Searching for just a few words should be enough to get started. If you need to make more complex queries, use the tips below to guide you.
Article type: Research Article
Authors: Majumdar, Suryadiptaa; * | Tabiban, Azadehb | Jarraya, Yosrc | Oqaily, Momenb | Alimohammadifar, Amirb | Pourzandi, Makanc | Wang, Lingyub | Debbabi, Mouradb
Affiliations: [a] Information Security and Digital Forensics, University at Albany, Albany, NY, USA. E-mail: smajumdar@albany.edu | [b] CIISE, Concordia University, Montreal, QC, Canada. E-mails: a_tabiba@encs.concordia.ca, m_oqaily@encs.concordia.ca, ami_alim@encs.concordia.ca, wang@ciise.concordia.ca, debbabi@ciise.concordia.ca | [c] Ericsson Security Research, Ericsson, Montreal, QC, Canada. E-mails: yosr.jarraya@ericsson.com, makan.pourzandi@ericsson.com
Correspondence: [*] Corresponding author. E-mail: smajumdar@albany.edu. Majority of the work was conducted during Suryadipta’s study at Concordia University.
Abstract: Security compliance auditing is a viable solution to ensure the accountability and transparency of a cloud provider to its tenants. However, the sheer size of a cloud, coupled with the high operational complexity implied by the multi-tenancy and self-service nature, can easily render existing runtime auditing techniques too expensive and non-scalable. To this end, a proactive approach, which prepares for the auditing ahead of critical events, is a promising solution to reduce the response time to a practical level. However, a key limitation of such approaches is their reliance on manual efforts to extract the dependency relationships among events, which greatly restricts their practicality. What makes things worse is the fact that, as the most important input to security auditing, the logs and configuration databases of a real world cloud platform can be unstructured and not ready to be used for efficient security auditing. In this paper, we first propose a log processing technique, which prepares raw cloud logs for different analysis purposes, and then design a learning-based proactive security auditing system, namely, LeaPS+. To this end, we conduct case studies on current log formats in different real-world OpenStack (a popular cloud platform) deployments, and identify major challenges in log processing. Later, we design a stand-alone log processor for clouds, which may potentially be used for various log analyses. Consequently, we leverage the log processor outputs to extract probabilistic dependencies from runtime events for the dependency models. Finally, through these dependency models, we proactively prepare for security critical events and prevent security violations resulting from those critical events. Furthermore, we integrate LeaPS+ to OpenStack and perform extensive experiments in both simulated and real cloud environments that show a practical response time (e.g., 6 ms to audit a cloud of 100,000 VMs) and a significant improvement (e.g., about 50% faster) over existing proactive approaches. In addition, we successfully and efficiently apply our log processor outputs to other learning techniques (e.g., executing sequence pattern mining algorithms within 18 ms for 50,000 events).
Keywords: Proactive auditing, security auditing, cloud security, automatic learning, log formatting, log processing, OpenStack
DOI: 10.3233/JCS-181137
Journal: Journal of Computer Security, vol. 27, no. 2, pp. 165-202, 2019
IOS Press, Inc.
6751 Tepper Drive
Clifton, VA 20124
USA
Tel: +1 703 830 6300
Fax: +1 703 830 2300
sales@iospress.com
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
IOS Press
Nieuwe Hemweg 6B
1013 BG Amsterdam
The Netherlands
Tel: +31 20 688 3355
Fax: +31 20 687 0091
info@iospress.nl
For editorial issues, permissions, book requests, submissions and proceedings, contact the Amsterdam office info@iospress.nl
Inspirees International (China Office)
Ciyunsi Beili 207(CapitaLand), Bld 1, 7-901
100025, Beijing
China
Free service line: 400 661 8717
Fax: +86 10 8446 7947
china@iospress.cn
For editorial issues, like the status of your submitted paper or proposals, write to editorial@iospress.nl
如果您在出版方面需要帮助或有任何建, 件至: editorial@iospress.nl