DDoS Attacks: Tools, Mitigation Approaches, and

Probable Impact on Private Cloud Environment

R. K. Deka*1 , D. K. Bhattacharyya†1 and J. Kalita‡2

1 Departmentof Computer Science and Engineering, Tezpur University, Napaam,
Assam, India,
2 Department of Computer Science, College of Engineering and Applied Science,

University of Colorado, Boulder, CO, United States

arXiv:1710.08628v1 [cs.NI] 24 Oct 2017

Abstract: The future of the Internet is predicted to be on the cloud, resulting in more
complex and more intensive computing, but possibly also a more insecure digital world.
The presence of a large amount of resources organized densely is a key factor in attracting
DDoS attacks. Such attacks are arguably more dangerous in private individual clouds
with limited resources. This paper discusses several prominent approaches introduced to
counter DDoS attacks in private clouds. We also discuss issues and challenges to mitigate
DDoS attacks in private clouds.

Keywords: DoS, Intrusion, Defense, Response, Tolerance.

1 Introduction and Related work

The cloud computing infrastructure allows a service provider on the Internet to provide
the use of computing resources to satisfy the demands of users. It also enables data cen-
tres and business organizations to provide benefits such as fast deployment, scalability,
elasticity, security and resiliency. Virtualization makes it possible for cloud computing to
provide services with optimal use of resources. Khorshed et al. [27] define cloud comput-
ing as “a system of shared resources of a data center using virtualization technology. Such
systems provide elastic on the basis of demand and ask for charges based on customer
usage".
When providing relevant services on the Internet using a pool of shared resources,
security is a major concern and policies must exist in cloud computing to address impor-
tant issues such as reliability, security, anonymity and liability. Three types of intrusion
can occur in a network of computing machines: scanning, DoS and penetration [14]. The
cloud incessantly faces security threats such as SQL injection, Cross Site Scripting (XSS),
DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks, and hacking
in general. The Arbor Networks1 reported the largest (at that time) DDoS attack of 400
Gbps in 2014. In Figure 1, DDoS attack trends in quarter two of year 2016 are shown2 . In
particular, large-scale DDoS attack frequency has continued to trend upward as shown in
Figure 2.
* rup.deka@gmail.com
† dkb@tezu.ernet.in
‡ jkalita@uccs.edu
1 http://www.arbornetworks.com, Accessed: June, 2016
2 http://www.stateoftheinternet.com/securityreport, Accessed: November, 2016.

1
 Figure 1: Intrusion Scenario in Quarter-2, 2016(in percentage)

Figure 2: Statistics on DDoS Attacks in 2016

In October, 2016, the cyber attack that brought down much of America’s Internet was
caused by a new weapon called the Mirai botnet and was likely the largest of its kind in
history. Unlike other botnets, which are typically made up of computers, the Mirai botnet
is largely made up of so called Internet of Things (IoT) devices such as digital cameras
and digital video recorder (DVR) players. The victims were the servers of Dyn, a company
that controls much of the Internet’s Domain Name System (DNS) infrastructure. It was
hit on 21st of October, 2016 with an extraordinary attack strength of around 1.2 Tbps and
remained under sustained assault for most of the day, bringing down many sites including
Twitter, The Guardian, Netflix, Reddit, CNN and many others in Europe and US 3 .
Research on DDoS attacks and defense in the cloud environment is still at an early
stage. These days, researchers are very much concerned about services in the cloud and
cloud security. Sabahi [47], Pitropakis et al. [46], and Grover and Sharma [20] discuss
efforts to secure user data in the cloud. Rather than storing the information locally at the
client’s infrastructure, information is stored in the cloud provider’s location. It is obvious
3 https://www.theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet, Accessed:
February, 2017

2
that in such a situation, people are worried about the security of their data. Thus cloud
organizations should provide adequate security for the customer and also for the safety of
their own.
In the context of the cloud, requests for resources like virtual machines (VMs) can be
made by any user through the Internet. As a result, a network of zombies can easily launch
DDoS attacks. Modi et al. [40] provide a survey of different types of intrusions which can
take place in the cloud environment. Khorshed et al. [27], and Subashini and Kavitha [56]
focus on flaws, challenges, security concerns in different service layers.
In this article, we discuss the seriousness of the threats posed by DDoS attacks in the
context of the cloud, particularly in the individual private cloud. We present a discussion
of different approaches which are used to defend or mitigate DDoS attacks in a general net-
work architecture, and also some approaches that consider cloud computing technology
in particular. Unlike [40], we highlight challenges and issues faced particularly by the pri-
vate cloud environment when facing DDoS attacks in a general way. A generic framework
is discussed to defend against DDoS attacks in an individual private cloud environment
taking into account different challenges and issues.
The first reported occurrence of a DDoS attack was from 1999 against servers at the
University of Minnesota. In the early 2000s, many popular and major Websites like Yahoo!,
Ebay, CNN and Amazon.com were assaulted by DDoS attacks [29]. Their systems were
down for hours and users were denied access to services [44]. These attacks were able to
create disaster because of the use of botnets. Stone-Gross et al. [55], and Hoque et al.
[21] provide a detailed investigation of botnets [18], a network of compromised machines
under the control of a master. Khorshed et al. [27] provide a survey of challenges related
to the cloud and present a proactive approach towards detection of attacks in the cloud.
A large number of methods have been documented and categorized in [6] to detect
DDoS attacks. These methods or approaches are supervised learning, unsupervised learn-
ing, probabilistic learning, soft computing, and knowledge-based.
It is important to note that usually only two types of attacks are mounted depending
on the traffic rate, i.e., high-rate and low-rate. If a numbers of legitimate users access the
Internet at a high rate, and a sophisticated attacker attempts to mimic legitimacy like a
flash crowd at the same time, it is tough to discriminate between them. Yu et al. [73]
formulate a feasible theory for distinguishing between the two using the concept of flow
correlation coefficient. Xiang et al. [67] show how a low-rate attacker can take advantage
of flaws in network protocols and also present a detection method for such attacks.
There has been some work on mitigating or tolerating DDoS attacks in the cloud envi-
ronment. With increased sophistication of attackers, protection of open systems is increas-
ingly challenging. Nguyen and Sood [42] opine that intrusion tolerance should be a part
of overall in-depth security. They compare three types of intrusion-tolerant system archi-
tectures. Lua and Yow [35] propose a method in which an intelligent large swarm network
is used to mitigate the attack. The swarm network constantly reconfigures itself through
the use of a parallel optimization algorithm such as the Intelligent Water Drop mechanism
[50]. Amazon has created a technique called cloudWatch4 to monitor resources and to mit-
igate the situation according to the attack. Yu et al. [74] attempt to provide the theory of
optimal resource allocation in a cloud platform when defending a DDoS attack. Wang et
al. [63] have also developed a theory on optimal resource allocation, which is adaptable to
the cloud scenario.
In Table 1, a comparison is provided among few existing survey papers with our work.
For comparison, we choose four parameters, inclusion of attacks, description of defense
solutions, issues and challenges, and inclusion of recommendations in these papers. khor-
shed et al. [27], Grover and Sharma [20], and Subashini and Kavitha [56] discuss that de-
spite a lot of talk about the cloud, customers were still reluctant to deploy their business
4 https://aws.amazon.com/cloudwatch/, Accessed: August, 2016.

3
 Table 1: Comparison with Existing Survey Articles

Authors Year Attacks Defense Issues Recommen-

dations
Included Solutions & Challenges

Subashini and Kavitha [56] 2010 X × X ×

Sabahi [47] 2011 X × X ×

Bhadauria et al. [5] 2011 X × X ×

Khorshed et al. [27] 2012 X × X ×

Modi et al. [40] 2013 X × × ×

Zhang et al. [81] 2013 X × × ×

Grover and Sharma [20] 2014 X × X ×

Wong and Tan. [66] 2014 X X X ×

Our survey X X X X

in the cloud. Security and complications with data privacy and data protection continue
to restrict the growth of the cloud market and these survey papers are more specific to
the security issues that have been raised due to the nature of the service delivery system
of a cloud environment. Sabahi [47] also raise the same concern about the cloud environ-
ment. Comparison between the benefits and risks of cloud computing is necessary for a
full evaluation of the viability of cloud computing. Some critical issues that clients need
to consider arise as they contemplate moving to cloud computing. Sabahi summarize re-
liability, availability, and security issues faced by cloud computing, and proposed feasible
and available solutions for some of them. In a cloud computing environment, the entire
data is deployed over a set of networked resources, and such data can be accessed through
virtual machines. Since these data centers may be anywhere in the world beyond the
immediate reach and control of end users, there are many types security and privacy chal-
lenges that need to be understood and taken care of. There is always a possibility of server
breakdown that has been witnessed often in recent times. Such things are extensively sur-
veyed by Bhadauria et al. [5], who elaborate and analyze the numerous unresolved issues
threatening the adoption of cloud computing and the diffusion affect the various stake
holders linked to it.
Modi et al. [40] discuss different intrusions that affect availability, confidentiality and
integrity of cloud resources and services. A few existing proposals including Intrusion
Detection Systems (IDS) and Intrusion Prevention Systems (IPS) on the cloud are briefed.
Many,commercial cloud providing businesses have emerged in the past deacde, and each
one provides its own cloud infrastructure, APIs and application description formats to
access the cloud resources and also support for Service Level Agreements (SLAs). As a
result, vendor lock-in has seriously restricted the flexibility of end users, who would like
to deploy applications over different infrastructures in different geographic locations, or
to migrate a service from one provider’s cloud to another. To enable seamless sharing of
resources from a pool of cloud providers, efforts have emerged recently in both the in-

