a security monitoring method based on autonomic computing

Research ArticleA Security Monitoring Method Based on Autonomic Computingfor the Cloud Platform

Jingjie Zhang QingtaoWu Ruijuan Zheng Junlong Zhu Mingchuan Zhang and Ruoshui Liu

Information Engineering College Henan University of Science and Technology Luoyang 471023 China

Correspondence should be addressed to Qingtao Wu wqt8921hausteducn

Received 16 November 2017 Accepted 5 February 2018 Published 5 March 2018

Academic Editor Vincent C Emeakaroha

Copyright copy 2018 Jingjie Zhang et al This is an open access article distributed under the Creative Commons Attribution Licensewhich permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

With the continuous development of cloud computing cloud security has become one of the most important issues in cloudcomputing For example data stored in the cloud platformmay be attacked and its security is difficult to be guaranteedThereforewe must attach weight to the issue of how to protect the data stored in the cloud To protect data data monitoring is a necessaryprocess Based on autonomic computing we develop a cloud datamonitoring systemon the cloud platformmonitoringwhether thedata is abnormal in the cycle and analyzing the security of the data according to the monitored results In this paper the feasibilityof the scheme can be verified through simulation The results show that the proposed method can adapt to the dynamic change ofcloud platform load and it can also accurately evaluate the degree of abnormal dataMeanwhile by adjustingmonitoring frequencyautomatically it improves the accuracy and timeliness of monitoring Furthermore it can reduce the monitoring cost of the systemin normal operation process

1 Introduction

Resource monitoring in cloud computing environment is animportant part of resource management of cloud computingplatform It provides the basis for resource allocation taskscheduling and load balancing With the extensive useof cloud computing services users have made increasingdemands on the security of cloud computing Since the cloudcomputing environment has the characteristics of transparentvirtualization and resource flexibility it is infeasible for atraditional security program to protect the data security inthe cloud platform which hinders further development andapplication of cloud computing [1] Therefore it is of criticalimportance to develop new tools suitable for monitoringcloud platform data However the collection transmissionstorage and analysis of a large number of monitored datawill bring huge resource overhead directly affecting systemperformance timely detection of anomalies and pinpointaccuracy of problem In addition because cloud computingis essentially developed on the basis of current technologythe existing security vulnerabilities will be inherited directlyto the cloud computing platform which may even bring

greater security threat It can be seen that in the cloudcomputing environment users basically lost the controlof private information and data which triggered a seriesof security challenges such as cloud data storage loca-tion data encryption mechanism data recovery mechanismintegrity protection third-party supervision and auditingvirtual machine security and memory security At presentthere is not enough research on cloud computing resourcemonitoring but there are a lot of researches on distributedcomputing and grid computing for instance DRMonitor [2]Ganglia [3] and MDS (Monitoring and Discovery System)[4] They play important roles in distributed systems or gridsystems However if the above methods are applied directlyin the cloud computing environment there will be someshortcomings On the one hand the resource in the cloudcomputing environment is highly virtualized and flexibleMoreover cloud computing provides services such as IaaSPaaS and SaaS in addition to monitoring the resources ofthe physical server [5] Users need to monitor the virtualmachine running on it On the other hand cloud computingis a businessmodel and the cloud service providerwill chargethe user for usage accordingly Monitoring information in

HindawiJournal of Electrical and Computer EngineeringVolume 2018 Article ID 8309450 9 pageshttpsdoiorg10115520188309450

2 Journal of Electrical and Computer Engineering

existing resource monitoring system is not fine granularityso it is unable to get to the process level of informationand track consumption of CPU memory storage and otherresources in real time during the user task execution processCloud computing environment is dynamic random com-plex and open Cloud providers need to collect user-relatedfees based on resource usage as a result original resourcemonitoring methods cannot fully meet the requirements ofthe cloud computing environment Therefore according tothe characteristics of cloud computing itself some resourcemonitoring methods for current distributed computing andgrid computing cannot fully adapt to the cloud computingenvironment

In order to adapt to the cloud computing environmentcombining with abnormal data mining algorithm we pro-pose a data monitoring method under cloud environmentbased on autonomic computing model In order to addressthe security challenges for data on the cloud platform themodel uses autonomic computingmechanism and the abnor-mal datamining idea to transmit themonitoring informationto each otherThemodel is mainly composed of fivemodulesnetwork monitoring module data analysis module responsestrategymodule system implementationmodule and knowl-edge base In the network monitoring module the systemgathers the data by collecting the data stream and generatesthe original data In addition through the data preprocessingmechanism the original data are formattedThe data analysismodule evaluates these processed data extracts useful datafrom it to determine whether they are abnormal and thenfeeds the analysis result back to the response strategy moduleto adjust the monitoring period The data collection andanalysis of storage are the core parts of this model whichprovide users with essential data monitoring information Inthe local computer deployment monitoring framework thecloud is connected to data monitoring Our contributions areas follows

