提高用户影响策略的可预测性以支持云服务中的异常检测
Improving Predictability of User-Affecting Metrics to Support Anomaly Detection in Cloud Services
摘要：
异常检测系统旨在检测和报告网络系统中的攻击或意外行为。以前的工作表明，异常对系统性能有影响，性能签名可以有效地用于实现IDS。在本文中，我们提出了一个分析和实验研究之间的权衡异常检测的基础上的性能签名和系统的可扩展性。所提出的方法结合分析建模和负载测试，以找到最佳配置的基于签名的入侵检测系统。我们应用重尾双模态建模方法，其中“长”作业表示消耗大量资源的事务，例如，DDoS攻击产生的;该模型使用从受控实验中获得的结果进行参数化。出于性能目的，平均响应时间是要最小化的关键度量，而出于安全目的，必须考虑响应时间方差和分类精度。从我们的分析的关键见解是：（i）有一个最佳数量的服务器，最大限度地减少响应时间方差，（ii）最小化响应时间方差和最大化分类精度的最佳点服务器数量通常小于或等于最小化平均响应时间。因此，出于安全目的，稍微牺牲性能以提高分类准确性可能是值得的。
英文摘要：
Anomaly detection systems aim to detect and report attacks or unexpected behavior in networked systems. Previous work has shown that anomalies have an impact on system performance, and that performance signatures can be effectively used for implementing an IDS. In this paper, we present an analytical and an experimental study on the trade-off between anomaly detection based on performance signatures and system scalability. The proposed approach combines analytical modeling and load testing to find optimal configurations for the signature-based IDS. We apply a heavy-tail bi-modal modeling approach, where "long" jobs represent large resource consuming transactions, e.g., generated by DDoS attacks; the model was parametrized using results obtained from controlled experiments. For performance purposes, mean response time is the key metric to be minimized, whereas for security purposes, response time variance and classification accuracy must be taken into account. The key insights from our analysis are: (i) there is an optimal number of servers which minimizes the response time variance, (ii) the sweet-spot number of servers that minimizes response time variance and maximizes classification accuracy is typically smaller than or equal to the one that minimizes mean response time. Therefore, for security purposes, it may be worth slightly sacrificing performance to increase classification accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