4
dustry and academia to facilitate cloud interoperability, i.e., the ability for multiple cloud
providers to work together. Zhang et al. [81] discuss all this and conduct the survey on
the state-of-the-art efforts, with a focus on cooperation among different IaaS (Infrastruc-
ture as a Service) cloud platforms. They investigate the existing studies on taxonomies
and standardization of cloud cooperation. Another big issue is that DDoS attacks today
have been amplified into terabit volume with broadband Internet access and with the use
of more powerful botnets. As a result, common DDoS mitigation and protection solutions
implemented in small and large organizations’ networks and servers are no longer effec-
tive. Wong and Tan [66] provide an in-depth study on the current largest DNS reflection
attack with more than 300 Gbps strength on Spamhaus.org. They review and analyze the
currently most popular DDoS attack types launched by hacktivists. Effective cloud-based
DDoS mitigation and protection techniques proposed by both academic researchers and
large commercial cloud-based DDoS service providers are also discussed.
This paper presents an organized survey concerning security in the network infrastruc-
ture of cloud computing, specifically impact of DoS and DDoS attacks on the networking
services of a cloud environment. It begins with a description of types of cloud environ-
ments and then different types of DDoS attacks. It also highlights the seriousness of DDoS
attacks in private clouds. We present an in-depth discussion of the challenges and issues
in defending such attacks. The major contributions of this survey are the following.

Figure 3: A Taxonomy

• Our presentation is specific to security of cloud computing.

• There are just a handful of surveys on cloud security, and published surveys do not
emphasize the impact of DDoS attacks on individual private clouds. We present

5
 challenges and issues to help the researcher in creating a defense theory and in build-
ing a defense system against DDoS attacks.

• Pros and cons analysis of a large number of detection and mitigation methods is
included.

• We also discuss trending concepts such as the role of big data and software defined
networking in cloud security.

• A generic framework for device defense mechanism in a cloud based environment is

also presented.

The rest of the paper is organized as follows. Different deployment models of clouds,
DDoS attacks, and types of DDoS attacks along with probable impact on private clouds are
discussed in Section 2. Different existing approaches and potential solutions are briefed
and some recommendations for developing a defense model are presented in Section 3.
In Section 4, challenges and issues related to private cloud in defending against DDoS
attacks are presented. A generic framework to defend against DDoS attacks is discussed
in Section 5. Finally, we present conclusions in Section 6. In Figure 3, a taxonomy of terms
and concepts used in the entire article is provided for better understanding as the reader
proceeds with the article.

2 Cloud And DDoS Attack

2.1 Cloud Deployment Models
A cloud node can provide three basic services to customers: infrastructure as a service
(IaaS), platform as a service (PaaS) and software as a service (SaaS), as shown in Figure 4.
The deployment differences can be seen in the Figure 5, and an explanation of different
deployment models are given below.

Figure 4: A Cloud Node

(a) Public cloud: The cloud is created for the general public where free or rental ser-
vices are provided. This can be accessed by any authorized user. Examples of public

6
 Figure 5: Deployment Models

clouds include Amazon Elastic Compute Cloud (EC2) 5 , Google AppEngine6 and
Windows Azure Services Platform 7 . A public cloud provides abstractions for re-
sources using virtualization techniques on a large scale. It benefits the user by pro-
viding for backup and access to secure resources by synchronizing, replicating and
allocating the resources throughout the network.

(b) Private cloud: This type of cloud is managed internally by an organization or by a

third party, and is hosted either internally or externally. A private cloud is designed
to offer the same features and benefits of public cloud systems, usually with limited
resources for maintaining the cloud environment. Unlike a public cloud, a private
cloud remains within the corporate firewall, which means private cloud is privately
manged by a company for private use of its private users and not for public on pay
per use basis. Also, a private cloud can be used by a company to store sensitive data
internally and at the same time provide the advantages of cloud computing within
their business infrastructure, such as on demand resource allocation as in Apache
CloudStack8 , OpenStack9 , VMware vCloud Suite10 , etc. Individual private cloud
customers as well as the provider (referred to as parties hosting their services in a
cloud) do not have sufficient resources to handle a rapid increase in service demands.
On the other hand, they too can avail the advantage of unique features of clouds.

(c) Community Cloud: This cloud infrastructure is provided for a specific or exclusive
community of consumers11 . These group of users or organisations may have shared
5 https://aws.amazon.com/ec2/, Accessed: July, 2016
6 https://cloud.google.com/appengine/docs, Accessed: July, 2016
7 https://azure.microsoft.com/en-in/, Accessed: August, 2016
8 https://cloudstack.apache.org/, Accessed: September, 2016
9 https://www.openstack.org/, Accessed: September, 2016
10 http://www.vmware.com/in/products/vcloud-suite, Accessed: August, 2016
11 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf, Accessed: August,
2017

7
 concerns (e.g., mission, security requirements, policy, and compliance considera-
tions). Community Cloud can be controlled by one or more organizations of that
community, or a third party, or some combination of them. Also it can be exist on
or off premises. some examples of community clouds are Dimension Data12 , Layer-
Stack13 , and Zoolz14 .

(d) Hybrid cloud: This is a combination of two or more linked cloud deployment mod-
els with a provision to transfer data between them. The combination may include
both private and public clouds. For example, a company can maximize its efficiency
by deploying public cloud services for all non-sensitive operations, but only deploy
private cloud when it needs to store sensitive operations as it is surrounded by fire-
wall, and ensure that all of their platforms are seamlessly integrated. This type of
mixed cloud environment adds complexity to the distribution of applications across
environments. Amazon Web Services15 , Rackspace Hybrid Cloud16 , EMC Hybrid
Cloud17 , HP Hybrid Cloud18 are some examples of hybrid clouds.

Table 2: Differences between private and public cloud

Key Points Private Public

Use of Tech- Old New
nology
Capital Ex- Not Shifted Shifted to
penses
Operational
expenses
Utilization Low High
Rate
Infrastructure High Low
Cost
Elasticity Less More
Economies of Less High
Sale
Business Low High
Attraction
Security Less High
Perimeter Suffer Not suffer
Complacency
Skill Level Unknown Usually High
Penetration Insufficient Sufficient
Testing
Business Deeply in Out of
Focus
Data center Data center

12 http://www2.dimensiondata.com/services/cloud-services/provider-and-community-cloud, Accessed:
August, 2017
13 https://www.layerstack.com/cloud-servers
14 http://www.zoolz.com/overview/
15 https://aws.amazon.com, Accessed: October, 2016
16 https://www.rackspace.com/en-in/cloud/hybrid, Accessed: October, 2016
17 https://www.emc.com/en-us/cloud/hybrid-cloud-computing/index.htm, Accessed: July, 2016
18 http://www8.hp.com/in/en/cloud/helion-hybrid.html, Accessed: September, 2016

8
2.1.1 Differences Between Private Cloud and Public Cloud
In Table 2, differences between private and public clouds are enumerated. A cloud has
shared general features, whether private or public. As clouds have evolved on and from
the Internet, we can build defense models based on research that has been conducted
on general defense solutions against DDoS attacks and features of clouds. We can then
proceed to discuss individual private cloud defense. Private clouds require more attention
because they have limited resources and the cost is high during an attack compared to
a public cloud. This is because we know that a private cloud is accessed by authorized
users or private organizations paying money as per need. Both ends (customer and service
provider) heavily rely on security. A DDoS attack can cripple the whole private cloud and
jeopardize whole businesses. So DDoS attack is more threatening to individual private
cloud customers than a public cloud’s customers.

2.2 DDoS Attacks

DoS attacks are intended to deny legitimate users access to network resources. Attackers
create a botnet of compromised nodes on the Internet to support a DoS attack to inflict
severe damage to a target. Such coordinated and distributed attacks are termed DDoS at-
tacks. It is obvious that in the cloud environment, there are a lot of concentrated resources
and the infrastructure is shared by a large number of users. A DDoS attack has the po-
tential to do immense harm, much more than the harm that can be wrought upon single
tenanted architectures [16].

Figure 6: Direct DDoS Attack

Figure 7: Reflection/Indirect DDoS Attack

9
2.2.1 Infrastructure level attacks
Network bandwidth, routing equipment and computing resources are considered infras-
tructure. In this attack, the intruder attempts to overwhelm the resource capacity of a
private cloud’s infrastructure by sending a large number of fake requests, which exploit
the limitation of a specific application to cause performance degradation or ultimately
crash remote servers. Some commonly used infrastructure level attacks are listed below.
a) Direct: A direct Denial-of-Service attack is characterized by an explicit attempt to
prevent the legitimate use of a service [38]. A Distributed Denial-of-Service attack deploys
multiple attacking entities to attain this goal as shown in Figure 6. A DDoS attack includes
an overwhelming quantity of packets sent from multiple attack sites to a victim site. These
packets arrive in such a high quantity that some key resource at the victim is quickly
exhausted. The victim either crashes or spends so much time handling the attack traffic
that it cannot attend to its real work.
b) Reflection/Indirect: It is a type DoS attack in which multiple compromised victim
machines unwillingly participate in a DDoS attack. Flashes of requests to the victim host
machines are redirected or reflected from the victim hosts to the target. Some reflection or
indirect based attacks are mentioned below. The general approach is as shown in Figure 7.

