Controlled access to cloud resources for mitigating Economic Denial of Sustainability (EDoS) attacks

Abstract

Cloud computing is a paradigm that provides scalable IT resources as a service over the Internet. Vulnerabilities in the cloud infrastructure have been readily exploited by the adversary class. Therefore, providing the desired level of assurance to all stakeholders through safeguarding data (sensitive or otherwise) which is stored in the cloud, is of utmost importance. In addition, protecting the cloud from adversarial attacks of diverse types and intents, cannot be understated. Economic Denial of Sustainability (EDoS) attack is considered as one of the concerns that has stalled many organizations from migrating their operations and/or data to the cloud. This is because an EDoS attack targets the financial component of the service provider. In this work, we propose a novel and reactive approach based on a rate limit technique, with low overhead, to detect and mitigate EDoS attacks against cloud-based services. Through this reactive scheme, a limited access permission for cloud services is granted to each user. Experiments were conducted in a laboratory cloud setup, to evaluate the performance of the proposed mitigation technique. Results obtained show that the proposed approach is able to detect and prevent such an attack with low cost and overhead.

Introduction

Cloud computing is a model to provision on-demand network access to a shared pool of computing resources that can accommodate varying end-user demands, with minimal service provider intervention [1]. It allows for utility-based pricing and dynamic resource assignments for services provisioned to end-users. Cloud providers manage submission of requests to the cloud based on leasing agreements of a utility-based pricing model. Service providers request resources from cloud providers, subsequently paying only for actual resource utilization, and in effect providing services to end users [2].

The cloud computing platform has gained immense popularity in recent times by allowing end-users to lease computing resources, and only pay based on individual usage. Auto-scaling is a fundamental characteristic of the cloud facilitating near-instantaneous scaling up or down of the required cloud-based services. This is based on variable user demands, which are derived from pre-agreed Service Level Agreements (SLAs). Implementation of auto-scaling within the cloud translates to rules for auto-allocation of resources such as the number of CPUs, amount of memory, or the number of networking devices. As a result, overwhelming of cloud resources is avoided. For instance, if the CPU usage for a given set of users belonging to a service provider, exceeds 80% for a period of time amounting to a minute, the cloud provider will dynamically allocate additional CPUs to reduce the overhead on the existing CPUs. On the contrary, reducing demand for resources in the cloud is handled through deallocation of computing resources, in real-time, again based on predefined rules at the provider’s end. In general, the most common parameters considered by a cloud provider to facilitate auto-scaling are: performance metric, threshold, and duration. The performance metric parameter is a tuple defining the percentage of resource utilization within the cloud, in terms of the CPU utilization rate, memory usage and networking resource usage, during a given window of time. The threshold parameter defines the aggregate value calculated based on current performance metric values, at which point auto-scaling of resources is triggered. The duration parameter defines the period of time during which the auto-scaling condition is to be active for [3]. Scaling up or down of computing resources does not exceed thresholds of maximum resource allocation to end-users of a given service provider, as stipulated in the SLA. As a simple example, if the upper and lower thresholds on CPU utilization are set to 30% and 80% at time of cloud initialization, and the duration is set to 1 min then, whenever the CPU utilization exceeds 80% persistently for a period of 1 min, additional CPUs will be allocated (i.e., scaling up). On the other hand, CPU resources will be scaled down when the CPU utilization falls below 30% for a period of 1 min.

The cloud computing paradigm in an ideal situation will operate according to the needs and demands of end-users, thus ensuring quality of end-user experience, through accurate auto-scaling of resources. Cloud security is rated as the greatest issue faced by cloud providers [4]. EDoS attack is considered as one of the cloud security concerns, that has remained broadly unaddressed in the literature. In the presence of the adversarial class, routine operations of a cloud provider may be disrupted, through diverse and sophisticated malicious activity, conducted for achieving one of many objectives, such as: disclosure of sensitive cloud data, modification/tampering of data, high volumes of incoming requests for cloud resource allocation, identity theft, etc. Through an EDoS attack, the adversarial entity exploits the auto-scaling feature of the cloud to cause intentional and unwanted scaling up of computing resources at the cloud provider. Resulting cost associated with provisioning of cloud resources is billed to the service provider. After a persistent effort by the adversary over a period of time, the service provider is charged with an exceedingly high amount for unused and unrequested services. Economic viability of the service provider is thus left unsustainable. EDoS attacks may be launched through generation of a large volume of service and/or resource requests that appear to be legitimate. The cloud provider accordingly scales its resources to accommodate all end-user requests, duly abiding by the SLA [5], [6].

A mitigation technique to identify suspicious service requests that targets the service provider’s end, and mitigates the effects of the EDoS attack through controlled resource usage is proposed in this paper. The scheme operates through a regular assessment of incoming requests from end-users, by comparing user activity (i.e., numbers and types of requests for cloud services) at the cloud provider, and by controlling the rate at which cloud service requests can be positively responded to. The proposed techniques operates with low overhead and does accurate classification of incoming requests into legitimate and malicious, based on several criteria.

The rest of the paper is organized as follows: Section 2 provides an extensive analysis of the existing work done to identify and prevent distributed attacks against the cloud. An elaborate explanation of the proposed scheme and its implementation is provided in Section 3. Experimental results and their analysis is presented in Section 4. Finally, we provide conclusions and future directions for work in Section 5.