Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud

Wei ZENG; Hongchao HU; Lingshu LI; Shumin HUO

doi:10.11959/j.issn.2096-109x.2021063

您当前的位置：

首页 >

文章列表页 >

Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud

TopicⅡ: SDN and cloud computing security | 更新时间：2024-06-03

- Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud
- Chinese Journal of Network and Information Security Vol. 7, Issue 3, Pages: 95-104(2021)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021063
  CLC：
- Online First：2021-06，
  
  Published：15 June 2021
- 稿件说明：
移动端阅览
Wei ZENG, Hongchao HU, Lingshu LI, et al. Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 95-104.
DOI：

Wei ZENG, Hongchao HU, Lingshu LI, et al. Dynamic heterogeneous scheduling method based on Stackelberg game model in container cloud[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 95-104. DOI： 10.11959/j.issn.2096-109x.2021063.

摘要

容器技术以其灵活、高效的特性促进了云计算的快速发展，但同时引入了如同驻攻击、逃逸攻击和共模攻击等安全威胁。针对这些安全威胁，提出一种容器云中基于 Stackelberg 博弈的动态异构式调度方法。首先，构建异构镜像资源池以抑制云上基于共模漏洞的攻击扩散；进而，将攻防交互过程建模为Stackelberg博弈模型；最后，对攻防模型进行分析，将系统调度问题建模为混合整数非线性规划问题以求解系统最优调度策略。实验证明，所提方法能够提升云平台的防御效果，降低系统防御开销。

Abstract

Container technology promotes the rapid development of cloud computing with its flexible and efficient features

but it also introduces security threats such as co-resident attacks

escape attacks

and common mode attacks.In response to these security threats

a dynamic heterogeneous scheduling method based on Stackelberg game in the container cloud was proposed.First

a heterogeneous mirrored resource pool is constructed to suppress the spread of attacks based on common-mode vulnerabilities on the cloud.Then

the offensive and defense interaction process is modeled as a Stackelberg game model.Finally

the offensive and defensive model is analyzed

and the system scheduling problem is modeled as a mixed integer non-linear programming problem to solve the system's optimal scheduling strategy.Experiments show that the proposed method can improve the defense effect of the cloud platform and reduce the system defense overhead.

关键词

Keywords

references

JITHIN R , CHANDRAN P . Virtual machine isolation [C ] // International Conference on Security in Computer Networks and Distributed Systems . 2014 .

JIN H , LI Z , ZOU D , et al . DSEOM:a framework for dynamic security evaluation and optimization of MTD in container-based cloud [J ] . IEEE Transactions on Dependable and Secure Computing , 2019 ,( 99 ): 1 - 1 .

CHOWDHARY A , . Adaptive MTD security using Markov game modeling [C ] // 2019 International Conference on Computing,Networking and Communications (ICNC) . 2019 : 577 - 581 .

WANG J W , ZHANG X L , LI Q , et al . Network function virtualization technology:a survey [J ] . Chinese Journal of Computers , 2019 , 42 ( 2 ): 415 - 436 .

LI S Y , LI Q , LI B . Research on isolation of container based on docker technology [J ] . Computer engineering ＆ Software , 2015 ,( 4 ): 110 - 113 .

ABDELRAHEM O , BAHAA-ELDIN A M , TAHA A . Virtualization security:a survey [C ] // International Conference on Computer Engineering ＆ Systems . 2016 : 32 - 40 .

ZHENG Z . Virtual machine security isolation and protection based on cloud platform [J ] . China Computer ＆ Communication , 2018 , 417 ( 23 ): 174 - 177 .

AZAB M , . Toward smart moving target defense for Linux container resiliency [C ] // 2016 IEEE 41st Conference on Local Computer Networks (LCN) . 2016 : 619 - 622 .

HUANG R , . RELOCATE:a container based moving target defense approach [C ] // Proceedings of The 7th International Conference on Computer Engineering and Networks — PoS(CENet2017) . 2017 :8.

SARKALE V V , RAD P , LEE W . Secure cloud container:runtime behavior monitoring using most privileged container (MPC) [C ] // IEEE International Conference on Cyber Security ＆Cloud Computing . 2017 : 351 - 356 .

杨爽 . 基于改进遗传算法的动态虚拟机调度策略研究 [D ] . 哈尔滨:哈尔滨工程大学 , 2019 .

YANG S . Research on dynamic virtual machine scheduling strategy based on improved genetic algorithm [D ] . Harbin:Harbin Engineering University , 2019 .

TONG K , LIMING W , ZHEN X , et al . Design of a container-based security cloud computing platform [J ] . e-Science Technology ＆ Application , 2017 , 8 ( 1 ): 10 - 18 .

蔡雨彤 , 常晓林 , 石禹 , 等 . 动态平台技术防御攻击的瞬态效能量化分析 [J ] . 信息安全学报 , 2019 ,( 4 ): 59 - 67 .