• DNS (Domain Name Service) reflection or amplification attacks use botnets that send
a large number of DNS queries to open DNS resolver using spoofed IP addresses of
victims to produce an overwhelming amount of traffic with very little effort. Thus,
such an attack can do a lot of damage as it is difficult to stop this type of attack at an
early stage.

• SSDP (Simple Service Discovery Protocol) reflection attacks are created using the
Simple Object Access Protocol (SOAP) to deliver control messages to universal plug
and play (UPnP) devices and to communicate information. These requests are cre-
ated to elicit responses, which reflect and amplify a packet and redirect responses
towards a target.

• NTP (Network Time Protocol) reflection attacks are created by the attacker to send a
crafted packet in which requests for a large amount of data are sent to the host. NTP
is used to synchronize the time between client and server.

• In an SNMP (Simple Network Management Protocol) reflection attack, the culprits

send out a huge number of SNMP queries with forged IP addresses to numerous
victim machines. SNMP is a network management protocol for configuring and col-
lecting information from servers.

• CHARGEN (Character Generator Protocol) is often misused when attackers use the
testing features of the protocol to create malicious payloads and reflect them by
spoofing the address of the source to direct them to the target. CHARGEN is a de-
bugging and measurement tool and also a character generator service.

c) TCP SYN flood: Manipulating the 3-way handshake in a TCP connection, an attacker
sends a lot of ordinary SYN segments to fill up resources causing a service to be denied for
legitimate connections.
d) UDP flood: In this attack, massive amounts of UDP packets are sent to random ports
on the victim side. Sometimes ports remain open without knowledge of administrators,
causing the server to respond. A response to each UDP packet with an IMCP unreachable
reply to the spoofed source IP address makes the situation worse by overwhelming the
network environment of the victimized IP addresses.
e) ICMP flood: ICMP flood, occasionally referred to also as a Smurf attack or Ping
flood, is a ping-based DoS attack that sends large numbers of ICMP packets to a server

10
and attempts to crash the TCP/IP stack on the server and cause it to stop responding to
incoming TCP/IP requests.
f) Crossfire Attack: A botnet can launch an attack with low intensity traffic flows that
cross a targeted link at roughly the same time and flood it. For example, a botnet controller
can compute a large set of IP addresses whose advertised routes cross the same link, and
then direct its bots to send low-intensity traffic towards these addresses. This type of
attack is called the Crossfire attack [25].

2.2.2 Application level attacks

Application layer DDoS attacks continue to grow in both complexity and prevalence.

(i) Common application-layer DDoS attack types: When a heavy amount of legitimate
application-layer requests or normal requests that consume large amounts of server
resources or high workload requests across many TCP sessions are sent to the server,
they can cause common application layer DDoS attacks.
(ii) HTTP flood attacks: Some application level DDoS attacks come in the form of HTTP
GET floods. HTTP request attacks are those attacks where attackers send HTTP GETs
and POSTs to Web servers in an attempt to flood them by consuming a large amount
of resources. The HTTP POST method enables attackers to POST large amounts of
data to the application layer at the victim side, and it happens to be the second most
popular approach among the application layer attacks.

2.3 Probable Impact of DoS/DDoS on Cloud

As mentioned earlier, the cloud computing market continues to grow, and the cloud plat-
form is becoming an attractive target for attackers to disrupt services and steal data, and
to compromise resources to launch attacks. Miao et al. [37] present a large-scale char-
acterization of inbound attacks towards the cloud and outbound attacks from the cloud
using three months of NetFlow data in 2013 from a cloud provider. They investigate nine
types (TCP SYN flood, UDP flood, ICMP flood, DNS reflection, Spam, Brute-force, SQL
injection, Port scan, and Malicious Web activity (TDS)) of attacks ranging from network-
level attacks such as DDoS to application-level attacks such as SQL injection and spam.
Cloud computing features a cost-efficient, “pay-as-you-go” business model. A cloud plat-
form can dynamically clone virtual machines very quickly, e.g., by duplicating a gigabyte
level server within one minute [43]. Despite the promising business model and hype sur-
rounding cloud computing, security is the major concern for a business that is moving
its applications to clouds. When a DDoS attack is launched from a botnet with a lot of
zombies, Web servers can be flooded with packets quickly, and memory can be exhausted
quickly in an individual private cloud. So, we can say that the main competition between
DDoS attacks and defenses is for resources. The increase of DDoS attacks in volume,
frequency, and complexity, combined with the constant required alertness for mitigating
Web application threats, has caused many Website owners to turn to Cloud-based Security
Providers (CBSPs) to protect their infrastructure [61]. In one recent analysis19 , DDoS at-
tacks are considered one of the top nine threats to cloud based environments. This report
concludes that cloud services are very tempting to DDoS attackers who now focus mainly
on private data centers. It is safe to assume that, as more cloud services come into use,
DDoS attacks on them will become more commonplace. Some key findings are provided
by InfoWorld20 , in 2013.
• 94 percent of data center managers reported some type of security attacks.
19 http:/www.cloudsecurityalliance.orgtopthreats, Accessed: November, 2016
20 http://www.infoworld.com/d/cloud-computing/cloud-use-grows-so-will-rate-of-DDoS-attacks-
211876, Accessed:October, 2016

11
 • 76 percent had to deal with distributed denial-of-service (DDoS) attacks on their
customers.

• 43 percent had partial or total infrastructure outages due to DDoS attacks.

• 14 percent had to deal with attacks targeting a cloud service.

Unfortunately, the counterparts of clouds, e.g., client-server and peer-to-peer comput-
ing platforms, do not usually have sufficient resources to beat DDoS attacks. The public
cloud infrastructure stands a better chance because a public cloud usually has a lot of re-
sources that make it easy to handle a rapid increase in service demands to counter the
attack dynamically. It is almost impossible to shut down such clouds by attacking them.
But, if an intense DDoS attack occurs on customers of an individual private cloud like a
data center with limited resources, it cannot escape from the DDoS attack, and it becomes
a battle of survival using all the resources there are to confront. The essential requirement
to defeat a DDoS attack is to allocate sufficient resources to mitigate attacks no matter how
efficient our detection and filtering algorithms are.
Cloud Service Providers (CPS) usually provide cloud customers two resource provi-
sioning plans: short-term on-demand and long-term reservation. Giant cloud providers,
like Amazon EC2 and GoGrid, provide both plans [7]. If a customer chooses the first plan,
it is charged based onresources used. This business model for resources is vulnerable to
an Economic Denial of Sustainability (EDoS) attack [23, 54, 53]. This kind of attack also
disturbs the service of clouds that allocate resources based on spot instance [64, 72]. On
the other hand, if a customer chooses the reservation plan, it makes a prior reservation for
resources for the maximum usage for the business. In other words, the reserved resources
for the application are limited from start. As a result, a threat of DDoS attack remains.

Figure 8: Possible Scenario of DDoS Attack Types in Private Cloud

Some possible examples of DDoS attacks in cloud environments are Smurf attack, IP
spoofing attack, Tear drop attack, SYN flood attack, ping of death attack, Buffer overflow
attack, LAND attack, etc., as shown in Figure 8 [69, 15]. From many news report we can
state that large-scale IoT-enabled DDOS attacks will continue to dominate enterprise se-
curity. Darwish et al. [12] discuss DDoS attacks as attacks that target the resources of
these services, lowering their ability to provide optimum usage of the network infrastruc-
ture. Due to the nature of cloud computing, the methodologies for preventing or stopping

12
DDoS attacks are quite different compared to those used in traditional networks, and new
approaches published till now are usually adapted versions of older approaches. In the
above mentioned papers, we can find descriptions about the effect of DDoS attacks on
cloud resources and recommend practical defense mechanisms against different types of
DDoS attacks in the cloud environment.

2.4 Discussion
We summarize below the security concerns in the private cloud against DDoS attacks in
the following.

• Since infrastructure is shared by a large number of clients, a massive DDoS attack

potentially has great impact.

• Symptoms of DoS or DDoS attacks are unusually slow network performance, un-
availability of a particular Website, inability to access any Website, and dramatic
increase in the amount of spam.

• The patterns of DDoS attack are always changing. Attack growth, intensity and pen-
etration time change fast along with the Internet world.

• In the resource constrained environment of a private cloud network, it is essential to

handle a DDoS attack as quickly as possible.

• It is usually a battle for survival with all the resources the private cloud can muster.

• Deft resource management is necessary to defend against a DDoS attack in the cloud
when a DDoS attack is mounted against a private cloud, especially in an individual
private cloud. Putting the best detection or filtering algorithm may not always work.
But tolerating the attack by optimal resource utilization may resist the attack and
may help counter the DDoS attack.

• Virtualization of resources gives some edge over DDoS attacks in a cloud environ-
ment.

3 Mitigation Approaches
Mitigating DDoS attacks is a classic problem. However, in the cloud environment, it be-
comes a bigger challenge [80]. We also cannot totally separate a cloud environment from
the traditional network infrastructure. Though the data center networks are more complex
in reality, the backbone infrastructure is based on the traditional network architecture.
These complex networks are adapted for virtualization for scalability and robustness. We
present several approaches that have been applied in network contexts in transition so
that we can understand the requirements, issues and challenges in building defense mod-
ules against DDoS attacks in a data center-like private cloud environment. One can see
the evolving nature of the defense approaches along with the evolution of the Internet
in the discussed approaches. All approaches presented in this section have some advan-
tages, which can be adapted for private cloud-like environment. Some promising new
approaches have also been developed in the context of the cloud. These include like SDN-
based ideas and ideas from the big data analytic point of view [51]. A defense approach
can be deploy in the network itself or in the host(victim) environment. We analyze dif-
ferent existing approaches, and based on features of the approaches such as the level of
operation, time to respond, and time to cooperate with other devices, we divide active
response into two main categories, as shown in Figure 9.

