Fuzz testing in AWS Firecracker hypervisor

The analysis of the volatile memory (RAM) of a computer system, known as memory forensics, is a critical component of modern digital forensics investigations. Since the evidence provided by memory forensics is vital, it is necessary for there to be automated solutions that implement the analysis. Volatility is the most widely used memory forensics framework and also contains the most functionality of all tools publicly available. Volatility, as well as all other memory forensics frameworks, are extremely complex software systems as they must parse a substantial number of in-memory data structures and their associated values. Given the reliance on memory forensics during digital investigations, robust automation of artifact extraction and presentation is required. In this study, novel methods for scalable fuzz testing were developed and the implementations of these methods were thoroughly evaluated against the Volatility framework. Fuzz testing is a technique in which a target program is intentionally fed faulty data in order to discover whether it enters an unexpected state during processing. The developed fuzzer generates thousands of mutations, each of which is specifically generated to stress test the algorithms of memory forensic frameworks. Since the developed library of mutation is so extensive, complete fuzz testing requires copious amounts of compute time and memory. To handle these requirements in a scalable and flexible manner, the developed system was designed to evenly distribute all resources, even when scaled to hundreds of compute cores. Distributed fuzzing of Volatility using the developed fuzz framework led to the discovery of many issues in Volatility's analysis engine, including it being vulnerable to resource exhaustion attacks, silent crashes, and unhandled exceptions.

Cloud Computing has become in just few years a key consideration for businesses and governments willing to externalize their infrastructure, increase flexibility and reduce the cost of their infrastructure (CAPEX), maintenance and operation (OPEX). Although several commercial solutions are available, there are still numerous issues to solve. Two important aspects to address are the lock-in risk with one Cloud Provider (CP) and the fulfillment of the contractual SLA (Service Level Agreement). In this paper, we propose an integrated approach based on the concept of Broker that takes benefit from different CPs to efficiently embed a complex service into the various available cloud infrastructures. The Broker approach allows Cloud Customer (CC) to be independent from any particular CP while taking benefit from the overall available resources and avoid the lock-in with a particular one. In addition, we leverage the service model to provide Customers with the possibility to request different types of services (e.g. compound service) and propose a solution to fulfill requested Customer SLA in terms of availability, cost and geographic location according to the contracted SLA between the Broker and the CPs. We have implemented the solution in a lab cloud infrastructure and performed several tests and simulations to highlight the benefit of our approach.

Co-resident attacks on public clouds could extract sensitive information like encryption keys, memory content or workload patterns from cloud-based applications. Most existing defense mechanisms have been targeting cloud providers. They usually require substantial changes to the underlying hardware, cloud infrastructure or VM placement strategies, therefore making their deployment difficult. In this work, we investigate secure VM provisioning from the user perspective. Our approach leverages existing secure resource allocation methods provided by public cloud providers such as EC2 Dedicated Instances. We consider several different VM provisioning algorithms which are secure, cost-effective and at the same time immediately deployable for cloud users without any changes required from cloud providers' part. Extensive experiments using real workload traces and EC2 resource pricing confirm the effectiveness of our approach. To the best of our knowledge, this work is the first to consider secure and cost-effective VM provisioning from the user perspective.

The deployment of cloud infrastructure in libraries enhances scalability and availability of resources, but different hazards have evolved, and so has the need for sound security measures for shielding critical information from some risks such as quantum computing’s risks. This paper proposes the Quantum-Resistant Federated Authentication (AQFA) framework which uses the federated learning with quantum-resistant cryptographic technologies for the improvement of authentication in library cloud systems. AQFA employs a multilayer security model which ensures two things; user credential protection against quantum attacks, privacy, and accessibility. It also uses trust models to adapt its incident response to real-time user behavior; thereby making it easier to manage risks of unauthorized access. In addition, AQFA also adapts homomorphic encryption to help encrypt data for processing with the ability of library that enables libraries to perform operations on encrypted data. This thinking solution not only improves the general security of library cloud infrastructures but also enables reasonable scale and user adjustment in a more and more digital environment. The findings further affirm the ability of AQFA in mitigating risks to historical library assets and preventing information leakage in cloud configuration

