Rogue Virtual Machine Identification in DaISy Clouds

我们在本提案中的工作主要集中在EPSRC DaISy呼叫的安全可靠云计算挑战上。此外，它还密切关注与提取有意义的信息挑战相关的问题，特别是从云计算环境中收集的大规模监测信息中提取意义，以及通过开发元数据和使用户能够监控其数字资产如何在共享环境中使用的方法来确保对协作工作挑战的信心。该提案建立在研究人员在构建安全云计算系统（特别是ic云系统），开发大规模数据分析系统以及开发程序行为安全分析算法和方法方面的专业知识的基础上，以开发和评估新方法，以检测已经获得访问安全云系统内虚拟机的对手的微妙攻击。我们对这个为期一年的项目的一般方法是基于1)在现有的IC-Cloud平台上构建作为我们研究的测试平台。使用基于流行的XEN Hypervisor的内部基础设施使我们能够快速开发和评估监控工具，开发和测试不同的攻击场景，并从实际应用程序收集日志数据。2)基于我们多年来为分类、聚类和关联分析开发的内部数据挖掘和分析工具，以及我们最近在实时数据挖掘方法和贝叶斯分析框架方面开发的专业知识，用于环境和安全应用的大规模传感器数据的建模和分析异常。3)与研究所和安全科学技术的合作伙伴和合作者密切合作，在我们开发方法论、结果和方法的过程中不断获得反馈。

Our work in this proposal focuses primarily on the safe and secure cloud computing challenge of the EPSRC DaISy call. In addition, it also addresses closely issues relevant to the extracting meaningful information challenge, specifically extracting meaning from large-scale monitoring information collected in a cloud computing environment, and the ensuring confidence in collaborative working challenge by developing meta-data and methods that enable users to monitor how their digital assets are being used in shared environments. The proposal builds on the investigators' expertise in building secure cloud computing systems (especially the IC-Cloud system), developing large-scale data analysis systems and developing algorithms and methods for the security analysis of program behaviour to develop develop and evaluate novel methods to detect subtle attacks by adversaries who have already gained access to a VM within a secure cloud system.Our general methodology for this 1-year project is based on 1) Building on the existing IC-Cloud platform as a test-bed our research. The use of the in-house infrastructure based on the popular XEN Hypervisor enables us to rapidly develop and evaluate monitoring tools, to develop and test different attack scenarios and collect the log data from the real applications. 2) Building on our in-house repertoire of data mining and analysis tools developed over the years for classification, clustering and association analysis and on our recent expertise developed in real-time data mining methods and Bayesian analysis frameworks for modeling and analysis anomalies in large scale sensor data for environmental and security applications. 3) Close collaboration with partners and collaborators of the Institute and Security Science and Technology to receive ongoing feedback on our methodology, results and methods as we develop them.