Virtual machine anomaly detection strategy based on cloud platform operating environment perception

The failure prediction method of virtual machines (VM) guarantees reliability to cloud platforms. However, the uncertainty of VM security state will affect the reliability and task processing capabilities of the entire cloud platform. In this Study, a failure prediction method of VM based on AdaBoost-Hidden Markov Model was proposed to improve the reliability of VMs and overall performance of cloud platforms. This method analyzed the deep relationship between the observation state and the hidden state of the VM through the hidden Markov model, proved the influence of the AdaBoost algorithm on the hidden Markov model (HMM), and realized the prediction of the VM failure state. Results show that the proposed method adapts to the complex dynamic cloud platform environment, can effectively predict the failure state of VMs, and improve the predictive ability of VM security state.

Virtual machine (VM) technologies, especially those offered via Cloud platforms, present new dimensions with respect to performance and cost in executing parallel discrete event simulation (PDES) applications. Due to the introduction of overall cost as a metric, the choice of the highest-end computing configuration is no longer the most economical one. Moreover, runtime dynamics unique to VM platforms introduce new performance characteristics, and the variety of possible VM configurations give rise to a range of choices for hosting a PDES run. Here, an empirical study of these issues is undertaken to guide an understanding of the dynamics, trends and trade-offs in executing PDES on VM/Cloud platforms. Performance results and cost measures are obtained from actual execution of a range of scenarios in two PDES benchmark applications on the Amazon Cloud offerings and on a high-end VM host machine. The data reveals interesting insights into the new VM-PDES dynamics that come into play and also leads to counter-intuitive guidelines with respect to choosing the best and second-best configurations when overall cost of execution is considered. In particular, it is found that choosing the highest-end VM configuration guarantees neither the best runtime nor the least cost. Interestingly, choosing a (suitably scaled) low-end VM configuration provides the least overall cost without adversely affecting the total runtime.

As a typical Internet-of-Things (IoT) scenario, massive machine-type communications (mMTC) services are expected to grow exponentially and create a multibillion-dollar industry spanning a broad range of vertical sectors. In literature, wireless software-defined network (SDN) is viewed as a promising approach to facilitate the degree of reconfigurability on extended sets of mMTC devices via centralized software updates. However, most of the current anomaly detection scheme (ADS) in SDN suffers from the high risk of overwhelming of the controller as well as excessive energy consumption if directly applied in the network with enormous devices. To address the scalability issues in centralized ADS, we propose a localized ADS scheme, called scalable and energy-efficient anomaly detection scheme (SEE-ADS), comprising of a detection activation module, a lightweight predetection module, a heavyweight anomaly detection module, and a dynamic strategy selection module. Through the cooperation among these modules, the proposed ADS is capable of detecting attacks dynamically and effectively without the risk of energy depletion via discontinuous activation of the heavyweight detection. The lower complexity is fulfilled by developing a localized and adaptive heavyweight detection module, called a localized evolving semisupervised learning-based anomaly detection scheme (LESLA). Besides, the proposed scheme makes full use of feedback from the previous heavyweight activation and the indication of predetection on each packet. The simulation results show that the proposed scheme greatly reduces the overall energy consumption over heavyweight detection. Furthermore, the proposed scheme shows higher sensitivity on abnormal packets and similar false alarm compared with the literature work.

Open-source cloud platforms provide a feasible alternative of deploying cloud computing in low-cost commodity hardware and operating systems. To enhance the reliability of an open-source cloud, we propose CloudVS, an add-on system that enables version control for virtual machines (VMs). CloudVS targets a commodity cloud platform that has limited available resources. It exploits content similarities across different VM versions using redundancy elimination (RE), such that only non-redundant data chunks of a VM version are transmitted over the network and kept in persistent storage. Using RE as a building block, we propose a suite of performance adaptation mechanisms that make CloudVS amenable to different commodity settings. Specifically, we propose a tunable mechanism to balance the storage and disk seek overheads, as well as various I/O optimization techniques to minimize the interferences to other coresident processes. Using a 3-month span of real VM snapshots, we experiment CloudVS in an open-source cloud testbed built on Eucalyptus. We demonstrate how CloudVS leverages RE to save the storage cost and the VM operation time than simply keeping full VM images. More importantly, we show how CloudVS can be parameterized to balance the performance trade-offs between version control and normal VM operations.

