RADS：云数据中心实时的异常检测系统
RADS: Real-time Anomaly Detection System for Cloud Data Centres
摘要：
随着云服务市场的增长，云数据中心的网络安全攻击也在增加。现有的研究提出了一些异常检测系统来检测这种攻击。然而，这些系统遇到了许多挑战，特别是由于攻击的未知行为和真正的云工作负载峰值的发生，这必须与攻击区分开来。在本文中，我们讨论了这些挑战，并调查了现有的云异常检测方法的问题。然后，我们提出了一个实时的【形】异常检测系统（RADS）的云数据中心，它使用一类分类算法和基于窗口的时间序列分析来解决的挑战。具体来说，RADS可以检测由于DDoS和加密挖矿攻击而发生的VM级异常。我们通过运行基于实验室的实验和使用真实世界的云工作负载跟踪来评估RADS的性能。评估结果表明，RADS可以达到90-95%的准确性，低误报率为0- 3%。结果进一步表明，RADS经验较少的假阳性时，使用其基于窗口的时间序列分析相比，使用最先进的平均或熵为基础的分析。
英文摘要：
Cybersecurity attacks in Cloud data centres are increasing alongside the growth of the Cloud services market. Existing research proposes a number of anomaly detection systems for detecting such attacks. However, these systems encounter a number of challenges, specifically due to the unknown behaviour of the attacks and the occurrence of genuine Cloud workload spikes, which must be distinguished from attacks. In this paper, we discuss these challenges and investigate the issues with the existing Cloud anomaly detection approaches. Then, we propose a Real-time Anomaly Detection System (RADS) for Cloud data centres, which uses a one class classification algorithm and a window-based time series analysis to address the challenges. Specifically, RADS can detect VM-level anomalies occurring due to DDoS and cryptomining attacks. We evaluate the performance of RADS by running lab-based experiments and by using real-world Cloud workload traces. Evaluation results demonstrate that RADS can achieve 90-95% accuracy with a low false positive rate of 0-3%. The results further reveal that RADS experiences fewer false positives when using its window-based time series analysis in comparison to using state-of-the-art average or entropy based analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