(i) We propose a safe and effective model that enablesthe data on the cloud platform to be monitored intime and the system adjusts the monitoring cycle toautonomously protect the data

(ii) We design a data mining algorithm in which basedon an improved chaotic algorithm data miningmethod was proposed for the frequently appearingabnormal data in the cloud computing environmentWe also design and implement abnormal behaviordetection based on the Poisson process to obtainaccurate test results

(iii) We formally analyze the capability of abnormalbehavior monitoring and implement all of thesedata security monitoring models based on auto-nomic computing A large number of experimentsare carried out in the simulation environment usingprepared dataset and the results show that our systemachieves the desired goals

This paper is organized as follows Section 2 states theorigin of autonomic computing theory and its related workSection 3 analyzes how to establish a security monitoring

Monitor Execute

PlanAnalyse

Sensors Effectors

Managed resource

Sensors Effectors

Knowledge base

Figure 1 MAPE autonomic computing model diagram

model based on autonomic computing for the cloud plat-form Then we analyze the existing security model andsafety monitoring method of autonomic computing to thecloud platform oriented metrics and the calculation methodSection 4 analyzes method of simulation and experiment andpresents a security monitoring model based on autonomiccomputing analysis for the cloud platform Section 5 gives thesummary and points out the future research directions

2 Related Work

The concept of autonomic computing was proposed byIBMrsquos Paul Horn in 2001 which has self-configuring self-optimization self-healing self- protection and other goodfeatures that have been accepted by the computer scientists[6 7] Autonomous computing refers to the computingenvironment with self-management capabilities dynamicallyadapting to the increasingly complex environment and self-discipline since calculation unit (Autonomic ComputingElement) is an essential part of the autonomic computingsystem [8] At present the research on autonomic computingis based on a model of control loop proposed by IBM in2003 It is called the MAPE-K (Monitor Analyze PlanExecute and Knowledge) cycle Based on this model astrategy module has been added to allow IT managers tofacilitate the management of autonomic computing units Itsstructure is shown in Figure 1 The monitor assembly meanscollecting information from the managed resource that isfrom the external environmentThe analyze assembly is usedto analyze the complexity of the internal environment of thesystem so that the self-regulatory manager can understandthe running state of the system in real time so as to predictthe future situation and take right strategy for the futurecondition The plan generates a sequence of actions thatcan be achieved based on the monitoring component andthe analysis componentrsquos data information from the externaland internal environments as well as previous policies Theexecute is given to the effector to adjust the state of themanaged resource The actions generated by the above fourcomponents are all based on the knowledge in the knowledgebase

Journal of Electrical and Computer Engineering 3

An event classification method used in the fault mon-itoring of autonomic computing system was introduced byLiu and Zhou in 2010 [9] In this scheme the systemmonitors the status of heterogeneous resources failure Withthe self-management system communicating internally anappropriate strategy is activated to repair the fault for self-repair system However there is a lack of research in thefield of self-discipline for systemperformance failures On thebasis of studying the self-monitoring of self-discipline theteam proposed a multipoint detection method in 2011 [10]Detecting the threshold cross-border and recovery to deter-mine the systemperformance failure ensures the effectivenessof detection for the system providing a useful strategy forthe repairment failure On the basis of studying the existingautonomic computing model they proposed a self-disciplinemodel which is suitable for distributed environment andformalizes the model elements of management resourcesresource operation state and action and so on to enhancethe application of self-discipline model and practical value[11]

Among these advances of distributed computing onemust take into account the emergence of new paradigms suchas cloud computing In 2012 Yolanda et al proposed a mon-itoring tool [12] The goal of their work is to evaluate existingmonitoring tools that can be used in cloud environments andare subsequently included in the monitoring component ofthe projects

In order to improve the efficiency of resource manage-ment in the cloud environment Liu and Li proposed a self-regulatory model for the cloud environment [13] which usesthe multi-autonomous managerrsquos hierarchical managementmodel to solve the traditional autonomic computing modelin dealing with a large number of requests when there isa bottleneck Moreover they proposed a hybrid strategymanagement model to tackle different fault repair requests