The technological landscape is rapidly evolving, and organizations are increasingly recognizing the benefits of multi - cloud environments, which allow them to leverage different cloud platforms to meet specific requirements. This shift from a reliance on a single cloud provider underscores the need to embrace the adaptability and flexibility relevant to simultaneous multi - cloud utilization. Within the complexities of multi - cloud environments, effective cost management is key. This necessitates a strategic way to approach costs aligned with the unique needs of every organization. By deploying tools, implementing processes, and continuously monitoring tools, businesses can achieve cost savings while capitalizing on the advantages offered by different cloud providers. Additionally, as multi - cloud adoption becomes common in IT enterprises, the challenges related to managing multi - cloud infrastructure can discourage IT operations. This paper advocates for extending the DevOps approach to multi - cloud environments by emphasizing its potential to support and simplify application development, delivery, and maintenance. While adopting DevOps into a multi - cloud strategy may need compromises, they speed up democratizing development and maintenance work, thus fostering an organization?s competitive advantage. DevOps is an emerging field in IT infrastructure management and cloud automation; it is explored in continuous improvement and optimization. Organizations invest resources in enhancing efficiency, reducing redundancy, and optimizing costs in developing and deploying enterprise applications. Managing multiple environments can be challenging, necessitating continuous monitoring and optimization of operational tasks and improved collaboration across different organizational teams. The migration to the cloud and the prevalence of multiple cloud environments further complicate the management of DevOps in a multi - cloud setting, thus needing mechanisms to address key risks and challenges. It is vital for rapid software development to meet organizational objectives in the competitive landscape, which is highlighted by positioning DevOps as an essential technique. This approach allows enterprises to deliver high - quality software capabilities through automation by enhancing team communication and increasing efficiency across the software product lifestyle. The research problem depicts the shift in organizational workloads towards automation, mainly regarding cloud - based applications to keep up with the demand for new technologies and products. In this trend of multi - cloud deployments, it is important to ensure the security of workloads across diverse cloud platforms to allow organizational focus. While security controls may be uniform, differences in deployment approaches, architecture, tools, and processes bring challenges. The dynamic nature of the cloud further complicates security visibility addressed by Cloud Security Posture Management (CPSM) solutions. These solutions are key in providing visibility as organizations? cloud footprints expand. This comprehensive analysis delves into the complexities of multi - cloud deployments in DevOps, providing insights into the challenges and strategies employed to navigate this landscape.

High availability is the most important and challenging problem for cloud providers. However, virtual machine monitor (VMM), a crucial component of the cloud infrastructure, has to be frequently updated and restarted to add security patches and new features, undermining high availability. There are two existing live update methods to improve the cloud availability: kernel live patching and Virtual Machine (VM) live migration. However, they both have serious drawbacks that impair their usefulness in the large cloud infrastructure: kernel live patching cannot handle complex changes (e.g., changes to persistent data structures); and VM live migration may incur unacceptably long delays when migrating millions of VMs in the whole cloud, for example, to deploy urgent security patches. In this paper, we propose a new method, VMM live upgrade, that can promptly upgrade the whole VMM (KVM & QEMU) without interrupting customer VMs. Timely upgrade of the VMM is essential to the cloud because it is both the main attack surface of malicious VMs and the component to integrate new features. We have built a VMM live upgrade system called Orthus. Orthus features three key techniques: dual KVM, VM grafting, and device handover. Together, they enable the cloud provider to load an upgraded KVM instance while the original one is running and cut-and-paste'' the VM to this new instance. In addition, Orthus can seamlessly hand over passthrough devices to the new KVM instance without losing any ongoing (DMA) operations. Our evaluation shows that Orthus can reduce the total migration time and downtime by more than $99%$ and $90%$, respectively. We have deployed Orthus in one of the largest cloud infrastructures for a long time. It has become the most effective and indispensable tool in our daily maintenance of hundreds of thousands of servers and millions of VMs.

Cloud computing is becoming increasingly important for provision of services and storage of data in the Internet. However there are several significant challenges in securing cloud infrastructures from different types of attacks. The focus of this paper is on the security services that a cloud provider can offer as part of its infrastructure to its customers (tenants) to counteract these attacks. Our main contribution is a security architecture that provides a flexible security as a service model that a cloud provider can offer to its tenants and customers of its tenants. Our security as a service model while offering a baseline security to the provider to protect its own cloud infrastructure also provides flexibility to tenants to have additional security functionalities that suit their security requirements. The paper describes the design of the security architecture and discusses how different types of attacks are counteracted by the proposed architecture. We have implemented the security architecture and the paper discusses analysis and performance evaluation results.

