Rogue Virtual Machine Identification in DaISy Clouds

我们在这份提案中的工作主要集中在EPSRC雏菊电话会议的安全云计算挑战上。此外，它还解决了与提取有意义的信息挑战密切相关的问题，特别是从云计算环境中收集的大规模监测信息中提取意义，以及通过开发元数据和方法，使用户能够监测其数字资产在共享环境中的使用情况，确保对协作工作的信心。该建议基于研究人员在构建安全云计算系统(特别是IC-Cloud系统)、开发大规模数据分析系统和开发用于程序行为安全分析的算法和方法方面的专业知识，以开发、开发和评估新方法来检测已经访问安全云系统中的VM的对手的微妙攻击。我们为期1年的项目的一般方法基于1)建立在现有IC-Cloud平台上作为我们研究的试验床。基于流行的Xen Hypervisor的内部基础设施的使用使我们能够快速开发和评估监控工具，开发和测试不同的攻击场景，并从实际应用程序收集日志数据。2)基于我们多年来开发的用于分类、聚类和关联分析的内部数据挖掘和分析工具，以及我们在实时数据挖掘方法和贝叶斯分析框架方面开发的最新专业知识，用于建模和分析用于环境和安全应用的大规模传感器数据中的异常。3)与研究所和安全科学与技术研究所的合作伙伴和合作者密切合作，在我们制定方法、结果和方法的过程中不断获得反馈。

Our work in this proposal focuses primarily on the safe and secure cloud computing challenge of the EPSRC DaISy call. In addition, it also addresses closely issues relevant to the extracting meaningful information challenge, specifically extracting meaning from large-scale monitoring information collected in a cloud computing environment, and the ensuring confidence in collaborative working challenge by developing meta-data and methods that enable users to monitor how their digital assets are being used in shared environments. The proposal builds on the investigators' expertise in building secure cloud computing systems (especially the IC-Cloud system), developing large-scale data analysis systems and developing algorithms and methods for the security analysis of program behaviour to develop develop and evaluate novel methods to detect subtle attacks by adversaries who have already gained access to a VM within a secure cloud system.Our general methodology for this 1-year project is based on 1) Building on the existing IC-Cloud platform as a test-bed our research. The use of the in-house infrastructure based on the popular XEN Hypervisor enables us to rapidly develop and evaluate monitoring tools, to develop and test different attack scenarios and collect the log data from the real applications. 2) Building on our in-house repertoire of data mining and analysis tools developed over the years for classification, clustering and association analysis and on our recent expertise developed in real-time data mining methods and Bayesian analysis frameworks for modeling and analysis anomalies in large scale sensor data for environmental and security applications. 3) Close collaboration with partners and collaborators of the Institute and Security Science and Technology to receive ongoing feedback on our methodology, results and methods as we develop them.