WBATimeNet: A deep neural network approach for VM Live Migration in the cloud

Virtual machine cluster mobility in inter-cloud platforms

Swarm learning anomaly detection framework for cloud data center using multi-channel BiWGAN-GTN and CEEMDAN

Cloud computing platforms are becoming viable alternative for running high performance parallel applications. However, when running these applications in cloud platforms, VMs (virtual machines) are easily affected by the synchronization latency problem which leads to serious performance degradation. There are two main reasons. The first is that a host is unaware of the synchronization requirements of the guest OS. The second is that the synchronization requests of VMs on a physical host are unknown to VMs on the other physical host. It is a great challenge to mitigate the negative influence of virtualization on synchronization and accelerate the synchronization response of HPC applications. In this paper, we propose a \(two-phase\) synchronization-aware (TPS) scheduling algorithm to solve the problem above. The TPS algorithm takes both intra-VMs’ and inter-VMs’ synchronization demands into consideration. Spin-locks and network packets are used as the metrics to detect the synchronization demands of VMs and VMs are scheduled based on spinlock-aware and communication-aware strategies. The algorithm is implemented on the base of KVM and experiments are conducted in a cluster environment. The experimental results show that our TPS algorithm obtains a better performance for HPC applications and reduces negative impacts on non-HPC applications simultaneously. Therefore, our approach is an effective solution to the HPC synchronization issues in cloud platforms.

Self-Organizing Map (SOM) algorithm as an unsupervised learning method has been applied in anomaly detection due to its capabilities of self-organizing and automatic anomaly prediction. However, because of the algorithm is initialized in random, it takes a long time to train a detection model. Besides, the Cloud platforms with large scale virtual machines are prone to performance anomalies due to their high dynamic and resource sharing characters, which makes the algorithm present a low accuracy and a low scalability. To address these problems, an Improved Incremental Self-Organizing Map (IISOM) model is proposed for anomaly detection of virtual machines. In this model, a heuristic-based initialization algorithm and a Weighted Euclidean Distance (WED) algorithm are introduced into SOM to speed up the training process and improve model quality. Meanwhile, a neighborhood-based searching algorithm is presented to accelerate the detection time by taking into account the large scale and high dynamic features of virtual machines on cloud platform. To demonstrate the effectiveness, experiments on a common benchmark KDD Cup dataset and a real dataset have been performed. Results suggest that IISOM has advantages in accuracy and convergence velocity of anomaly detection for virtual machines on cloud platform.

Load balancing represents a key issue in any job scheduling application to guarantee optimal utilization of underlying resources, enhance performance, and reduce the execution cost. The core of this paper is the fitness value calculation (FVC) to provide application software, a reliable solution in the early stages of load balancing. This study is focused on the cloud computing environment. It includes both physical components (in particular cloud infrastructure and cloud storage) and logical components (in particular cloud services and cloud platforms). Such complex structure is interconnected to deliver services to users and achieve improved performance of the whole system. This case study is one of the most important segments of cloud computing, i.e., load balancing. The aim of this paper is to introduce a new approach to balance the load among virtual machines of the cloud computing environment. The proposed method led to the proposal and implementation of an algorithm inspired by Bat Algorithm. This proposed Modified Bat Algorithm (MBA) allows balancing the load among virtual machines. The proposed algorithm works in two variants: Modified Bat Algorithm with ‘Overloaded Optimal Virtual Machine’ (MBA-OOVM) and Modified Bat Algorithm with ‘Balanced Virtual Machine’ (MBA-BVM). MBA generates solutions which are cost-effective and the strengths of MBA are finally validated by comparing it with Bat Algorithm.