Monitoring is an important factor in improving the qual-ity of service provided in cloud computingWith the increaseof cloud system architecture the workload of data centeris also increasing leading to node failure and performanceproblems Suciu et al proposed a solution for monitoringand service providing cloud computing systems that allowsusers and providers to optimize the usage of the com-putational resources according to the constantly changingbusiness requirements inside an organization [14] The maincontribution of their paper consists of the integration of themonitoring system which is based on Nagios and NConfwith test cloud architecture

Liu and Guo proposed a hardware monitoring systembased on cloud platform for data acquisition storage andanalysis based on cloud computing [15] Computer hardwaremonitoring system stores and accesses data based on thecloud platform Storage hardware in the cloud platformunifies modeling analysis parameters for a large numberof data in order to provide users with complete hardwaremaintenance information

In 2015 Masmoudi et al [16] proposed a multitenantmonitoring approach based services that keep monitoringservice execution at runtime and detecting privacy viola-tions

In 2016 Peng et al [17] proposed a sampling methodin the compressed sensing theory to implement featurecompression for network data flow so that we can gainrefined sparse representation After that SVM (Support Vec-tor Machine) is used to classify the compression results Thismethod can realize detection of network anomaly behaviorquickly without reducing the classification accuracy

3 Security Monitoring ModelBased on Autonomic Computing forthe Cloud Platform

With the widespread use of cloud computing services usershave made increasing demands regarding the security ofcloud computing systems The dynamicity randomnesscomplexity and openness of the cloud computing environ-ment make it difficult to apply the conventional securityscheme which also hinders the further development andapplication of cloud computing [18] The security require-ments of cloud computing include terminal platform com-munication and information security and confidentiality ofthe whole cycle The cycle involves the cloud computinginfrastructure layer platform layer application layer andother layers

Autonomic computing provides an effective way toreduce the complexity of the system management but whatearly autonomic computing system mostly considered isphysical resource management of distributed heterogeneousenvironment It did not include the cloud environment undervarious restricting factors such as large-scale virtualizedapplications service level agreements diverse applicationand dynamic changes in the deployment environment Theoriginal framework of autonomic computing applicationcannot be applied directly in the cloud environment [19] Forexample in the virtual layer monitoring tools usually requireon-demand configuration to distinguish the surveillanceapplications and resources As a result the traditional MAPEcycle also needs to be redesigned to fit the cloud Cloudservices have the characteristics of virtualization liquidityand boundary ambiguity so the evaluation of their safetyis one of the most important issues According to thedata security problem of the cloud platform the workingmechanism of autonomic computing system model uses theabnormal data mining idea for reference It contains fourself-regulatory elements which can transmit the monitoringinformation to one another The model framework is shownin Figure 2 The model consists of five modules networkmonitoring module data analysis module response strategymodule system implementation module knowledge baseand virtual machine (VM)

31 Model of the Cloud Security Monitoring In order tosolve the problem of cloud system security we designedan independent monitoring model based on autonomiccomputing idea The model is mainly composed of fivemodules networkmonitoringmodule data analysis moduleresponse strategy module system implementation moduleand knowledge base


Knowledge

Networkmonitoring Data analysis

Systemimplementation Response strategies

Virtual layerresources

VM VM VMhelliphellip

Figure 2The cloud securitymonitoringmodel based on autonomiccomputing

In the cloud computing environment the traditionalresource monitoring can be in two modes (1) Active modethere is the resource monitoring component in the worknode and the virtual machinemonitor collecting status infor-mation of the virtual machine running on it The monitoractivates the master node by sending its own monitoringinformation (2) Passivemode themaster node sends requestto the work node then the work node returns their monitor-ing data back to the main node

Network monitoring module is the monitoring agentdeployed on the physical host virtual machine or othercontainers It is used to collect monitored data of system atall levels and its persistent storage Based on the historicalmonitored data the data analysis module establishes thecorrelation of the data to form the metric correlation graphfor evaluating the importance degree It uses the PCA (Prin-cipal Component Analysis) to calculate the eigenvector of themonitored data and computes the linear regression equationof the data source in the cloud computing environmentto quantitatively evaluate system anomalies The responsestrategymodule selects the object to bemonitored in the nextstage according to the importance of the monitored objectThe Poisson process is used to establish the software systemreliability model and the probability of the system failureis predicted based on the abnormality degree to adjust themonitoring period System implementation module is to usethe monitoring agent to perform the dynamic adjustment ofmonitoring objects and monitoring cycle Knowledge baseis the record of operation in the process of learning loadpatterns and corresponding eigenvectors so that the systemnormal operation can be depicted

