Luca Tasquier

Intrusion Detection in Cloud Computing

Cloud Computing represents both a technology for using computing infrastructures in a more efficient way, and a business model for selling computing resources and services. On the other hand, such complex and distributed architectures become an attractive target for intruders. Cyber-attacks represent a serious danger, which can compromise the quality of service delivered to the customers. In this paper, we investigate the key research topics for supporting distributed intrusion detection in Cloud environments. Moreover, we present a distributed architecture for providing intrusion detection in Cloud Computing, which enables Cloud providers to offer security solutions as a service. It is a hierarchical and multi-layer architecture designed to collect information in the Cloud environment, using multiple distributed security components, which can be used to perform complex event correlation analysis.

Agent Based Application Tools for Cloud Provisioning and Management

When service providers move to IAAS Clouds, whether their service is delivered by a legacy application, either it has been developed by a deployable open platform, the provisioning and the management workflow of the computing infrastructure really changes. Here we describe a set of tools which can be used to orchestrate agents’ based services, which provide facilities for provisioning, management and monitoring of Clouds. The user is able to discover, allocate, configure and monitor Cloud services at infrastructure level through an approach that is agnostic respect to the specific Cloud vendor or to the Cloud technology.

Management of Cloud Infrastructures through Agents

In the Cloud context, the monitoring of service levels becomes critical because of the conflicts of interest that might occur between provider and customer in case of outage. Here we focus on Cloud monitoring at infrastructure level (IaaS), but with the perspective of a Cloud customer. Cloud customers cannot check the compliance of the Service Level Agreement (SLA) trusting the monitoring service of their own Cloud provider. In fact the Cloud provider has a conflicting interest ensuring the guarantees on service levels it provides. Besides Cloud customers need to detect under-utilization and overload conditions to take decisions about load balancing and resource reconfiguration. In this paper we present an agency that is deployed in the Cloud together with the customers applications and can be used to configure a monitoring infrastructure. Mobile software agents take measures inside the Cloud resources, which are completely under the customers administration, collect performance information and compute metrics according to the users requirements. They implement a provider independent monitoring of the Cloud infrastructure during the execution of applications.

Interconnection of Federated Clouds

Cloud Federation is an emerging computing model where multiple resources from independent Cloud providers are leveraged to create large-scale distributed virtual computing clusters, operating as within a single Cloud organization. This model enables the implementation of environmental diversity for Cloud applications, and overcomes the provisioning and scalability limits of a single Cloud, by introducing minimal additional cost for the Cloud consumer. In such a scenario, it is necessary to leverage specific middleware technologies that enable the effective support of inter-Cloud communication services between Cloud providers. This paper proposes an interconnection solution for Cloud Federations based on publish-subscribe services.

Vendor Agents for IAAS Cloud Interoperability

Elastic provisioning of Cloud resources at IAAS is a mandatory facility to deploy applications on computing elements which are dynamically allocated based on the application needs. Because of the increasing offer of the Cloud market, the effectiveness of provisioning can be increased by selecting and exploiting the best proposal that is compliant with the user’s requirements. Due to the current lack of standards and to the heterogeneity of technologies interoperability at IAAS, it is the main issue to be addressed. We propose an agent based solution to abstract IAAS services for negotiation and management of Cloud resources. The paper presents our agent abstraction and its implementation to support two well known Cloud technologies: Open Nebula and Amazon.

Agents Based Monitoring of Heterogeneous Cloud Infrastructures

Monitoring of resources is one among the major challenges that the virtualization brings with it within the Cloud environment since the user applications are often distributed on several nodes whose location is unknown a priori and can dynamically change. Consumers need to monitor their resources for checking that service levels are continuously compliant with the agreed SLA and for detecting under-utilization or overloading conditions of their resources. Furthermore the monitoring of service levels becomes critical because of the conflicts of interest that might occur between provider and customer in case of outage. In this paper a framework that supports the monitoring of Cloud infrastructure is presented. It provides to the user the possibility to check the state of his/her resources, even if they have been acquired from heterogeneous vendors. The proposed environment will offer high elasticity and extensibility by the provisioning of an high level of customization of the performance indexes and metrics.

Addressing the interoperability in cloud: the vendor agent

Cloud computing has made the use of IT services more accessible and cheap. Resources are easily configurable and accessible using networked client devices and are characterised by particular agility and efficiency of use that allows to scale dynamically and on demand. However, owing to the current lack of standards and to the heterogeneity of technologies, users have little flexibility in choosing from alternative providers simultaneously in order to optimise resources at different levels so being affected by the vendor lock-in problem. In this paper, we address the problem of interoperability at IaaS level by proposing an agent abstraction, the vendor agent that is a wrapper to a specific provider technology, and its implementation to support two well-known cloud platforms: Open Nebula and Amazon. This abstraction represents a key driver towards interoperability giving users the opportunity to choose and use services provided by many different cloud vendors.

An Agent-Based Platform for Cloud Applications Performance Monitoring

The monitoring of the resources is one among the major challenges that the virtualization brings with it within the Cloud environments. In order to ensure scalability and dependability, the users applications are often distributed on several computational resources, such as Virtual Machines, storages and so on. For this reason, the customer is able to retrieve information about the Cloud infrastructure only by acquiring monitoring services provided by the same vendor that is offering the Cloud resources, thus being forced to trust the Cloud provider about the detected performance indexes. In this work we present a complete architecture that covers all the monitoring activities that take place within a Cloud application lifecycle: we also propose an agent-based implementation of a particular module of the designed architecture that ensures high customization of the monitoring facility and more tolerance to network and resource failures.

Agent Based Negotiation of Decentralized Energy Production

The increasing demand for energy has stimulated the formulation of plans aiming at shifting to renewable energies, not only to save money, but also for the responsibility that the present population has towards future generations. Within this scenario, ICT solutions will help the citizens in saving energy: people of a community that have power’s over-production can take benefits in terms of gain by selling the excess energy to neighbourhood instead of power suppliers due to the fees that they have to pay in the latter case. On the other hand, citizens that need additional energy can buy it from sellers in the neighbourhood at favorable prices. In this paper we present an agent-based framework that allows the collection of data about energy consumption in a neighbourhood and the negotiation of the whole produced/consumed energy among the involved parties in order to maximize the profits of the community.

Agent-Based Intrusion Detection for Federated Clouds

In the last years, the cloud services market has experienced an extremely rapid growth, as reported in several market research reports, which may lead to severe scalability problems. Therefore, federating multiple clouds is enjoying a lot of attention from the academic and commercial point of views. In this context, publish-subscribe is a widely used paradigm to support the interoperability of federated clouds. In this paper, we describe some potential vulnerabilities of a publish-subscribe based federated cloud system. In particular, we propose an agent-based system that aims at monitoring security vulnerabilities that affect such kind of inter-cloud cooperation solutions.