13
 Figure 9: Attack Response Scenario

• In a proactive approach, steps taken to control potential incident activity before it

happens rather than waiting for it to happen.

• A reactive approach detects the abnormality and informs the security administrator
or automatically takes a responsive counter-action immediately i.e., in real-time. A
reactive response reacts only after the intrusion is detected.

In the rest of this section, a few prominent approaches are discussed. The models de-
veloped by different authors based on these approaches are analyzed. Each of the methods
can be included either in the proactive or the reactive category. It very much remains open
to debate which type category will work best in the individual private cloud environment.
Push-back: Mitigating DDoS attacks is a congestion-control problem because most
congestion happens due to malicious hosts not obeying traditional end-to-end congestion
control policies. Most researchers think that the problem needs to be handled by routers.
Functionality can be introduced in each router to detect and preferentially drop malicious
packets, which probably belong to an attack. A push-back mechanism based on managing
congestion at the routers has been implemented by Ioannidis and Bellovin [24]. Their
architecture has three main parts. Congestion signature matching tries to monitor packets
in the incoming queue. Matching patterns are then sent to a rate-limiter to decide whether
a packet is to be dropped or forwarded. The packets to be dropped are sent to the Push-
Back Daemon, which periodically updates congestion signatures and the rate limit in the
rate-limiter. A cooperative environment among neighboring routers implementing this
approach will be appropriate for dealing with DDoS attacks in the cloud environment and
provide for a dynamic solution in real time.
Router Throttling: The basic concept behind router throttling is to develop a model to
throttle or control the flow of traffic at upstream routers of a server, which may be under
stress or attack. It is a proactive process to forestall an impending attack. Participating
routers can regulate the packet rate destined for a server. Yau et al. [70] propose and
simulate a router throttling model to establish the efficacy of the concept, as shown in
Figure 10. This proactive process may be very useful in the private cloud environment,
because it can reduce computation load in an end server with limited resources. This idea
can also increase the service reliability for legal users. Using the improvised K-level max-
min fairness theory [41], Yau et al. find that the throttling mechanism is highly effective in
countering an aggressive attacker. They efficiently regulate the server load to a level below

14
its design limit in the midst of a DDoS attack.

Figure 10: Router Throttling Model Proposed by Yau et al.[70]

Divide and Conquer: Chen et al. [8] use the divide and conquer strategy to actively
throttle attack traffic. They present a diagnosis and attack mitigation scheme that com-
bines the concepts of push-back and packet marking. Attack detection is performed near
the victim and packet filtering is executed close to attack sources. Initially, the intru-
sion detection system detects the attack on the victim side. The victim end instructs the
upstream router to mark malicious packets with trace back information to filter out bad
packets when they arrive again at the victim later. The traceback scheme is carried out till
the source end is reached. We believe that this idea can be adapted to the cloud environ-
ment.
Random Flow Network Modeling: This approach adapts the theoretical concept rep-
resented by the max-flow min-cut theorem of [11] concerning flow in a network. Kong et
al. [28] rely on this theory in designing a random flow network model to mitigate DDoS
attacks. They show that this mitigation problem can be reduced to an instance of the max-
imum flow problem. We know that a DDoS attacker heavily pumps the flow of traffic
towards the sink. The strategy depends on the fact that the maximum achievable flow
value from the source to the sink is equal to the capacity of a certain cut in the flow net-
work. This method is suitable for any kind of computing environment because it does not
depend on the end infrastructure, rather it is concerned with the intermediate network
infrastructure.
Self-Cleansing Intrusion Tolerance (SCIT): SCIT [3], a method based on virtualization
technology, tries to achieve mitigation by constantly cleansing the servers and rotating the
roles of individual servers, as shown in Figure 11. We know that virtualization is a key
technique in a cloud based environment. If a server is initiated, SCIT places a pristine,
malware-free copy of the server’s operating system into a virtual machine. Any server in
the cluster switches between two modes periodically. The two modes are online servicing
of clients and offline for cleansing. To coordinate among server modes, rotations can be
performed with the help of a central controller or a distributed control mechanism using
the Cluster Communication Protocol (CCP) [22]. In the rotation process, online servers
are set offline. Afterwards, the system is rebooted to initiate cleansing procedures.
Dynamic Resource Pricing: Mankins et al. [36] discuss the applicability of dynamic

15
 Figure 11: A High-Level View of SCIT Model

resource pricing to discriminate good from bad traffic. They implement a dynamic pric-
ing strategy that favors good user behavior and punishes aggressive adversarial behavior.
They propose a distributed gateway framework and a payment protocol. The idea is to
impose dynamically changing prices on both network servers and information resources
so that the approach can push the cost of initiating service requests, in terms of monetary
payments and/or computational burdens, to requesting clients. Thus, the architecture
can provide for service quality discrimination to separate good client behavior from ad-
versarial behavior in a private cloud environment serving a large set of heterogeneous
consumers.
Intelligent Fast-Flux Swarm Network: Lua et al. [35] describe an intelligent fast-flux
swarm network to mitigate DDoS attacks. This swarm network ensures autonomous co-
ordination among nodes and allocation of swarm nodes (deploying nodes densely like
bee colonies) to perform relay operations. They use the fast-flux hosting technique, which
uses a very short Time-To-Live (TTL) parameter for any specific name record and reassigns
host names at high frequency. A load-balancing process checks the health of nodes and
removes those that are unresponsive. However, when a DDoS attack is in progress, it may
not be robust. For better optimization, they use the intelligent water drop algorithm [50].
The Intelligent Water Drop (IWD) algorithm is a nature inspired algorithm. The algorithm
mimics how water drops behave in the flow of a river, i.e., the dynamic behavior of a river.
Roaming Honeypot: Generally, honeypots are built in a network to trap malicious
attackers. In traditional deployment, honeypots are situated in fixed locations and ma-
chines. However, having fixed locations makes the security of the entire operation vul-
nerable to sophisticated attacks. Khattab et al. [26] and Sardana and Joshi [48] propose
the concept of roaming honeypots, changing the locations of the honeypots continuously
and disguising them within a server pool. A subset of servers is active and provides ser-
vice, while the rest of the server pool is idle and act as honeypots. The roaming honeypot
scheme detects attacks from outside the firewall and mitigates attacks from behind the
firewall by dropping all connections when a server switches from acting as honeypot to
become an active server. So, if we can adapt this approach to the individual private cloud
environment, a roaming honeypot may be a very good defender for that environment with
limited resources for legitimate users.
Moving Target Defense: Moving target defenses have been proposed as a way to make
it much more difficult for an attacker to exploit a vulnerable system by changing aspects
of that system to present attackers with a varying attack surface. The hope is that con-

16
 Figure 12: Dynamic Resource Allocation Strategy by Yu et al. [74]

structing a successful exploit requires analyzing properties of the system, and that in the
time it takes an attacker to learn these properties and construct the exploit, the system will
have changed enough so that by the time the attacker can launch the exploit to disrupt the
exploit’s functionality, the system has become more or less a new system [58, 59]. This ap-
proach may provide an effective defense solution in context of private cloud environment
as well.
Dynamic Resource Allocation: In addition the traditional defense approaches, we
need to explore resource allocation and utilization strategies for defending DDoS attacks
in the cloud. Yau et al. [70] contend that DDoS defense is a resource management prob-
lem. Everyday the attack patterns keep changing. It will be a fruitless waste of time
and resources to try to defend against DDoS attacks by just looking at patterns learned
earlier. In addition, it is important to not only defend against an attack but also make
services available during an attack. To beat DDoS attacks in the cloud, Yu et al. [74] pro-
pose a dynamic resource allocation procedure within an individual cloud, as shown in
Figure 12. It is a simple methodology of cloning Intrusion Prevention Servers (IPSs) from
idle resources to filter out attack packets quickly and provide general services simultane-
ously. Some other specific resource allocation approaches have been proposed as well. We
present them below.
Virtualization is a key concept in resource provisioning and management in the cloud.
Virtualization provides a view of resources used to instantiate virtual machines. Isolating
and migrating the state of a machine help improve optimization of resource allocation.
Live virtual machine migration transfers the “state" of a virtual machine from one phys-
ical machine to another, and can mitigate overload conditions and enable uninterrupted
maintenance activities. Mishra et al. [39] incorporate dynamic resource management in
a virtual environment. Their approach answers basic questions such as when to migrate,
how to migrate, types of migration and where to migrate. It also treats differently the mi-
gration of resources in different network architectures, e.g., LAN (Local Area Networks)
and WAN (Wide Area Networks).
The cloud environment can be described as probabilistic in nature. So there is a need
to assess the performance of a cloud center for resource provisioning. The probabilistic
nature of the cloud can be represented in terms of stochastic processes [17]. Shawky [52]
introduces an approach to model and analyze the performance of the resource allocation
process using stochastic process algebra.

