Proceedings ArticleDOI
Security risk assessment of cloud carrier
Swetha Reddy Lenkala,Sachin Shetty,Kaiqi Xiong +2 more
- pp 442-449
Reads0
Chats0
TLDR
A risk assessment framework leverages the National Vulnerability Database (NVD) to examine the security vulnerabilities of operating systems of routers within the cloud carrier and provides quantifiable security metrics for cloud carrier, which enables cloud consumers to establish the quality of security services among cloud providers.Abstract:
Cloud computing based delivery model has been adopted by end-users and enterprises to reduce IT costs and complexities. The ability to offload user software and data to cloud data centers has raised many security and privacy concerns over the cloud computing model. Significant research efforts have focused on hyper visor security and low-layer operating system implementations in cloud data centers. Unfortunately, the role of cloud carrier in the security and privacy of user software and data has not been well studied. Cloud carrier represents the wide area network that provides the connectivity and transport of cloud services between cloud consumers and cloud providers. In this paper, we present a risk assessment framework to study the security risk of the cloud carrier between cloud consumers and cloud providers. The risk assessment framework leverages the National Vulnerability Database (NVD) to examine the security vulnerabilities of operating systems of routers within the cloud carrier. This framework provides quantifiable security metrics for cloud carrier, which enables cloud consumers to establish the quality of security services among cloud providers. Such security metric information is very useful in the Service Level Agreement (SLA) negotiation between a cloud consumer and a cloud provider. It can be also be used to build a tool to verify SLA compliance. Furthermore, we implement this framework for the cloud carriers of Amazon Web Services and Windows Azure Platform. Our experiments show that the security risks of cloud carriers on these two commercial clouds are significantly different. This finding provides guidance for a network provider to improve the security of cloud carriers.read more
Citations
More filters
Journal ArticleDOI
Systematic identification of threats in the cloud: A Survey
TL;DR: This survey explores threats to the cloud by investigating the linkages between threats, attacks and vulnerabilities, and proposes a method to identify threats systematically in the cloud using the threat classifications.
Book ChapterDOI
A Machine Learning Framework for Studying Domain Generation Algorithm (DGA)-Based Malware
TL;DR: A machine learning framework for identifying and clustering domain names to circumvent threats from a DGA is proposed and achieves accuracies of 95.14% and 92.45% for the first-level classification and second-level clustering, respectively.
Journal ArticleDOI
Generation of Labelled Datasets to Quantify the Impact of Security Threats to Cloud Data Centers
TL;DR: This paper presents an experimental platform designed to represent a practical interaction between cloud users and cloud services and collect network traces resulting from this interaction to conduct anomaly detection and uses Amazon web services (AWS) platform for conducting experiments.
Book ChapterDOI
Model-Based Quantitative Security Analysis of Mobile Offloading Systems Under Timing Attacks
TL;DR: This paper aims at quantifying the security attributes of mobile offloading systems, modeled as a stochastic process for steady-state behaviour as to optimise a combined security and cost trade-off measure.
Journal ArticleDOI
Probabilistic modeling and analysis of sequential cyber-attacks
TL;DR: Continuous‐time Markov chain and semi‐Markov process–based methods are proposed to estimate the occurrence probability of a security risk for systems undergoing the sequential cyber‐attacks.
References
More filters
Book
Systems engineering and analysis
TL;DR: The design for operational feasibility and design for Usability, as well as Alternatives and Models in Decision Making, and Design for Affordability and Disposability, are reviewed.
ReportDOI
Risk Management Guide for Information Technology Systems: Recommendations of the National Institute of Standards and Technology
Proceedings ArticleDOI
CloudCmp: comparing public cloud providers
TL;DR: Applying CloudCmp to four cloud providers that together account for most of the cloud customers today, it is found that their offered services vary widely in performance and costs, underscoring the need for thoughtful provider selection.
SP 800-30. Risk Management Guide for Information Technology Systems
TL;DR: In this article, the authors provide a framework for the development of an effective risk management program, containing both the definitions and the practical guidance necessary for assessing and mitigating risks identified within IT systems throughout their system development life cycle (SDLC).