The resources of the cloud computing environment mon-itoring with real-time information need to adopt the strategyof polling-cyclical or event-driven way Periodic mode refersto two cases In the first case the work nodes periodicallysend their own monitored information to the master nodeIn the second case the node that is the main resourcemonitoring component will send a periodic request to worknodes then these work nodes will collect and feed backinformation about themselves to the master nodeThe event-driven way refers to the fact that the old work nodes will

produce a series of events and the generation of each eventis triggered by monitoring of the corresponding terminalresource state for a check and compared with the last check ofthe data If the change between the two events is greater thanthe threshold set then the job is in either active or passivemode

32 Monitored Data Collection In the cloud computingenvironment the data collection work is a comprehensiveand coordinated process and needs to coordinate with thedata storage and analysis work Then it establishes a dataacquisition and analysis model including data collectiondata preprocessing data analysis storage and other compo-nents

After the data collection process the original data streamis classified and the original data are generatedThen the datapreprocessing mechanism is used to format these originaldata Finally through the data analysis and storage parts theuseful data are extracted from the massive data By theseprocedures and software users can use the data directly Thisdata acquisition and analysis model achieves an integrateddata processing process In this model the data collectionand analysis of storage are two core parts giving customersmeaningful information

Data Collection In the cloud computing environment thedata collection consists of three steps namely data capturedata filtering and data classification Through these threesteps original data flow deals with customer meaningfuldata [20] After capturing the data it needs to filter andremove some useless information and categorize the restThen the classification of the data is sent to the preprocessingpart

Data Preprocessing Data preprocessing includes severalmethods that is data cleaning data integration data trans-formation and data reduction [21] After selecting appropri-ate attributes as the data mining attributes from the originaldata the principle of selection process should refer to givingattribute names and attribute values as clear meaning aspossible unifying multiple data source attribute code andremoving the unique attribute So it can select the appropriatemonitoring data for analysis

Data Analysis Data collection model must be establishedwith relevant functions and appropriate conditions Firstlythe data acquisition model needs to understand the expectedresults Measuring and verifying the initial model are alsorequired According to the validation results the model willbe effectively adjusted Secondly the data acquisition modelneeds to be practical At last the causal relationship betweenthe data will be revealed in order to make the collected datastatistically significant The establishment of the data modelalso needs to be improved continuously

(1) The length of the sliding window is 119899 multiplemeasures for monitored data are collected as 119909 =(1199091 1199092 119909119898) among which each collected moni-toring data includes 119898 metrics The operation and


maintenance personnel can set 119898 value according totheir needsHere119898 is a positive integer119909119894 is the valueof the 119894th metric The monitored data slides into thesliding window in the order of time Monitored datain the sliding window form the matrix 119860119899119898 (119899 rowsand119898 columns)

(2) Each column of 119860119899119898 is standardized with a mean of0 and the variance of 1 119885119894 = (119909119894 minus 119906119894)120590119894 119906119894 is themean of the 119894th column data set and 120590119894 is the standarddeviation of the 119894th column data set

(3) The covariance matrix is obtained

119862 = [[[[[120590211 sdot sdot sdot 12059021119898 d

12059021198981 sdot sdot sdot 1205902119898119898]]]]] (1)

(4) Calculate the eigenvector of 119862 the main direction ofthe data distribution 997888rarr119906

(5) When newmonitored data arrives in order to enlargethe influence of outliers on the main direction ofchange the sample will be copied 119899119903 times 119903 isin[0 1] which is a copy of the current samples with thecurrent sample size The proportion of the updatedmatrices are shown as follows119860 = 119860 cup 119909119905 119909119905 119909119905 (2)

(6) Update matrix mean and covariance matrix119906 = (119906 + 119903119909119905)(1 + 119903) Update the eigenvector in themain direction 119906119905 = sum119860 1199061003817100381710038171003817sum119860 1199061003817100381710038171003817 (3)

(7) Evaluate abnormality of newly collected monitoreddata by using cosine similarity The lower the similar-ity between the two main eigenvectors the larger thedeviation and the higher the abnormality This paperdescribes the degree of anomaly

AutoCos = 119906119905 sdot 11990610038171003817100381710038171199061199051003817100381710038171003817 times 119906 (4)

In this formula ldquosdotrdquo represents the dot productData Storage Data storage is the most important securityissue which needs to be addressed to ensure the integrity ofthe data The access to data can only be granted to those withright authority