17
 Figure 13: Defense mechanisms against DDoS attack using SDN [68]

SDN-based DDoS defense: The Software Defined Network (SDN) paradigm can be
used to provide new opportunities to integrate application provisioning in the cloud with
the network through programmable interfaces and automation [4]. The available options
in SDNs (e.g., software-based traffic analysis, logical centralized control, global view of the
network, and dynamic updating of forwarding rules) make it easy to provide detection and
reaction to DDoS attacks in cloud environments. However, the separation of the control
plane from the data plane in SDNs may introduce new attack planes.
An SDN itself may be a target of some attacks, and potential DDoS vulnerabilities exist
across SDN platforms. For example, an attacker can take advantage of the characteristics
of SDNs to launch DDoS attacks against the control layer, infrastructure layer plane and
application layer of SDNs. An attacker can infect a sufficient number of machines in a
short time frame in traditional networks. On-demand self-service capabilities of the cloud
that let legitimate businesses quickly add or subtract computing power could be used to
instantly create a powerful botnet. Attackers are also known to use cloud as malware-
as-a-service by renting different virtual machines and using them as bots. Separation of
the control plane from the data plane enables one to establish easily large-scale attack and
defense experiments. A logical centralized controller of an SDN permits a system defender
to build consistent security policies and to monitor or analyze traffic patterns for potential
security threats. A programmable intermediate network architecture can be setup easily
in on an SDN.
The cloud networks face challenges such as guaranteed performance of applications
when applications are moved from on-premise to the cloud facility, flexible deployment of
appliances (e.g., intrusion detection systems or firewalls), and security and privacy protec-
tion. An environment, providing good programmable, flexible and secure infrastructure
is needed. SDNs are evolving as the key technology that can improve cloud manageabil-
ity, scalability, controllability, and dynamism [2]. In the past few years, several innova-

18
tive SDN-based defense solutions have been introduced. These solutions belong to the
three basic types of SDN-based DDoS defense mechanisms as shown in Figure 13. In [68]
include a detailed discussion of SDNs, SDN-based clouds, and autonomous defense in
clouds. SDNs can provide a new, dynamic network architecture that can transform tradi-
tional cloud network backbones into rich service-delivery platforms.
Lin et al. [33] refer to SDNs as an emerging wave to transform network industries.
They discuss SDNs and standardization in terms of components such as controllers, appli-
cations, service chains, network function virtualization and interfaces. SDN-based clouds
are a new type cloud, in which SDN technology is used to establish control over network
infrastructure and to provide networking-as-a-service (NaaS). In such clouds, cloud com-
puting extends from server centralization and virtualization as well as storage centraliza-
tion and virtualization to network centralization and virtualization. Banikazemi et al. [4]
argue that service-level network models that provide higher-level connectivity and pol-
icy abstractions are integral parts of cloud applications. Yen and Su [71] establish that
an SDN-based cloud computing environment via open source OpenFLow switch and con-
troller packages is effective in providing load balancing, power-saving and monitoring
mechanisms.
A QoS-guaranteed approach is described in [1] for bandwidth allocation that satisfies
QoS requirements for all priority cloud users by using Open vSwitch [45] based on SDNs.
An integrated solution is described in [32] to combine two strategies, flow migration and
VM migration, to maximize throughput and minimize energy. Cziva et al. [10] present an
SDN-based framework for live VM management where server hypervisors exploit tempo-
ral network information to migrate VMs and minimize the network-wide communication
cost of the resulting traffic dynamics. In [49], authors claim that SDNs offer new opportu-
nities for network security in cloud scenarios, because an SDN-based cloud provides more
flexibility and faster reaction when the conditions are changing. Braga et al. [75] presents
a lightweight method for DDoS attack detection based on traffic flow features, in which the
extraction of such information is made with a very low overhead compared to traditional
approaches. This is possible due to the use of the NOX platform [76], which provides
a programmatic interface to facilitate the handling of switch information. Shin and Gu
[77] show a new attack to fingerprint SDN networks and further launch efficient resource
consumption attacks. This attack demonstrates that SDNs also introduce new security is-
sues that may not be ignored. Flow Table Overloading in Software-Defined Networks is a
vulnerablity to be handled carefully. Yuan et al. [78] points out this issue and provides
a security service in an SDN using QoS-aware mitigation strategy, namely, peer support
strategy, integrating the available idle flow table resource of the whole SDN system to
mitigate such an attack on a single switch of the system.
SDNs have been accepted as a new paradigm to provide an entire set of virtualization
and control mechanisms to meet defense challenges in cloud networking. Thus, explor-
ing the use of SDNs in providing better DDoS defense solutions in the cloud computing
environment is likely to be beneficial.
Big Data Analytics: Anomaly detection is essential for preventing network outages
and keeping the network resources available. However, to cope with the increasing growth
of Internet traffic, network anomaly detectors are only exposed to sampled traffic, and as a
result, harmful traffic may avoid detector examination. Fontugne et al. [79] investigate the
benefits of recent distributed computing approaches for real-time analysis of non-sampled
Internet traffic. Their study is to detect network traffic anomalies using Hadoop. They
also note that since MapReduce requires the dataset to be divided into small splits and
anomaly detectors compute statistics from spatial and temporal traffic structures, special
care should be taken when splitting traffic. They propose Hashdoop, a MapReduce frame-
work that splits traffic with a hash function to preserve traffic structures.
Vieira et al. [60] propose the Intrusion Responsive Autonomic System (IRAS) to an-
alyze real time traffic to detect intrusion and mitigate attacks in the cloud platform, as

19
 Figure 14: Intrusion Responsive Autonomic System(IRAS)

Figure 15: Traffic Cluster Analysis by [19]

shown in Figure 14. IRAS is an autonomous intrusion response technique endowed with
self-awareness, self-optimization and self-healing properties. It runs through four steps,
monitor, analyze, plan and execute to respond to the behavior patterns observed in real time
big data using knowledge-based techniques. The sensors present in the system gather the
log data from the network intrusion detection system and host systems.

20
 As the Internet evolves and the computing infrastructure changes rapidly, the types
of data being processed also evolve and change rapidly, and the complexity in structure
and size of data being generated increases. All this is happening because more processing
power produces more data at every opportunity. Researchers have coined the concept
of “Big Data" to refer to data handled by large enterprises like Google, Facebook, IBM
and so on [34]. Processing such data to gather information from a cloud network traffic
is a big task. Big data traffic is collected, examined and analyzed in high performance
servers to find interesting and useful patterns. The use of large scale distributed parallel
processing of data in the cloud environment is commonplace. For example, Lee et al. [31]
propose a method to analyze Internet traffic using the MapReduce [13] framework within
the cloud computing platform. They compare their result with Hadoop [65] and other
tools concluding 72% improvement in computational efficiency. Tripathi et al. [57] also
study characteristics of DDoS attacks in the cloud and develope a scheme to detect such
attacks in a Hadoop based environment. Lee et al. [30] also provide two algorithms to
detect DDoS attacks using packet tracing method in a MapReduce environment.
It is obviously necessary to remove DDoS attack traffic from normal traffic in the cloud
environment to reduce the burden of processing huge amounts of unwanted traffic, and to
maximize the flow of normal traffic. Govinda and Sathiyamoorthy [19] introduce a process
of clustering the traffic into different groups. These groups are flash traffic, interactive
traffic, latency sensitive traffic, non-real time traffic and unknown traffic, as shown in
Figure 15. They use Hadoop technology to analyze big data traffic. If any of these packets
is categorized as unknown traffic, it is identified as a part of DDoS attack and eliminated
by the packet analyzer.

3.1 Discussion
The approaches discussed in this section are presented compactly in Table 3. We can
summarize our discussions in the following observations.

• It is necessary to build a real time defense system, whether it is network based or

host based.

• Incorporating dynamic behavior in the solution can provide adaptability to the de-
fense.

• The discussed methods employ the tolerance approach. Thus, allocating and utiliz-
ing resources effectively can provide a good defense.

• As cloud computing systems incorporate traditional network topology and also new
resource sharing methods, defense solutions against DDoS in the individual private
cloud environment need to evolve to adapt to both.

• Resource utilization in a virtualized cloud computing environment is important. So,

resource sharing and utilization need to be smooth enough to provide services along
with security.

• In a large infrastructure network, the converging network traffic will be always high
enough for analysis. New data analysis techniques need to to be adapted for better
defense.

3.2 Recommendations
In a private cloud environment, it is possible to build an effective defense solution against
DDoS attacks. After analyzing many existing approaches, we can set some recommenda-
tions to adapt some of the discussed approaches and to develop the best feasible solutions.

21
 Table 3: Selected Approaches Handling DDoS Attacks

Authors Key Points Real- High rate/

Time Low rate
Mankins et al. [36] Implements dynamic pricing strategy in Yes Not men-
terms of payments and/or computational tioned
load of each user.
Ioannidis and Uses a router based approach to detect and Yes High Rate
Bellovin [24] drop malicious packets.
Achieves dropping of malicious packets by
limiting the rate after matching attack sig-
natures.
Kong et al. [28] Models the network flow to mitigate attacks. Yes Not
Expresses DDoS attacks in terms of max- mentioned
flow min cut theorem [11].
Wang et al. [62] Provides minimal services to legitimate Yes Not men-
users in the critical moments during an at- tioned
tack.
Use a dynamic fault tolerance architecture is
to achieve the goal.
Khattab et al. [26] Introduces a roaming honeypot technique to Yes High rate
continuously disguise servers from the at-
tacker, changing locations.
Provide general service using a subset of the
servers and the rest of the idle servers act as
honeypots.
Detects the attack and tries mitigation.
Yauet al. [70] Throttles the traffic at upstream routers to Yes High rate
forestall an impending attack.
Uses k-level max-min fairness theory.

