Entropy‐based denial‐of‐service attack detection in cloud data center

Cloud data centers today usually lack network resource isolation. Meanwhile, it is easy to deploy and terminate large number of malicious virtual machines in a few seconds, while the administrator is probably difficult to identify these malicious virtual machines immediately. These features open doors for attackers to launch denial‐of‐service (DoS) attacks that target at degrading the quality of cloud service. This paper studies an attack scenario that malicious tenants use cloud resources to launch DoS attack targeting at data center subnets. Unlike traditional data flow‐based detections, which heavily depend on the pattern of data flows, we propose an approach that takes advantage of virtual machine status including CPU usage and network usage to identify the attack. We notice that malicious virtual machines exhibit similar status patterns when attack is launched. Based on this observation, information entropy is applied in monitoring the status of virtual machines to identify the attack behaviors. We conduct our experiments in the campus‐wide data center, and the results show our detection system can promptly and accurately response to DoS attacks. Copyright © 2015 John Wiley & Sons, Ltd.