33 Monitored Data Analysis When the traditional miningalgorithm is used to excavate the frequent abnormal datait cannot identify the abnormal data of frequent abnormal-ities and there is a big problem of frequent anomaly ofdata mining Based on the historical monitored data thedata analysis module establishes the correlation between

the metrics to form the metric graph so that the degreeof importance of the metric can be evaluated A miningmethod for anomaly data based on the improved chaosalgorithm is proposedThe eigenvector of themonitored datais calculated to quantify the system anomalies Firstly thedata source in the observed cloud computing environmentis fused to the partial least squares method to be cleanedand dimensionless processed and a normalized data matrixas well as a normalized dimension vector is obtained Thematrix and the vector are defined respectivelyThe anomalousdata predicting variables and the determinants are observedand the principal component analysis is extracted to establishthe linear regression equation of the data source in thecloud computing environment The concrete steps are as fol-lows

(1) We will fuse the observed data to partial least squaresso that the original data can be the cleaned withnondimension The formula is as follows119909lowast119894119895 = 119909119894119895 minus 119909119895radic119878119895119878 (119863)

119910lowast119894 = 119910119894 minus 119910radic119878119910 times 119909lowast119894119895(5)

Here119909119894119895 is state space of data source in the cloud com-puting environment with intrinsic mode function 119878119895represents weight vector of each data in the cloudcomputing environment 119878119910 represents the steady-state probability of the global data in the cloudcomputing environment119910119894 represents amultivariabletime series of given exception data 119910 represents thelocal thinning ratio 119909lowast119894119895 represents the source dataafter cleaning in the cloud computing environmentand 119910lowast119894 represents dimensionless processing of datasource in cloud computing environment

(2) We calculate the standardized data matrix and thenormalized dimensional vector and provide the databasis for the main component analysis in the nextstep We obtain a normalized matrix of 119898 times 119899 orderrepresented by 1198830 and the 119898-dimensional vectorrepresented by 1198840 as follows

1198840 = 119910119894lowast times [[[[[[[1199101lowast1199102lowast119910119898lowast]]]]]]]

1198830 = (119909lowast11 sdot sdot sdot 119909lowast1119899 d119909lowast1198981 sdot sdot sdot 119909lowast119898119899)times1198840

(6)

1199101lowast 1199102lowast and 119910119898lowast represent the main elements of1198840 and 119909lowast11 119909lowast1119899 119909lowast1198981 and 119909lowast119898119899 represent the mainelements of1198830


(3) 1198830 and 1198840 are defined respectively as the resultsof observation value standardization for predictionvariables and the determinant of frequent abnormaldata in cloud computing environment The principalcomponent analysis and extraction will be carried onThe following two formulas are used respectively toextract principal components1198840 and1198830 of1198841 and1198831making1198831 maximally reflect 1198841 implementing prin-cipal component extractionThe calculation formulasare as follows 1198841 = 1199051 (11988301205961)1198840

1198831 = 1198751 otimes 1198831198790 11990511198841 (7)

where 1198751 is the frequent abnormal data on behalf ofthe cloud computing environment1198831198790 represents theeigenvalue vector data of frequent abnormalities incloud computing environment 1205961 is the similarity ofcharacteristic value for frequent abnormal data and 1199051represents the time complexity of the decompositionof matrix1198830

(4) After extracting the principal components we needto establish the regression equation of the source datain cloud computing environmentThe expression is asfollows(119909lowast 119910lowast) = 1198831 times 12057211199091 + 1205722 + 1199092lowast + 120572119901 + 119909119901lowast1206031 (8)

(119909lowast 119910lowast) is the linear regression coefficient of datain cloud computing environment 1205721 1205722 and 120572119901represent relevance between dependent variable andeach variable of frequent abnormal data and 1199092lowast and119909119901lowast represent the correlation between the frequentabnormal data variables

34 Policy Response Method The nature of the servicesprovided by the cloud computing platform is the Internetaccess serviceMost of the existingmethods use the stochasticprocess model of typical telecommunication access-Poissonprocess as the basis of system resource scheduling optimiza-tion Poisson process is a class of the most basic independentprocess in describing random events in which the timeinterval of events is considered to be independent randomvariables equivalent to an update process [22] The typicalPoisson process is expressed as119875 (119873 (119905) minus 119873 (119905 minus 119904) = 119899)

= 119890minus120582[(119905minus(119905minus119904))] [120582119905 minus 120582 (119905 minus 119904)]119899119899 (9)

In (9) 119873(119905) is the number of events occurring between0 and 119905 and 120582 is the intensity of the event In the Internetaccess services they can be seen as the number and accessstrength of Internet services access at time 119905119873(119905) minus 119873(119905 minus 119904)is the increment of the number of Internet access services inthe time [119905 minus 119904 119905)

