of k requested VMs on minimum number of datacenter nodes, such that the VM placement availability requirement is satisfied and each VM pair has a communication delay no greater than the specified. We prove that this problem is NP-hard. We subsequently propose an exact Integer Nonlinear Program (INLP) and an efficient heuristic to solve this problem. Finally, we conduct simulations to compare the proposed algorithms with two existing heuristics in terms of acceptance ratio, average number of used nodes and running time.

In recent decades, task scheduling and load balancing in the cloud is a growing research area, due to the vast amount of data stored in the server highly increases the load. In order to address this concern, Hybrid Max-Min Genetic Algorithm (HMMGA) is proposed for task scheduling and load balancing in the cloud environment. At first, the load is evaluated for every Virtual Machine (VM), if the load is high, then HMMGA is used for balancing the load. HMMGA selects the best VMs to assign the tasks and migrates the over-loaded VMs tasks to the under-loaded VMs. HMMGA significantly avoids the imbalanced workload performance in the cloud environment. In this research paper, the proposed HMMGA performance is compared to Max-Min algorithm, Low time complexity and low cost binary Particle Swarm Optimizer (IBPSO-LBS) and PSO with Technique of Order Preference by Similarity to Ideal Solution (TOPSIS) algorithm to examine the efficacy of HMMGA. From the experimental simulation, the result shows that HMMGA averagely delivers 1.63 and 3.88 seconds less make span compared to the Max-Min and TOPSIS-PSO algorithm for five VMs. In addition, HMMGA averagely enhances 10% to 40% of resource utilization than the MaxMin and TOPSIS-PSO algorithm. In another experiment, the HMMGA approximately showed 1.7 to 25.99 seconds less average waiting time compared to the Max-Min and IBPSO-LBS.

High availability is the most important and challenging problem for cloud providers. However, virtual machine monitor (VMM), a crucial component of the cloud infrastructure, has to be frequently updated and restarted to add security patches and new features, undermining high availability. There are two existing live update methods to improve the cloud availability: kernel live patching and Virtual Machine (VM) live migration. However, they both have serious drawbacks that impair their usefulness in the large cloud infrastructure: kernel live patching cannot handle complex changes (e.g., changes to persistent data structures); and VM live migration may incur unacceptably long delays when migrating millions of VMs in the whole cloud, for example, to deploy urgent security patches. In this paper, we propose a new method, VMM live upgrade, that can promptly upgrade the whole VMM (KVM & QEMU) without interrupting customer VMs. Timely upgrade of the VMM is essential to the cloud because it is both the main attack surface of malicious VMs and the component to integrate new features. We have built a VMM live upgrade system called Orthus. Orthus features three key techniques: dual KVM, VM grafting, and device handover. Together, they enable the cloud provider to load an upgraded KVM instance while the original one is running and cut-and-paste'' the VM to this new instance. In addition, Orthus can seamlessly hand over passthrough devices to the new KVM instance without losing any ongoing (DMA) operations. Our evaluation shows that Orthus can reduce the total migration time and downtime by more than $99%$ and $90%$, respectively. We have deployed Orthus in one of the largest cloud infrastructures for a long time. It has become the most effective and indispensable tool in our daily maintenance of hundreds of thousands of servers and millions of VMs.

In cloud computing environment, the load balancing of non pre-emptive independent tasks is an important aspect of task scheduling. The tasks are executed on Virtual Machines (VMs) and these VMs are run in parallel so that the load has to be well balanced across all VMs. Since the cloud user pay for the service he/she is interested in reducing the execution time of task as well as the cost of using VM instances (CPU, Memory, Bandwidth etc). The proposed algorithm balance the load across VMs effectively by mapping tasks to under loaded or idle VMs based on the foraging behaviour of honey bees and if there is more than one under loaded VMs, it also selects cost efficient one using Pareto dominance strategy. The experimental results show that the algorithm is effective when compared with existing algorithms and it also reduces the cost of using VM instances.

HEPGA: A new effective hybrid algorithm for scientific workflow scheduling in cloud computing environment

Cloud computing is a convenient model for processing data remotely. However, users must trust their cloud provider with the confidentiality and integrity of the stored and processed data. To increase the protection of virtual machines, AMD introduced SEV, a hardware feature which aims to protect code and data in a virtual machine. This allows to store and process sensitive data in cloud environments without the need to trust the cloud provider or the underlying software. However, the virtual machine still depends on the hypervisor for performing certain activities, such as the emulation of special CPU instructions, or the emulation of devices. Yet, most code that runs in virtual machines was not written with an attacker model which considers the hypervisor as malicious. In this work, we introduce a new class of attacks in which a malicious hypervisor manipulates external interfaces of an SEV or SEV-ES virtual machine to make it act against its own interests. We start by showing how we can make use of virtual devices to extract encryption keys and secret data of a virtual machine. We then show how we can reduce the entropy of probabilistic kernel defenses in the virtual machine by carefully manipulating the results of the CPUID and RDTSC instructions. We continue by showing an approach for secret data exfiltration and code injection based on the forgery of MMIO regions over the VM's address space. Finally, we show another attack which forces decryption of the VM's stack and uses Return Oriented Programming to execute arbitrary code inside the VM. While our approach is also applicable to traditional virtualization environments, its severity significantly increases with the attacker model of SEV-ES, which aims to protect a virtual machine from a benign but vulnerable hypervisor.