With the evolution of smart grids, accurate and secure predictions of the electricity load become crucial for efficient energy management and reliability. In this paper, a scalable and cyber-resilient methodology for electricity consumption forecasting on individual smart meter level based on machine learning and anomaly detection schemes is proposed. The proposed technique utilizes K-MEANS Clustering and Neural Networks (KMEANS–NN) to enhance Individual Load Forecasting (ILF) with reduced computational complexity and high prediction accuracy. A Principal Component Analysis based One-Class Support Vector Machine (PCA–OCSVM) model is employed as an Anomaly Detection Scheme (ADS) to identify the false data injection attacks in smart meter telemetry. The system uses five months of real-world data from :text{2,089} smart meters gathered under the supervision of Electrical Distribution Sector (EDS) of Suez Canal Authority (SCA) in Egypt. KMEANS–NN strategy reduces significantly MAAPE by up to :25.6% and cuts computational time from days to minutes. It improves forecasting accuracy across four proposed models: ARIMA, CTREE, MLP and NNETAR. To assess the cyber-security profile, :50% of the dataset is orchestrated with scaling, ramping and random cyber-attack simulation. Proposed ADS achieves :99.3% overall accuracy, :100% sensitivity, :98.62% precision, :98.6% specificity and F1-score of::0.9896, whereas it’s :100% accurate on clean data. This integrated model offers accurate, efficient, and secure load forecasting presenting good potential for its deployment in large-scale smart grid environments.

A balanced virtual machine scheduling method for energy-performance trade-offs in cyber-physical cloud systems

Virtual machine (VM) consolidation is an effective way to improve resource utilization and reduce energy consumption in cloud data centers. Most existing studies have considered VM consolidation as a bin-packing problem, but the current schemes commonly ignore the long-term relationship between VMs and hosts. In addition, there is a lack of long-term consideration for resource optimization in the VM consolidation, which results in unnecessary VM migration and increased energy consumption. To address these limitations, a VM consolidation method based on multi-step prediction and affinity-aware technique for energy-efficient cloud data centers (MPaAFVMC) is proposed. The proposed method uses an improved linear regression prediction algorithm to predict the next-moment resource utilization of hosts and VMs, and obtains the stage demand of resources in the future period through multi-step prediction, which is realized by iterative prediction. Then, based on the multi-step prediction, an affinity model between the VM and host is designed using the first-order correlation coefficient and Euclidean distance. During the VM consolidation, the affinity value is used to select the migration VM and placement host. The proposed method is compared with the existing consolidation algorithms on the PlanetLab and Google cluster real workload data using the CloudSim simulation platform. Experimental results show that the proposed method can achieve significant improvement in reducing energy consumption, VM migration costs, and service level agreement (SLA) violations.

ABSTRACT: An agent-less technique to understand virtual machines (VMs) behavior and their changes during the VM life-cycle is essential for many performance analysis and debugging tasks in the cloud environment. Because of privacy and security issues, ease of deployment and execution overhead, the method preferably limits its data collection to the physical host level, without internal access to the VMs. We propose a host-based, precise method to recover execution flow of virtualized environments, regardless of the level of virtualization. Given a VM, the Any-Level VM Detection Algorithm (ADA) and Nested VM State Detection (NSD) Algorithm compute its execution path along with the state of virtual CPUs (vCPUs) from the host kernel trace. The state of vCPUs is displayed in an interactive trace viewer (TraceCompass) for further inspection. Then, a new approach for profiling threads and processes inside the VMs is proposed. Our proposed VM trace analysis algorithms have been open-sourced for further enhancements and to the benefit of other developers. Our new techniques are being evaluated with workloads generated by different benchmarking tools. These approaches are based on host hypervisor tracing, which brings a lower overhead (around 1%) as compared to other approaches.

Digital Investigation on the cloud platform is a challenging task. In the Virtual Scenario, Virtual Machines contain evidences. If once VMDK (Virtual Machine Disk file) is destroyed (deleted), it is impossible to recover your VM. At present there does not exist any mechanism that can recover a destroyed VM again which is the flaw in VM itself. All the activities on the VM is logged in VM, whereas activities of CSP (Cloud Service Provider) is logged on the server. So even if someone deleted the VM, all the evidences will be lost. This creates a disaster for the user and acts as a barrier for a forensic investigator to dig out the sensitive data of user that was stored in the Virtual Machine sometime.