Coverage‐based fuzz testing and dynamic symbolic execution are both popular program testing techniques. However, on their own, both techniques suffer from scalability problems when considering the complexity of modern software. Hybrid testing methods attempt to mitigate these problems by leveraging dynamic symbolic execution to assist fuzz testing. Unfortunately, the efficiency of such methods is still limited by specific program structures and the schedule of seed files. In this study, the authors introduce a novel lazy symbolic pointer concretisation method and a symbolic loop bucket optimisation to mitigate path explosion caused by dynamic symbolic execution in hybrid testing. They also propose a distance‐based seed selection method to rearrange the seed queue of the fuzzer engine in order to achieve higher coverage. They implemented a prototype and evaluate its ability to find vulnerabilities in software and cover new execution paths. They show on different benchmarks that it can find more crashes than other off‐the‐shelf vulnerability detection tools. They also show that the proposed method can discover 43% more unique paths than vanilla fuzz testing.

With an increasing number of providers claiming to offer Cloud infrastructures, there is a lack in the community for a common terminology, accompanied by a clear definition and classification of Cloud features. We conduct in this paper a survey on a selection of Cloud providers, and propose a taxonomy of eight important Cloud computing elements covering service type, resource deployment, hardware, runtime tuning, business model, middleware, and performance. We conclude that the provisioning of Service Level Agreements as utilities, of open and interoperable middleware solutions, as well as of sustained performance metrics for high-performance computing applications are three elements with the highest need of further community research.

Cloud Computing has been widely used by Customers to outsource IT services and business applications managed by a third-party called Cloud Provider in order to reduce their equipment management costs. The academic sector have also taken notice and are investigating how Cloud technology can provide results more quickly and at lower cost in order to deploy Grid services which benefit already from distributed environment like Grid Computing. Indeed, Grid Computing environment supports the large-scale distribution of all resources but faces problem of resource’s increasing demands and resource’s management caused by the growing of scientific computing applications. In this case, taking full advantage of Cloud technologies like enabling the use of Cloud-provided resources and exploiting infrastructure Cloud management system can simplify Grid service’s resource deployment and allocation. However, it is necessary to have an adaptable monitoring solution to operate, analyze and adjust Cloud’s resources to the specifications and requirements of Grid services including ”Middleware” which allows them to run. For this purpose, the work presented in this paper consists on the proposal of an integration ”Grid-Cloud” model to deploy Grid services on Cloud IaaS-resource provided. And secondly, complete this model by developing a Framework based on new monitoring approach with ”Complex Event Processing (CEP)”.

With the continuous development of blockchain technology, thousands of smart contracts have been deployed on the blockchain, and the number of smart contract vulnerabilities has increased significantly. In the task of smart contract vulnerability detection, fuzz testing methods are usually used for detection. Existing AFL-based methods are inefficient in generating test cases that meet complex path constraints. This study addresses the limitations of traditional fuzz testing techniques in detecting vulnerabilities related to strictly constrained conditional branches in Ethereum smart contracts. To overcome this challenge, we propose a hybrid framework that combines static semantic analysis with adaptive dynamic fuzz testing and combines a lightweight heuristic seed selection mechanism to prioritize path-sensitive mutations. Our method adopts semantic-aware operators to guide targeted exploration of protected execution paths while dynamically optimizing energy allocation among test cases. Experimental evaluation on benchmark contracts shows that compared with baseline methods, the proposed framework achieves significantly improved branch coverage and accelerated vulnerability detection, especially for critical security vulnerabilities such as reentrancy and arithmetic exceptions, without sacrificing detection accuracy. The results verify the effectiveness of our method in balancing exploration efficiency and analysis rigor for blockchain-oriented security verification.

Cloud computing has transformed the IT field by offering adaptable and versatile resources to cater to the increasing demands of businesses and organizations. Virtualization technologies are instrumental in facilitating the efficient deployment and management of resources within cloud environments. However, there are notable concerns regarding the security implications of virtualization in the cloud. This research paper thoroughly examines the security aspects of virtualization technologies in cloud computing, primarily focusing on identifying potential weaknesses, risks, and strategies to mitigate security threats. Additionally, the study investigates the security features and mechanisms provided by leading virtualization platforms and management tools. It scrutinizes access controls, isolation methods, network security, data protection, and integrity mechanisms offered by virtualization technologies to safeguard the cloud infrastructure and customer data. Furthermore, the paper addresses emerging security concerns associated with containerization technologies, encompassing vulnerabilities related to container escape, risks stemming from shared kernels, and issues concerning image integrity. It explores the effectiveness of container security measures, such asisolation, sandboxing, and access controls, in reducing these risks. Lastly, the paper summarizes the main findings and provides recommendations to enhance the security of virtualization technologies in cloud computing. It emphasizes the importance of continuous monitoring, regular security updates, robust access controls, and threat intelligence integration to mitigate security risks and uphold a secure cloud infrastructure.