CAI Y T , CHANG X L , SHI Y , et al . Quantitative analysis of transient effectiveness of dynamic platform technology in defense against attacks [J ] . Journal of Information Security , 2019 ,( 4 ): 59 - 67 .

ZHANG Y . Cost-effective migration-based dynamic platform defense technique:a CTMDP approach [J ] . Peer-to-Peer Networking and Applications , 2021 : 1 - 11 .

SOUROUR D , . Platform moving target defense strategy based on trusted dynamic logical heterogeneity system [C ] // Proceedings of the 2019 International Conference on Artificial Intelligence 1and Computer Science . 2019 : 643 - 648 .

CAI Z Y , XIE X L . An improved container cloud resource scheduling strategy [C ] // Proceedings of the 2019 4th International Conference on Intelligent Information Processing . 2019 : 383 - 387 .

XIAO Z , JIANG J , ZHU Y , et al . A solution of dynamic VMs placement problem for energy consumption optimization based on evolutionary game theory [J ] . Journal of Systems ＆ Software , 2015 , 101 ( 3 ): 260 - 272 .

HASAN M G M M , RAHMAN M A . Protection by detection:a signaling game approach to mitigate co-resident attacks in cloud [C ] // Proc IEEE 10th Int Conf Cloud Comput (CLOUD) , 2017 : 552 - 559 .

LEI C , ZHANG H Q , WAN L M , et al . Incomplete information Markov game theoretic approach to strategy generation for moving target defense [J ] . Computer Communications , 2018 , 116 ( 1 ): 184 - 199 .

季新生 , 徐水灵 , 刘文彦 , 等 . 一种面向安全的虚拟网络功能动态异构调度方法 [J ] . 电子与信息学报 , 2019 , 41 ( 10 ).

JI X S , XU S L , LIU W Y , et al . A security-oriented dynamic heterogeneous scheduling method of virtual network functions [J ] . Journal of Electronics ＆ Information Technology , 2019 , 41 ( 10 ).

HAN Y , CHAN J , ALPCAN T , et al . Using virtual machine allocation policies to defend against co-resident attacks in cloud computing [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2017 , 14 ( 1 ): 95 - 108 .

ALNAIM A , ALWAKEEL A , FERNANDEZ E B . A misuse pattern for compromising VMs via virtual machine escape in NFV [C ] // The 14th International Conference . 2019 : 1 - 6 .

WU J . An access control model for preventing virtual machine escape attack [J ] . Future Internet , 2017 , 9 ( 2 ): 20 .

王禛鹏 . 拟态网络操作系统调度与裁决机制研究及实现 [D ] . 郑州：信息工程大学 , 2017 .

WANG Z P . Research and implementation of mimic network operating system scheduling and adjudication mechanism [D ] . Zhengzhou:Information Engineering University , 2017 .

WU M GUAN H , ZANG B , et al . POSTER:quantitative security assessment method based on entropy for moving target defense [J ] . ACM SIGPLAN Notices , 2017 , 52 ( 8 ): 457 - 458 .

GARCIA M . Analysis of operating system diversity for intrusion tolerance [J ] . Software-Practice and Experience , 2014 , 44 ( 6 ): 735 - 770 .

张杰鑫 , 庞建民 , 张铮 . 拟态构造的 Web 服务器异构性量化方法 [J ] . 软件学报 , 2020 ( 2 ): 564 - 577 .

ZHANG J X , PANG J M , ZHANG Z . Quantification method for heterogeneity on Web server with mimic construction [J ] . Journal of Software , 2020 ( 2 ): 564 - 577 .

PARUCHURI P , PEARCE J P , TAMBLE M , et al . An efficient heuristic approach for security against multiple adversaries [C ] // Proc 6th Int Joint Conf Auton Agents Multiagent Syst . 2007 : 1 - 8 .

PARUCHURI P , PEARCE J P , MARECKI J , et al . Playing games for security:An efficient exact algorithm for solving Bayesian Stackelberg games [C ] // Proc 7th Int Joint Conf Auton Agents Multiagent Syst . 2008 : 895 - 902 .

PLADD:deterring attacks on cyber systems and moving target defense [P ] . 2017 .

IBM Ins . CPLEX optimization studio 12.10 [EB ] . 2019

Views

617

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research progress on dynamic hopping technology for network layer

Moving target defense against adversarial attacks

Improve the robustness of algorithm under adversarial environment by moving target defense

Research progress on moving target defense for SDN

Risk assessment method for network attack surface based on Bayesian attack graph

Related Author

Guozhen CHENG

Shumin HUO

Jinglei TAN

Jie NIU

Fucai CHEN

Weizhen HE

Yaguan QIAN

Bin WANG

Related Institution

Information Engineering University

Unit 61212 of the Chinese People's Liberation Army

College of Science, Zhejiang University of Science and Technology

College of Electrical Engineering, Zhejiang University

Network and Information Security Laboratory, Hangzhou Hikvision Digital Technology Co., LTD

⁰