Chen et al. [8] Requests upstream routers of victim to mark Yes Does not
malicious packets for traceback.
Drops attack packets at the source end using depend on
traceback. rate
Bangalore and Sood Uses virtualization technology, cleansing Yes Does not
[3] and changing roles of servers to achieve mit- depend on
igation. rate
Reduces the server exposure time to net-
work.
Lua and Yow [35] Uses an intelligent fast-flux swarm network Yes Does not
and adapts the intelligent water drop algo- depend on
rithm of [50].
Performs load balancing for optimization. rate
Lee et al. [30] Traces packet tracing in MapReduce envi- Yes Flow/Rate
ronment. analysis
Yu et al. [74] Uses dynamic resource allocation policy. Yes Does not
Perform reallocation or deallocation of re- depend on
sources for the intrusion prevention server rate
based on the time required to compute and
respond to each request packet.

22
 Authors Key Points Real- High rate /
Time Low rate
Tripathi et al. [57] Analyzes DDoS attack traffic patterns in the Yes Not men-
cloud environment. tioned
Perform detection of attacks in Hadoop en-
vironment.
Vieira et al. [60] Analyzes big data in real time to mitigate at- Yes Not men-
tacks in the cloud environment. tioned
Govinda and Provides a clustering technique on big data Yes Traffic anal-
Sathiyamoorthy in the cloud environment to group different ysis
[19] types of traffic.
Eliminates packets that are categorized as
unknown traffic, by marking as DDoS at-
tack.

The cloud environment should have a dynamic firewall to detect abnormal changes in net-
work traffic in real time. Like, SDN based solution can provide dynamic, cost-effective,
adaptability and suitability for high bandwidth. If a preventive measure can work in co-
operation with routers near the source router, the defense is likely to be stronger. We can
explicitly reprogram all the cooperating routers to create centralized or distributed de-
fense using SDN paradigm according to our need. This way we may be able to trace back
the source of the attack or provide a defense as near as possible towards the source-end.
SDN controller applications are mostly deployed in large-scale scenarios. A huge attack of
size in terabit per second need to defend in cloud environment. A distributed and coop-
erative agent-based DDoS tolerant architecture can help counter that kind of huge DDoS
attacks in real time.

4 Challenges and Issues

A service provider usually has an adequate amount resources for specific service seek-
ers. The sophistication of cloud architectures and virtualized abstraction of the resources
have introduced issues and challenges in deploying effective design solutions to defend
against DDoS attacks suitable for individual private cloud platforms. In a private cloud,
customers share computing and store resources paying on a per use or subscription ba-
sis, and so frequent DDoS attacks can jeopardize the entire operation. There are a few
challenges and issues to be addressed to make effective use of the cloud when defending
against DDoS attacks.

• For a cyber defense tool, effectiveness should be measured in terms of time taken
and accuracy of detection obtained in real time. If not addressed properly before
deployment and thoroughly tested, lack of efficient performance can be a roadblock
to large-scale adoption of any real-time defense mechanism. This is especially true
in our case because the architecture of the cloud demands a different DDoS defense
model rather than a traditional one in a general network.

• Vulnerability or flaws in protocol or policy in the cloud environment is another major

reason for flooding DDoS attacks. A mitigation technique for flooding attacks must
take into account system and protocol design to ensure an effective and successful
implementation.

• All cloud users share the same pool of resources. This makes it absolutely essential to
start with requirements that ensure reliability, security and separation issues from

23
 Figure 16: A Generic Cloud Based Defense Framework

the outset. This has not been well considered in traditional DDoS attack defense.
The service provider must ensure that its DDoS attack defense operations neither
affect nor are affected by other cloud activities.

• If the cloud provider has only the resources required to provide services to its cus-
tomers but not much more to defend, this may encourage undesirable DDoS attacks
if attackers can guess the situation. This way, the system could give out inflated
statistics to the outside world.

• In a private cloud environment, defending against a DDoS attack is more about re-
source management. The challenge is to be able to perform rapid re-allocation or
use a dynamic network topology. It may make the attack traffic more difficult to
handle because the defense mechanism may need to update the network by chang-
ing physical locations of virtual machines. We need to build the defense strategy
keeping in mind that live migration technology [9] enables faster execution of the
needs imposed by the strategy.

• Skillful resource allocation and virtual machine migration lead to frequent topo-
logical changes in the network from the defender’s viewpoint. Such resource allo-
cation and virtual machine migration processes are fast-paced. Thus, an approach
to defense against DDoS attacks must be able to adapt to a dynamic network with
frequent topological changes and still maintain high detection rate and prompt re-
action capability. In other words, a successful defense mechanism must be dynamic
and adaptive.

• It is necessary to detect an attack quickly with minimal required information to re-

duce communication overhead. Quick detection of an attack ensures that the next
phase of mitigating the attack can avail itself of the time and resources needed in
a dynamic framework. The detection algorithm needs to match its speed with the
packet forwarding scheme used in the cloud technology. Using a traditional detec-
tion mechanism like signature-based or anomaly-based approaches or using both,
the issue may be addressed.

24
 • There are no common characteristics among traffic streams comprising various at-
tacks. Patterns for different attacks are different. It is obvious that one cannot build
defensive approaches for each type of attack in a private cloud with a particular
amount of resource dedicated to each attack. Thus, it is important to build a generic
architecture to defend against most types of DDoS attacks.

• No security precautions can guarantee that a system will never be intruded and so at
the critical moment when the system is designed, applications still need to provide
minimal services to the legitimate users even under active attacks or when partially
compromised.

5 A Generic Framework
Based on the recommendations presented earlier, we believe that an automatic host based
approach emphasizing tolerance can provide better utilization of resources in the cloud
environment to respond to DDoS attacks in an individual private cloud. With limited
resources, it is necessary to develop a procedure to defend against DDoS attacks and to
provide general service. A generic conceptual framework is shown in Figure 16. It is
a combination of different phases and components. The whole defense module is just
a conceptual depiction of cloud based defense solution against DDoS attacks adapting
concepts borrowed from existing techniques, adapted to a new environment. Detection
and prevention phases of this framework incorporate some ideas of the traditional Internet
and also tolerance techniques to the cloud environment. The framework, that we discuss
below, abides by the recommendations discussed previously.

(i) Detection Phase: In this phase, the monitor component analyzes the behavior of the
traffic coming to a responding server which handles incoming requests. If the incom-
ing traffic shows any abnormality, the monitor catches it automatically and sends an
alert message to the resource allocator. The alert message contains the threat level,
how to act to tackle the abnormality and when to initiate the migration stage. The
monitor will also communicate with the prevention component with alert messages
about the incoming traffic. This component needs to detect abnormal changes in
network traffic in real time.

(ii) Tolerance Phase: In this phase, we can utilize the resources effectively using an virtu-
alizaton technique available in the cloud environment. For example, the data center
or the private cloud provider has the ability to provide the resources to users using
virtualization. So, the utilization of the resources should be appropriate for the se-
curity needed in a crisis situation since resources are always limited in private cloud
environment.

– The resource allocator maintains a queue of fresh server copies to provide ser-
vices that must be rendered by the responding server. Depending on the level
of the alert message, it tries to maintain a dynamic queue of spare resources to
fight back if a rapid change in service demands occur because of any high traffic
attack. It can also push unnecessary resources back to the resource pool when
the state becomes normal.
– A responding server may be detached from service depending on two things,
time and computation load. A server needs to be exposed only for a limited
amount of time and if the computation load exceeds a threshold level due to
malicious activity, it can be switched to inactive status. Before switching, using
live migration we can copy the necessary states of the server to an incoming
fresh server so that the usual services can be resumed with minimum delay.

25
 (iii) Prevention Phase: If a preventive measure can work in cooperation with routers
near the source router, the defense is likely to be stronger. An adaptive and dynamic
mapping intrusion response system for effective prevention of DDoS attacks in real
time is essential. In the prevention phase, alert messages coming from the detection
component need to be analyzed and correlated to discover patterns or strategy in
attacks. Using these, we can filter out matching incoming packets later with a low
false positive rate. If the traffic flow is high, the amount of alert messages may be
high enough to analyze. In such a situation, we need to use newly developed data
analysis techniques, such as big data analytics to analyze the patterns.

6 Conclusion and Future Work

We can definitely say that in the near future, most computing activities and resources will
migrate to the cloud and security will be a prime concern. DDoS attacks may be resisted
with generic solutions to survive and to provide best services under the circumstances.
However, to be successful, more than the usual is necessary in the cloud context. In this
paper, we have discussed issues in handling DDoS attacks, specifically in a private cloud
environment. We have highlighted issues and challenges faced in the private cloud envi-
ronment when providing defense solutions against DDoS attacks. Some useful approaches
developed by researchers to address these issues have been presented and analyzed in this
paper. The importance of mitigating the attack by tolerating it and by optimized use of
resources in the private cloud scenario has been emphasized. Finally, the role of big data
analytics in defending DDoS attacks in the cloud has been introduced.
In the near future, we plan to deploy the conceptual cloud framework in a testbed to
demonstrate and analyze the effectiveness of our proposed solutions. It is important to
know how far this framework can resolve different issues and challenges when defending
against DDoS attacks in an individual private cloud environment.

References
[1] Anand V. Akella and Kaiqi Xiong. Quality of service (qos)-guaranteed network re-
source allocation via software defined networking (sdn). In: 12th International Con-
ference on Dependable, Autonomic and Secure Computing (DASC), IEEE , Dalian, China,
pp. 7–13, 2014.