When the data module is abnormal it will be sentto the corresponding module of the strategy The Poissondistribution process is the classical fault prediction modelof the reliability engineering Conventionally the historicalfault data is used to predict the time of the next failureHowever this paper improves the model and introduces theanomaly evaluation to replace the historical fault data andpredict the next system failure time In this way by assessingthe degree of system anomalies the instantaneous error canbe responded to in a timely manner the monitoring cycleis immediately adjusted to the minimum The cumulativeerror can be adjusted according to the degree of abnormalmonitoring cycle We set the probability of a system failureas 119865(119905) = 119908 Then you can calculate the time interval of nextfailure119905 = minus ln(1 minus 119908)120582 so the current monitoring period canbe adjusted to

119879 = 119879120573 0 le 119904119905 lt 120573minus ln (1 minus 119904119905)120582 + 119890 120573 le 119904119905 le 120572119879120572 120572 lt 119904119905 le 1 (10)

In (10) 119879120573 is the minimum monitoring period 119879120572 is themaximummonitoring period and 120582 and 119890 are the adjustmentparameters According to the analysis of the function we findthat if the monitoring cycle is set between the maximum andthe minimum monitoring cycle abnormal monitoring cycleshortens with the increase in the degree of abnormal systemand the shortness degree increases with the range of increasedegree of abnormal monitoring cycleThat is to say the moreserious the abnormality is the shorter the monitoring periodis which the desired result is

4 Experiments and Simulation

In order to further verify the feasibility and rationality ofthe autonomous monitoring model based on autonomiccomputing a simulation experiment is carried out MAT-LAB software is used to build the frequent abnormal datasimulation platform in the cloud computing environmentThe computer simulation platform configuration includesIntel (R) Core (TM) i3-2130 34GHz CPU 400GB memorywindows 10 professional 64-bit operating system MATLAB2014b The cloud platform is built on four different operatingsystem application servers The experimental environmentincludesHuawei S9303multilayer routing switch andMySQLdatabase server to provide data operation

41 Experiment Procedure In the monitoring of data collec-tion we monitor three kinds of resource types shown inTable 1 In this paper we use sliding window technology totemporarily store the monitoring data mainly to achieve twofunctionsThe first function is to calculate the current slidingwindow in the vector set of eigenvectors compared withthe reference feature vector to detect the fault The secondone is to learn the new load mode according to currentsliding window in the load vector set so that the exception


Table 1 Critical monitoring metrics

Resource type Interpretation MetricCPU The system calls the CPU time slice system cpu usage

Internet Number of packets received r packetsNumber of packets sent s packets

Data content Integrity inf com

Table 2 Frequent abnormal data mining performance

Number ofexperiments(times)

Accuracyrate ()

Error rate() Reliability rate ()

20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986

in the specific load mode can be detected When the newmonitored data arrives at the end of the sliding window thelarger the length of the first window of the monitoring datato delete is the more obvious the abnormal performancewill be and the better the timeliness of abnormal detectionwill be This results in a higher false negative rate On thecontrary the smaller the window length is the more obviousthe failure performance will be and the greater the impactof noise monitored data will be The results are in a higherfalse alarm rateThe experimental results show that when thewindow length is 17ndash23 the detection effect is ideal with littledifference So we will set the sliding window size to 20 in thisexperiment

In this experiment the number of concurrent stepsbetween 0 and 2 can be gradually increased to 300 Whenthe number of concurrent steps is set to 5 minutes and theexperiment lasts 500 minutes then 100 sets of data can beacquired In the experiment set the sliding window lengthto 20 The first 20 data sets in the main direction of thePCA (Principal Component Analysis) feature vector are thebenchmark training data and then the data can be used as anonline fault detection

Based on the improved chaos algorithm the anomaly datamining method is used to simulate the frequent abnormaldata in the cloud environment The mining accuracy andthe mining error rate are compared with different setsof experimental times so as to measure the effectivenessreferring to Table 2

42 Results Analysis When data analysis is carried out underunchanged condition of load model the experimental resultsare shown in Figure 3 It shows that the abscissa is concurrentnumber and the coordinate is the abnormal degree (1 minus|correlation|) with values between 0 and 1 The maximum ofabnormal degree is 1 which means that there is a problemin cloud data The minimum value is 0 implying that cloud

20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal

ityFigure 3 Abnormal degree change with concurrency

11 21 31 41 511The sampling points

0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)

Figure 4 Monitoring period adjustment

data is normal In the constant load model when there isa concurrent number there is no phenomenon of normalmonitoring data to detect anomalies mistakenly Thereforethe number of concurrent dynamic change situations hasgood adaptability

