Cloud security defence to protect cloud computing against HTTP-DoS and XML-DoS attacks

Service-oriented architecture (SOA) is gaining momentum as an emerging distributed system architecture for business-to-business collaborations. This momentum can be observed in both industry and academic research. SOA presents new challenges and opportunities for testing and verification, leading to an upsurge in research. This paper surveys the previous work undertaken on testing and verification of service-centric systems, which in total are 177 papers, showing the strengths and weaknesses of current strategies and testing tools and identifying issues for future work. Copyright © 2012 John Wiley & Sons, Ltd.

Testing and verification in service-oriented architecture: a survey

Distributed denial of service (DDoS) attacks are some of the most devastating attacks against Web applications. A large number of these attacks aim to exhaust the network bandwidth of the server, and are called network layer DDoS attacks. They are volumetric attacks and rely on a large volume of network layer packets to throttle the bandwidth. However, as time passed, network infrastructure became more robust and defenses against network layer attacks also became more advanced. Recently, DDoS attacks have started targeting the application layer. Unlike network layer attacks, these attacks can be carried out with a relatively low attack volume. They also utilize legitimate application layer requests, which makes it difficult for existing defense mechanisms to detect them. These attacks target a wide variety of resources at the application layer and can bring a server down much faster, and with much more stealth, than network layer DDoS attacks. Over the past decade, research on application layer DDoS attacks has focused on a few classes of these attacks. This paper attempts to explore the entire spectrum of application layer DDoS attacks using critical features that aid in understanding how these attacks can be executed. defense mechanisms against the different classes of attacks are also discussed with special emphasis on the features that aid in the detection of different classes of attacks. Such a discussion is expected to help researchers understand why a particular group of features are useful in detecting a particular class of attacks.

DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications

REATO: REActing TO Denial of Service attacks in the Internet of Things

This work analyzes a new and very subtle kind of security threat that can affect large-scale cloud-based IT service infrastructures, by exploiting the computational resources of their component data center to waste as much energy as possible. The consequence of these threats ranges from increased costs in the energy bill, to penalization for exceeding the agreed quantity of greenhouse gases (GHG) emissions, up to complete denial of service caused by electrical outages due to power budget exhaustion. We analyzed different types of such attacks with their potential impacts on the energy consumption, modeled their behavior and quantified how current energy-proportional technologies may provide attackers with great opportunities for raising the target facility emissions and costs. These efforts resulted in a simple model with some parametric reference values that can be used to estimate the impact of such attacks also in presence of very large infrastructures containing thousands or millions of servers.

/pdf/energy-oriented-denial-of-service-attacks-an-emerging-menace-3zippxv8my.pdf

Energy-oriented denial of service attacks: an emerging menace for large cloud infrastructures

Today Web services have grown in context of both business to business (B2B) and business to customer (B2C) applications. Web services are the most popular mode of implementing Service Oriented Architecture (SOA). With this growth and acceptance in the industry, the role of security is crucial. Most of the existing security mechanisms in Web services like XML encryption[4], digital signatures[3], user tokens etc. provide security on one basic assumption that source of the request is legitimate. But a typical Denial of Service attacker can use these sources as reflectors and play around with the contents of a Web service body to create an attack scenario. In this paper, we propose PreSODoS - a framework to detect and prevent XML based Denial of Service (XDoS) attacks on Web services based applications. The framework relies on content introspection to detect any XDoS possibility. We use a Patricia Trie based representation so that the schemas and the request messages can be compared and validated in a performance efficient manner. PreSODoS is capable of detecting any repetitive request message and sense an attack scenario and trigger corresponding prevention mechanisms.

Preventing Service Oriented Denial of Service (PreSODoS): A Proposed Approach

Interoperability refers to the ability of software and hardware on multiple machines from multiple vendors to communicate with each other without significant changes on either side. Web services streamline enterprise application integration by making it easier to tie applications running on heterogeneous platforms together helping them communicate correctly, effectively and at reduced cost. The difficulty of integration is a function of the level of interoperability between the applications being integrated. Even though there are established standards for Web services messaging (SOAP), description (WSDL) and discovery and registry (UDDI), custom implementations of these protocols by individual vendors has led to various interoperability issues. Web Services Interoperability Organization (WS-I) recently released Basic Profile 1.0, addressing the interoperability issues with core Web services standards. In this paper, we look at some of the key Web services interoperability issues pointed out by practitioners and critically examine how Basic Profile 1.0 addresses them. Further we also examine some limitations of the profile. We conclude by evaluating a popular Web services implementation against the profile and present our observations.

WS-I Basic Profile: a practitioner's view

Recent accounting scandals involving firms such as such as Enron, Worldcom, Tyco etc. have resulted in the emergence of stringent regulations aimed at safeguarding the interest of enterprise stakeholders. Important regulations such as Sarbanes-Oxley Act (SOX), the US PATRIOT act in US and the International Accounting Standards (IAS) regulation in Europe have diverse and far reaching effects. Organizations are mandated to comply with these regulations by producing certain documents and reports during the audit. This calls for appropriate extensible document lifecycle management solutions involving integration and reconciliation of stored data from heterogeneous sources with quick detailing. This is because these regulations demand easy accessibility of data. While point solutions to document life cycle management exist, they are not cost effective. The paradigm of service oriented architecture (SOA) which emphasizes software development based on well abstracted services has presented application development and adaptation a new dimension. SOA enables flexible deployment of shared reusable compliance services thereby yielding malleable and cost effective compliance solutions. In this paper, we provide a logical SOA based approach for achieving compliance in enterprises and illustrate this approach for a typical compliance need

K.M. Senthil Kumar

Papers

Preventing Service Oriented Denial of Service (PreSODoS): A Proposed Approach

WS-I Basic Profile: a practitioner's view

Reckoning Legislative Compliances with Service Oriented Architecture A Proposed Approach

Implementation of 5S practices in a small scale manufacturing industries