[2] Siamak Azodolmolky, Philipp Wieder, and Ramin Yahyapour. Sdn-based cloud com-
puting networking. In: 15th International Conference on Transparent Optical Networks
(ICTON), IEEE, Cartagena, Spain, pp. 1–4, 2013.

[3] Anantha K. Bangalore and Arun K. Sood. Securing web servers using self cleans-
ing intrusion tolerance (scit). In: Second International Conference on Dependability,
DEPEND’09, IEEE, Athens/Glyfada, Greece, pp. 60–65. 2009.

[4] Mohammad Banikazemi, David Olshefski, Ali Shaikh, John Tracey, and Guohui
Wang. Meridian: an sdn platform for cloud network services. Communications Maga-
zine, IEEE, 51(2):120–127, 2013.

[5] Rohit Bhadauria, Rituparna Chaki, Nabendu Chaki, and Sugata Sanyal. A survey on
security issues in cloud computing. IEEE Communications Surveys & Tutorials, pp.
1–15, 2011.

[6] Dhruba K. Bhattacharyya and Jugal K. Kalita. Network anomaly detection: A machine
learning perspective. CRC Press, 2013.

26
[7] Sivadon Chaisiri, Bu S. Lee, and Dusit Niyato. Optimization of resource provision-
ing cost in cloud computing. IEEE Transactions on Services Computing, 5(2):164–177,
2012.

[8] Ruiliang Chen, Jung-Min Park, and Randolph Marchany. A divide-and-conquer strat-
egy for thwarting distributed denial-of-service attacks. IEEE Transactions on Parallel
and Distributed Systems, 18(5):577–588, 2007.

[9] Christopher Clark, Keir Fraser, Steven Hand, Jacob G. Hansen, Eric Jul, Christian
Limpach, Ian Pratt, and Andrew Warfield. Live migration of virtual machines. In:
Proceedings of the 2nd conference on Symposium on Networked Systems Design & Imple-
mentation, USENIX Association, Berkeley, CA, USA, 2:273–286, 2005.

[10] Richard Cziva, David Stapleton, Fung P. Tso, and Dimitrios P. Pezaros. Sdn-based
virtual machine management for cloud data centers. In: IEEE 3rd International Con-
ference on Cloud Networking (CloudNet), Luxembourg City, Luxembourg, pp. 388–394,
2014.

[11] G Dantzig and Delbert R. Fulkerson. On the max flow min cut theorem of networks.
Linear inequalities and related systems, 38:225–231, 2003.

[12] Marwan Darwish, Abdelkader Ouda, and Luiz F. Capretz. Cloud-based ddos attacks
and defenses. In: International Conference on Information Society (i-Society), IEEE, pp.
67–71, 2013.

[13] Jeffrey Dean, and Sanjay Ghemawat. Mapreduce: simplified data processing on large
clusters. Communications of the ACM, 51(1):107–113, 2008.

[14] Rup K. Deka, Kausthav P. Kalita, Dhruba K. Bhattacharya, and Jugal K. Kalita. Net-
work defense: Approaches, methods and techniques. Journal of Network and Computer
Applications, 57:71–84, 2015.

[15] Rashmi V. Deshmukh, and Kailas K. Devadkar. Understanding ddos attack & its effect
in cloud environment. Procedia Computer Science, 49:202–210, 2015.

[16] Dnssec. Dnssec: Dns security extensions securing the domain name system,2013.

[17] Joseph L. Doob. Stochastic processes, volume 101. New York Wiley, 1953.

[18] MARJZ Fabian and Monrose A. Terzis. My botnet is bigger than yours (maybe, better
than yours): why size estimates remain challenging. In: Proceedings of the 1st USENIX
Workshop on Hot Topics in Understanding Botnets, Cambridge, USA, 2007.

[19] K Govinda and E Sathiyamoorthy. Secure traffic management in cluster environment

to handle ddos attack. World Applied Sciences Journal, 32(9):1828–1834, 2014.

[20] Jitender Grover and Mohit Sharma. Cloud computing and its security issues—a re-
view. In: International Conference on Computing, Communication and Networking Tech-
nologies(ICCCNT), IEEE, Hefei, China, pp. 1–5, 2014.

[21] Nazrul Hoque, Monowar H. Bhuyan, Ram C. Baishya, Dhruba K. Bhattacharyya, and
Jugal K. Kalita. Network attacks: Taxonomy, tools and systems. Journal of Network
and Computer Applications, 40:307–324, 2014.

[22] Yih Huang, David Arsenault, and Arun Sood. Scit-dns: Critical infrastructure pro-
tection through secure dns server dynamic updates. Journal of High Speed Networks,
15(1):5–20, 2006.

27
[23] Joseph Idziorek, Mark F. Tannian, and Doug Jacobson. The insecurity of cloud utility
models. IT Professional, 15(2):22–27, 2013.

[24] John Ioannidis and Steven M. Bellovin. Implementing pushback: Router-based de-
fense against ddos attacks. 2002.

[25] Min S. Kang, Soo B. Lee, and Virgil D. Gligor. The crossfire attack. In: IEEE Sympo-
sium on Security and Privacy (SP), pp. 127–141, 2013.

[26] Sherif M. Khattab, Chatree Sangpachatanaruk, Daniel Mossé, Rami Melhem, and
Taieb Znati. Roaming honeypots for mitigating service-level denial-of-service at-
tacks. In: Proceedings of 24th International Conference on Distributed Computing Sys-
tems, IEEE, Tokyo , Japan, pp. 328–337, 2004.

[27] Md. Tanzim Khorshed, A. B. M Shawkat Ali, and Saleh A. Wasimi. A survey on gaps,
threat remediation challenges and some thoughts for proactive attack detection in
cloud computing. Future Generation computer systems, 28(6):833–851, 2012.

[28] Jiejun Kong, Mansoor Mirza, James Shu, Christian Yoedhana, Mario Gerla, and
Songwu Lu. Random flow network modeling and simulations for ddos attack mitiga-
tion. In: IEEE International Conference on Communications, ICC’03, Anchorage, Alaska,
USA, 1:487–491, 2003.

[29] Felix Lau, Stuart H. Rubin, Michael H. Smith, and Ljiljana Trajković. Distributed
denial of service attacks. In: International Conference on Systems, Man, and Cybernetics,
IEEE, Nashville, Tennessee, 3:2275–2280, 2000.

[30] Yeonhee Lee, Wonchul Kang, and Youngseok Lee. A hadoop-based packet trace process-
ing tool. Springer, 2011.

[31] Youngseok Lee, Wonchul Kang, and Hyeongu Son. An internet traffic analysis
method with mapreduce. In: Network Operations and Management Symposium Work-
shops (NOMS Wksps), IEEE/IFIP, Osaka , China, pp. 357–361, 2010.

[32] Wei C. Lin, Chien H. Liao, Kuan T. Kuo, and Charles H-P Wen. Flow-and-vm migra-
tion for optimizing throughput and energy in sdn-based cloud datacenter. In: IEEE
5th International Conference on Cloud Computing Technology and Science (CloudCom),
IEEE, Bristol, United Kingdom, 1:206–211, 2013.

[33] Ying D. Lin, Dan Pitt, David Hausheer, Erica Johnson, and Yi-Bing Lin. Software-
defined networking: Standardization for cloud computing’s second wave. Computer,
47(11):19–21, 2014.

[34] Steve Lohr. The age of big data. New York Times, 11, 2012.

[35] Ruiping Lua and Kin C. Yow. Mitigating ddos attacks with transparent and intelligent
fast-flux swarm network. Network, IEEE, 25(4):28–33, 2011.

[36] David Mankins, Rajesh Krishnan, Ceilyn Boyd, John Zao, and Michael Frentz. Miti-
gating distributed denial of service attacks with dynamic resource pricing. In: Pro-
ceedings of 17th Annual Conference on Computer Security Applications, ACSAC’01, IEEE,
Sheraton New Orleans. Louisiana, USA, pp. 411–421, 2001.

[37] Rui Miao, Rahul Potharaju, Minlan Yu, and Navendu Jain. The dark menace: Charac-
terizing network-based attacks in the cloud. In: Proceedings of the ACM Conference on
Internet Measurement Conference, ACM, pp. 169–182, 2015.

[38] Jelena Mirkovic and Peter Reiher. A taxonomy of ddos attack and ddos defense mech-
anisms. ACM SIGCOMM Computer Communication Review, 34(2):39–53, 2004.

28
[39] Mayank Mishra, Anwesha Das, Purushottam Kulkarni, and Anirudha Sahoo. Dy-
namic resource management using virtual machine migrations. Communications
Magazine, IEEE, 50(9):34–40, 2012.

[40] Chirag Modi, Dhiren Patel, Bhavesh Borisaniya, Hiren Patel, Avi Patel, and Muttukr-
ishnan Rajarajan. A survey of intrusion detection techniques in cloud. Journal of
Network and Computer Applications, 36(1):42–57, 2013.

[41] Dritan Nace and Michal Pióro. Max-min fairness and its applications to routing and
load-balancing in communication networks: a tutorial. IEEE Communications Surveys
& Tutorials, 10(4):5–17, 2008.

[42] Quyen L Nguyen and Arun Sood. A comparison of intrusion-tolerant system archi-
tectures. IEEE Security & Privacy, 9(4):24–31, 2011.

[43] Chunyi Peng, Minkyong Kim, Zhe Zhang, and Hui Lei. Vdn: Virtual machine im-
age distribution network for cloud data centers. In: Proceedings of INFOCOM, IEEE,
Orlando, FL, USA, pp. 181–189, 2012.