According to the experimental results in this paper themaximum andminimummonitoring cycles are respectivelyset to 300 seconds and 10 seconds Initial system abnormalvalue is 0 and the biggest monitoring cycle is 300 secondsWhen the cloud data situation changes then the monitoringperiod is adjusted accordingly When the cycle of samplepoint is short and the monitoring cost is larger for examplewhen the sample point is no more than 20 Figure 4 showsthat no matter how the situation changes monitoring timeand the basic monitoring price remain unchanged


Repeated experiments show that when the degree ofnetwork anomaly is low themethod of dynamically adjustingthe monitoring period makes the monitoring system adopta large monitoring period reduce the number of data col-lection reduce the unnecessary overhead and dynamicallyadjust the monitoring period to send the network trafficbelow fixed detection cyclemethodTherefore themodel canbe adjusted according to the amount of data in cloud platformmonitoring cycle to reduce the monitoring cost

5 Conclusion and Further Work

Data security in cloud platform is an ongoing challengingissue We draw lessons from the working mechanism ofautonomic computing system and the idea of abnormaldata mining Then we propose a data security monitoringmethod based on autonomic computing This method mon-itors changes of data in the cloud platforms to ensure thesecurity of these Simulation results show that the cost canbe reduced with the architecture of integrated modules ofdata collection analysismonitoring service and data volumebased monitoring cycle adjustment However the ability ofrepairing the attacked data is not taken into account inthe proposed method yet Therefore the research on datarecovery and related implementation will be considered inthe future work

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported in part by the National NaturalScience Foundation of China (NSFC) under Grants no61602155 no U1604155 no 61370221 and no U1404611 inpart by the Program for Science amp Technology InnovationTalents in the University of Henan Province under Grantno 16HASTIT035 in part by Henan Science and TechnologyInnovation Project under Grants no 164200510007 and no174100510010 in part by the Industry university researchproject of Henan Province under Grant no 172107000005and in part by the support program for young backboneteachers in Henan Province under Grant no 2015GGJS-047

References

[1] G Komal and G Parul Cloud computing security issues Ananalysis Institute of Electrical and Electronics Engineers Inc2016

[2] J J Jiang and Z F Ding ldquoThe design and implementation ofcloud computing model and platformrdquo Applied Mechanics andMaterials vol 631-632 pp 210ndash217 2014

[3] J Kar andMRMishra ldquoMitigating threats and securitymetricsin cloud computingrdquo Journal of Information Processing Systemsvol 12 no 2 pp 226ndash233 2016

[4] I Diaz G Fernandez M Martin P Gonzalez and J TourinoldquoIntegrating the common information model with MDS4rdquo in

Proceedings of the 2008 9th IEEEACM International Conferenceon Grid Computing (GRID) pp 298ndash303 Tsukuba September2008

[5] Y Q Zhang X F Wang X F Liu and L Liu ldquoSurvey on cloudcomputing securityrdquo Journal of Software Ruanjian Xuebao vol27 no 6 pp 1328ndash1348 2016

[6] T B Mathias and P J Callaghan ldquoAutonomic computing andIBM System z10 active resource monitoringrdquo IBM Journal ofResearch and Development vol 53 no 1 pp 131ndash1311 2009

[7] ZWang HWang G Feng and et al ldquoResearch onAutonomicComputing System and its Key Technologiesrdquo Computer Sci-ence vol 40 no 7 pp 15ndash18 2013

[8] K Ahuja andHDangey ldquoAutonomic Computing An emergingperspective and issuesrdquo in Proceedings of the 2014 InternationalConference on Issues and Challenges in Intelligent ComputingTechniques ICICT 2014 pp 471ndash475 India February 2014

[9] W Liu and Y Zhou ldquoResearch and Design of Fault MonitoringMechanism Based Oil Autonomic Computingrdquo Computer Sci-ence vol 37 no 8 pp 175ndash177 2010

[10] W Liu and Z Li ldquoMultiplied DataThreshold DetectingMethodBased on Autonomic Computingrdquo Computer Science vol 38no 5 pp 132ndash134 2011

[11] W Liu and K Ren ldquoResearch and Design of an AutonomicComputing SystemModel Based on Distributed EnvironmentrdquoJournal of Northwestern Polytechnic University vol 29 no 2 pp160ndash164 2011

[12] S Yolanda G Georgina and C Mariela ldquoEvaluation ofmonitoring tools for cloud computing environmentsrdquo IEEEComputer Society pp 569ndash578 2012

