An agent based business aware incident detection system for cloud environments

Doelitzscher Frank, Reich Christoph, Knahl Martin, Passfall Alexander, Clarke, Clarke Nathan

Description

Classic intrusion detection mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. This makes them unable to address new cloud specific security issues. In this paper we introduce the cloud incident detection system Security Audit as a Service (SAaaS). It is built upon intelligent autonomous agents, which are aware of underlying business driven intercommunication of cloud services. This enables the presented SAaaS architecture to be flexible and to supported cross customer event monitoring within a cloud infrastructure. A contribution of this paper it to provide a high-level design of the SAaaS architecture, an introduction into the proposed Security Business Flow Language (SBFL), a first prototype of an autonomous agent and an evaluation about, which cloud specific security problems are addressed by the presented architecture. It is shown that autonomous agents and behaviour analysis are fertile approaches to detect cloud specific security problems and can create a cloud audit system.

Sujets

• Agent (informatique)

Informations

• Publié par: biomed
• Publié le: 01 janvier 2012
• Nombre de lectures: 7
• Langue: English
• Poids de l'ouvrage: 2 Mo

Extrait

Doelitzscher et al. Journal of Cloud Computing: Advances, Systems and Applications 2012, 1 :9 http://www.journalofcloudcomputing.com/content/1/1/9

R E S E A R C H Open Access An agent based business aware incident detection system for cloud environments Frank Doelitzscher 1* , Christoph Reich 1 , Martin Knahl 1 , Alexander Passfall 1 and Nathan Clarke 2

Abstract Classic intrusion detection mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. This makes them unable to address new cloud specific security issues. In this paper we introduce the cloud incident detection system Security Audit as a Service (SAaaS). It is built upon intelligent autonomous agents, which are aware of underlying business driven intercommunication of cloud services. This enables the presented SAaaS architecture to be flexible and to supported cross customer event monitoring within a cloud infrastructure. A contribution of this paper it to provide a high-level design of the SAaaS architecture, an introduction into the proposed Security Business Flow Language (SBFL), a first prototype of an autonomous agent and an evaluation about, which cloud specific security problems are addressed by the presented architecture. It is shown that autonomous agents and behaviour analysis are fertile approaches to detect cloud specific security problems and can create a cloud audit system. Keywords: Cloud security, Cloud audit, Agents

Introduction quality of service level agreements of 99.95% availability: Enterprise analysts and research have identified cloud (=ˆ 1,825 outage days/year), Amazon’s support handling specific security problems as the major research area had a strong impact on trust in current cloud provider: in cloud computing [1-4]. Since security is still a com- (1) Amazon data nters are divided into several petitive challenge for classic IT environments it is even avilabilityzon ce estodistributeimpactof(hardware) more for cloud environments due to its characteristics, a like seamless scalability, shared resources, multi-tenancy, failures. For resilience reasons users distribute their access from everywhere, on-demand availability and 3rd data over different availability zones. As a result of party hosting [5]. Pushed by cloud commercials promising the outage EC2 customers permanently lost data, “infinite scalability and resources” combined with on- a a l v t a h il o a u b g il h it s y e z rv o i n c e e s s . w A e c r o e m ho p s a t n e y d o o ff n er d i i n ff g er w e e nt bs E er C v 2 ice demand access from everywhere, cloud user quickly forget that there is still a real IT infrastructure behind a cloud, () u D sage g m t o h n e it c o ra ri s n h g a l n os E t C 11 2c h u o s u t r o s m of er hi r s u t n or n i i c n a g l a data[7]. where the architecture complexity is actually increased 2 m u o r n i i n toringserviceofcardiacpatientstriedtoreach compared to traditional data centers. This also intro- duces security and availability issues as recent incidents i A nf mazon t ’ i s o s n u a p b p o o u r t t t u h n e s e u x cc p e e s c s t f e u d lly d . o N w e n i t t i h m er enor at the major public cloud provider Amazon Web Services mo o v r in m g a theunreachableinstatadifferentEC2 (AWS) show. After an infrastructure outage in April 2011, data center was offered.  nces o Amazon’s Compute Cloud EC2 was not available, caus- (3) Since hardware sovereignty is given away in cloud ing popular services like Reddit to be unable to serve computing security, health and monitoring its customers [6]. While such an outage violates EC2’s information is critical to cloud users to build there services in an appropriate way regardless which 1 *C F o u r r r t e w spondence: v f e r r a s n it k y . , D C o l e o l u it d zs R c e h s e e r a @ rc h h s- L fu a r b t , w R a o n b g e e rt n - . G d e e rwig-Platz1,78120 c T l h o i u s d is m al o r d e e a l d ( y p k u n bl o ic w , n h f y r b o ri m d, tr p a ri d v it a i t o e n c a l l o I u T d)isused. angen Uni Furtwangen, Germany Full list of author information is available at the end of the article outsourcing and providers try to establish trust to

© 2012 Doelitzscher et al.; licensee Springer. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/2.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.