[44] Tao Peng, Christopher Leckie, and Kotagiri Ramamohanarao. Survey of network-
based defense mechanisms countering the dos and ddos problems. ACM Computing
Surveys (CSUR), 39(1):3, 2007.

[45] Ben Pfaff and Bruce Davie. The open vswitch database management protocol. 2013.

[46] Nikolaos Pitropakis, Eleni Darra, Nikos Vrakas, and Costas Lambrinoudakis. It’s all
in the cloud: Reviewing cloud security. In: 10th International Conference on Autonomic
and Trusted Computing (UIC/ATC) Ubiquitous Intelligence and Computing, IEEE, pp.
355–362, 2013.

[47] Farzad Sabahi. Cloud computing security threats and responses. In: 3rd International
Conference on Communication Software and Networks (ICCSN), IEEE , Xi’an, China, pp.
245–249, 2011.

[48] Anjali Sardana and Ramesh Joshi. An auto-responsive honeypot architecture for dy-
namic resource allocation and qos adaptation in ddos attacked networks. Computer
Communications, 32(12):1384–1399, 2009.

[49] Sebastian Seeber and Gabi Dreo Rodosek. Improving network security through sdn in
cloud scenarios. In: 10th International Conference on Network and Service Management
(CNSM), IEEE, Rio de Janeiro, Brazil, pp. 376–381, 2014.

[50] Hamed Shah-Hosseini. The intelligent water drops algorithm: a nature-inspired

swarm-based optimization algorithm. International Journal of Bio-Inspired Compu-
tation, 1(1):71–79, 2009.

[51] Seyed K. Fayaz, Yoshiaki Tobioka, Vyas Sekar, and Michael Bailey. Bohatei: Flexible
and elastic ddos defense. In: Usenix Security, pp. 817–832, 2015.

[52] Doaa M. Shawky. Performance evaluation of dynamic resource allocation in cloud

computing platforms using stochastic process algebra. In: 8th International Confer-
ence on Computer Engineering & Systems (ICCES), IEEE, Cairo, Egypt, pages 39–44,
2013.

[53] Gaurav Somani, Manoj S. Gaur, and Dheeraj Sanghi. Ddos/edos attack in cloud: af-
fecting everyone out there!. In: Proceedings of the 8th International Conference on Secu-
rity of Information and Networks, ACM, pp. 169–176, 2015.

29
[54] Mohammed H. Sqalli, Fahd Al-Haidari, and Khaled Salah. Edos-shield-a two-steps
mitigation technique against edos attacks in cloud computing. In: Fourth IEEE Inter-
national Conference on Utility and Cloud Computing (UCC), Melbourne, Australia, pp.
49–56, 2011.

[55] Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski,
Richard Kemmerer, Christopher Kruegel, and Giovanni Vigna. Your botnet is my
botnet: analysis of a botnet takeover. In: Proceedings of the 16th ACM conference on
Computer and communications security, Chicago, IL, USA, pp. 635–647, 2009.

[56] Subashini Subashini and V. Kavitha. A survey on security issues in service delivery
models of cloud computing. Journal of network and computer applications, 34(1):1–11,
2011.

[57] Shweta Tripathi, Brij Gupta, Ammar Almomani, Anupama Mishra, and Suresh
Veluru. Hadoop based defense solution to handle distributed denial of service(ddos)
attacks. Journal of Information Security, 4(3):150, 2013.

[58] Joseph D. Touch, Gregory G. Finn, Yu-Shun Wang, and Lars Eggert. Dynabone: Dy-
namic defense using multi-layer internet overlays. In: DISCEX, (2):271–276, 2003.

[59] Sridhar Venkatesan, Massimiliano Albanese, Kareem Amin, Sushil Jajodia, and Ma-
son Wright. A moving target defense approach to mitigate ddos attacks against proxy-
based architectures. In: IEEE Conference on Communications and Network Security,
2016.

[60] Kleber M. M. Vieira, Fernando Schubert, Guilherme A. Geronimo, Rafael

d. S. Mendes, and Carlos B. Westphall. Autonomic intrusion detection system in
cloud computing with big data.In: Proceedings of the International Conference on Secu-
rity and Management (SAM), The Steering Committee of The World Congress in Computer
Science, Computer Engineering and Applied Computing (WorldComp), Las Vegas, USA,
pp. 1, 2014.

[61] Thomas Vissers, Tom V. Goethem, Wouter Joosen, and Nick Nikiforakis. Maneuver-
ing around clouds: Bypassing cloud-based security providers. In: Proceedings of the
22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1530–
1541, 2015.

[62] Feiyi Wang, Frank Jou, Fengmin Gong, Chandramouli Sargor, Katerina Goseva-
Popstojanova, and Kishor Trivedi. Sitar: A scalable intrusion-tolerant architecture
for distributed services. In: Foundations of Intrusion Tolerant Systems, IEEE Computer
Society, pp. 359–359, 2003.

[63] Haiyang Wang, Feng Wang, Jiangchuan Liu, and Justin Groen. Measurement and
utilization of customer-provided resources for cloud computing. In: Proceedings on
INFOCOM, IEEE, Orlando, FL, USA, pp. 442–450, 2012.

[64] Qian Wang, Kui Ren, and Xiaoqiao Meng. When cloud meets ebay: Towards effective
pricing for cloud computing. In: Proceedings on INFOCOM, IEEE, Orlando, FL, USA,
pp. 936–944, 2012.

[65] Tom White. Hadoop: the definitive guide: the definitive guide, O’Reilly Media, Inc., 2009.

[66] FuiFui Wong and Cheng Xiang Tan. A survey of trends in massive ddos attacks and
cloud-based mitigations. International Journal of Network Security & Its Applications
(IJNSA), 6(3):57–71, 2014.

30
[67] Yang Xiang, Ke Li, and Wanlei Zhou. Low-rate ddos attacks detection and traceback
by using new information metrics. IEEE Transactions on Information Forensics and Se-
curity, 6(2):426–437, 2011.
[68] Qiao Yan, F. Richard Yu, Qingxiang Gong, and Jianqiang Li. Software-defined net-
working (sdn) and distributed denial of service (ddos) attacks in cloud computing
environments: A survey, some research issues, and challenges. IEEE Communications
Surveys & Tutorials, 18(1):602–622, 2016.
[69] Qiao Yan and F Richard Yu. Distributed denial of service attacks in software-defined
networking with cloud computing. IEEE Communications Magazine, 53(4):52–59,
2015.
[70] David K. Y. Yau, John Lui, Feng Liang, and Yeung Yam. Defending against distributed
denial-of-service attacks with max-min fair server-centric router throttles. IEEE/ACM
Transactions on Networking (TON), 13(1):29–42, 2005.
[71] Tseng C. Yen and Chi S. Su. An sdn-based cloud computing architecture and its
mathematical model. In: International Conference on Information Science, Electronics
and Electrical Engineering(ISEEE), Sapporo, Japan, 3:1728–1731, 2014.
[72] Sangho Yi, Artur Andrzejak, and Derrick Kondo. Monetary cost-aware checkpointing
and migration on amazon cloud spot instances. IEEE Transactions on Services Com-
puting, 5(4):512–524, 2012.
[73] Shui Yu, Wanlei Zhou, Weijia Jia, Song Guo, Yong Xiang, and Feilong Tang. Dis-
criminating ddos attacks from flash crowds using flow correlation coefficient. IEEE
Transactions on Parallel and Distributed Systems, 23(6):1073–1080, 2012.
[74] Shui Yu, Yonghong Tian, Song Guo, and Dapeng O. Wu. Can we beat ddos attacks in
clouds? IEEE Transactions on Parallel and Distributed Systems, 25(9):2245–2254, 2014.
[75] Rodrigo Braga, Edjard Mota, and Alexandre Passito. Lightweight ddos flooding attack
detection using nox/openflow. In: IEEE 35th Conference on Local Computer Networks
(LCN), pp. 408–415, 2010.
[76] Natasha Gude, Teemu Koponen, Justin Pettit, Ben Pfaff, Martín Casado, Nick McKe-
own, and Scott Shenker. Nox: towards an operating system for networks. ACM SIG-
COMM Computer Communication Review, 38(3):105–110, 2008.
[77] Seungwon Shin and Guofei Gu. Attacking software-defined networks: A first feasi-
bility study. In: Proceedings of the second ACM SIGCOMM workshop on Hot topics in
software defined networking, pp. 165–166, 2013.
[78] Bin Yuan, Deqing Zou, Shui Yu, Hai Jin, Weizhong Qiang, and Jinan Shen. Defending
against flow table overloading attack in software-defined networks. IEEE Transactions
on Services Computing, 2016.
[79] Romain Fontugne, Johan Mazel, and Kensuke Fukuda. Hashdoop: A mapreduce
framework for network anomaly detection. In: IEEE Conference on Computer Com-
munications Workshops (INFOCOM WKSHPS), pp. 494–499, 2014.
[80] Zahid Anwar and Asad W. Malik. Can a ddos attack meltdown my data center? A
simulation study and defense strategies. IEEE Communications Letters, 18(7):1175–
1178, 2014.
[81] Zhizhong Zhang, Chuan Wu, and David WL Cheung. A survey on cloud interoper-
ability: taxonomies, standards, and practice. ACM SIGMETRICS Performance Evalua-
tion Review, 40(4):13–22, 2013.

31