Anomaly Detection in the Cloud Using Data Density

TL;DR: The density is computed recursively, so the technique is memory-less and unsupervised, and therefore suitable for real-time cloud environments, and shows that network level attacks are detectable with high accuracy.

Abstract: Cloud computing is now extremely popular because of its use of elastic resources to provide optimized, cost-effective and on-demand services. However, clouds may be subject to challenges arising from cyber attacks including DoS and malware, as well as from sheer complexity problems that manifest themselves as anomalies. Anomaly detection techniques are used increasingly to improve the resilience of cloud environments and indirectly reduce the cost of recovery from outages. Most anomaly detection techniques are computationally expensive in a cloud context, and often require problem-specific parameters to be predefined in advance, impairing their use in real-time detection. Aiming to overcome these problems, we propose a technique for anomaly detection based on data density. The density is computed recursively, so the technique is memory-less and unsupervised, and therefore suitable for real-time cloud environments. We demonstrate the efficacy of the proposed technique on a dataset created in our cloud testbed. The dataset consists of feature vectors obtained from a physical cloud testbed network experiencing migration under controlled traffic conditions modelling scenarios combining normal network use with network-based attacks. The obtained results, which include precision, recall, accuracy, F-score and G-score, show that network level attacks are detectable with high accuracy.