Development of Cloud Monitoring System Handling IaaS Level Attacks

Abstract

In the past recent years, the cloud computing has been introduced as a very effective environment for parallel computation using virtualization, data storage etc. Since the users provide their confidential data to the cloud service providers, it has become a big challenge for cloud service providers to provide security to the user’s data against data breaches, denial of service, data loss, abuse of cloud services, root privilege escalation from guest os etc. Virtualization is the key component that endows the cloud technology. Hypervisor is the component that provides the virtualization which allows the virtual machines to have the access of physical hardware like memory and processors. If an attacker somehow manages to compromise the hypervisor, he can get the access of host operating system as well as other virtual instances running on that hypervisor. Another Network Layer based attack like spoofing and/or poison attacks on the Virtual machines of cloud system can cause the downturn of the cloud system. In this thesis, we have developed a cloud monitoring system which primarily focuses on the hypervisor based attacks as well as the Spoofing and Poison attacks. Many attacks have been identified on very popular and easily available open-source hypervisor, Kernel Based Virtual Machine (KVM) and XEN. Vulnerabilities reside at the code-based implementation of these hyperviors. It is possible for someone possessing very basic knowledge of computer networks to perform spoofing or poisoning attacks. Many researchers have proposed their solutions to these kinds of attacks, but they are not scalable to apply to the large scale networks and can detect a very limited cases of the attack. This thesis aims to provide a reliable solution to these problems by maintaining a ip-mac-unique id pair for each system in the cloud and by providing SR-IOV support to the cloud infrastructure. Once the attacker system is detected, we try to prevent the access of cloud from the attacker system.