The availability and advancements of cloud computing service models such as IaaS, SaaS, and PaaS; introducing on-demand self-service, auto scaling, easy maintenance, and pay as you go, has dramatically transformed the way organizations design and operate their datacenters. However, some organizations still have many concerns like: security, governance, lack of expertise, and migration. The purpose of this paper is to discuss the cloud computing customers’ opinions, feedbacks, attitudes, and emotions towards cloud computing services using sentiment analysis. The associated aim, is to help people and organizations to understand the benefits and challenges of cloud services from the general public’s perspective view as well as opinions about existing cloud providers, focusing on three main cloud providers: Azure, Amazon Web Services (AWS) and Google Cloud. The methodology used in this paper is based on sentiment analysis applied to the tweets that were extracted from social media platform (Twitter) via its search API. We have extracted a sample of 11,000 tweets and each cloud provider has almost similar proportion of the tweets based on relevant hashtags and keywords. Analysis starts by combining the tweets in order to find the overall polarity about cloud computing, then breaking the tweets to find the specific polarity for each cloud provider. Bing and NRC Lexicons are employed to measure the polarity and emotion of the terms in the tweets. The overall polarity classification of the tweets across all cloud providers shows 68.5% positive and 31.5% negative percentages. More specifically, Azure shows 63.8% positive and 36.2% negative tweets, Google Cloud shows 72.6% positive and 27.4% negative tweets and AWS shows 69.1% positive and 30.9% negative tweets.

With the advent of cloud computing, different cloud providers with heterogeneous cloud services (compute, storage, network, applications, etc.) and their related Application Programming Interfaces (APIs) have emerged. This heterogeneity complicates the implementation of an interoperable cloud system. Several standards have been proposed to address this challenge and provide a unified interface to cloud resources. The Open Cloud Computing Interface (OCCI) thereby focuses on the standardization of a common API for Infrastructure-as-a-Service (IaaS) providers, while the Topology and Orchestration Specification for Cloud Applications (TOSCA) focuses on the standardization of a template language to enable the proper definition of the topology of cloud applications and their orchestrations on top of a cloud system. TOSCA thereby does not define how the application topologies are created on the cloud. Therefore, we analyze the conceptual similarities between the two approaches and we study how we can integrate them to obtain a complete standard-based approach to manage both Cloud Infrastructure and Cloud application layers. We propose an automated extensive mapping between the concepts of the two standards, and we provide TOSCA Studio, a model-driven tool chain for TOSCA that conforms to OCCI. TOSCA Studio allows to graphically design cloud applications as well as to deploy and manage them at runtime using a fully model-driven cloud orchestrator based on the two standards. Our contribution is validated by successfully transforming and deploying three cloud applications: WordPress, Node Cellar and Multi-Tier.

One of the main reasons why cloud computing has gained so much popularity is due to its ease of use and its ability to scale computing resources on demand. As a result, users can now rent computing nodes on large commercial clusters through several vendors, such as Amazon and rackspace. However, despite the attention paid by Cloud providers, performance unpredictability is a major issue in Cloud computing for (1) database researchers performing wall clock experiments, and (2) database applications providing service-level agreements. In this paper, we carry out a study of the performance variance of the most widely used Cloud infrastructure (Amazon EC2) from different perspectives. We use established microbenchmarks to measure performance variance in CPU, I/O, and network. And, we use a multi-node MapReduce application to quantify the impact on real dataintensive applications. We collected data for an entire month and compare it with the results obtained on a local cluster. Our results show that EC2 performance varies a lot and often falls into two bands having a large performance gap in-between --- which is somewhat surprising. We observe in our experiments that these two bands correspond to the different virtual system types provided by Amazon. Moreover, we analyze results considering different availability zones, points in time, and locations. This analysis indicates that, among others, the choice of availability zone also influences the performance variability. A major conclusion of our work is that the variance on EC2 is currently so high that wall clock experiments may only be performed with considerable care. To this end, we provide some hints to users.