[13] W Liu and Z Li ldquoAutonomic Computing Model Based onHierarchical Management in Cloud Environmentrdquo ComputerScience vol 41 no 3 pp 189ndash192 2014

[14] G Suciu S Halunga A Ochian and V Suciu ldquoNetwork man-agement and monitoring for cloud systemsrdquo in Proceedings ofthe 6th International Conference on Electronics Computers andArtificial Intelligence ECAI 2014 pp 1ndash4 Romania October2014

[15] M Liu and P Guo ldquoDesign and Implementation of ComputerHardware Monitoring System Based on Cloud Computingrdquo inProceedings of the 2016 International Conference on ElectronicInformation and Computer Engineering ICEICE 2016 HongKong April 2016

[16] F Masmoudi M Loulou and A H Kacem ldquoMulti-tenantservices monitoring for accountability in cloud computingrdquoIEEE Computer Society pp 620ndash625 2015

[17] M Peng H Xiong and X Yu ldquoSVM intrusion detectionmodelbased on compressed samplingrdquo Journal of Electrical amp Com-puter Engineering pp 1ndash7 December 2016

[18] Z ZEng and C Li ldquoStudy on frequent Abnormal Data MiningMethod in Cloud Computing EnvironmentrdquoComputer Simula-tion vol 33 no 3 pp 339ndash342 2016

[19] J Ge B Zhang and Y Fang ldquoStudy on Resource MonitoringModel in Cloud Computing Environmentrdquo Computer Enginer-ing vol 37 no 11 pp 31ndash33 2014

[20] D Li L Li L Jin G Huang and Q Wu ldquoResearch of loadforecasting and elastic resources scheduling of Openstack plat-form based on time seriesrdquo Journal of Chongqing University ofPosts and Telecommunications (Natural Science Edition) vol 28no 4 pp 560ndash566 2016


[21] H Chen X Fu Z Tang and X Zhu ldquoResourcemonitoring andprediction in cloud computing environmentsrdquo in Proceedingsof the 3rd International Conference on Applied Computing andInformation Technology and 2nd International Conference onComputational Science and Intelligence ACIT-CSI 2015 pp 288ndash292 Japan July 2015

[22] Z Luo H Qian and Z Jun ldquoAbnormal Behavior DetectionBased on Poisson Equationrdquo Science Technology and Engineringvol 14 no 2 pp 50ndash54 2014

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018


Active and Passive Electronic Components

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of



Journal ofEngineeringVolume 2018

SensorsJournal of



RotatingMachinery


Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation


Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom


existing resource monitoring system is not fine granularityso it is unable to get to the process level of informationand track consumption of CPU memory storage and otherresources in real time during the user task execution processCloud computing environment is dynamic random com-plex and open Cloud providers need to collect user-relatedfees based on resource usage as a result original resourcemonitoring methods cannot fully meet the requirements ofthe cloud computing environment Therefore according tothe characteristics of cloud computing itself some resourcemonitoring methods for current distributed computing andgrid computing cannot fully adapt to the cloud computingenvironment

In order to adapt to the cloud computing environmentcombining with abnormal data mining algorithm we pro-pose a data monitoring method under cloud environmentbased on autonomic computing model In order to addressthe security challenges for data on the cloud platform themodel uses autonomic computingmechanism and the abnor-mal datamining idea to transmit themonitoring informationto each otherThemodel is mainly composed of fivemodulesnetwork monitoring module data analysis module responsestrategymodule system implementationmodule and knowl-edge base In the network monitoring module the systemgathers the data by collecting the data stream and generatesthe original data In addition through the data preprocessingmechanism the original data are formattedThe data analysismodule evaluates these processed data extracts useful datafrom it to determine whether they are abnormal and thenfeeds the analysis result back to the response strategy moduleto adjust the monitoring period The data collection andanalysis of storage are the core parts of this model whichprovide users with essential data monitoring information Inthe local computer deployment monitoring framework thecloud is connected to data monitoring Our contributions areas follows

(i) We propose a safe and effective model that enablesthe data on the cloud platform to be monitored intime and the system adjusts the monitoring cycle toautonomously protect the data

(ii) We design a data mining algorithm in which basedon an improved chaotic algorithm data miningmethod was proposed for the frequently appearingabnormal data in the cloud computing environmentWe also design and implement abnormal behaviordetection based on the Poisson process to obtainaccurate test results

(iii) We formally analyze the capability of abnormalbehavior monitoring and implement all of thesedata security monitoring models based on auto-nomic computing A large number of experimentsare carried out in the simulation environment usingprepared dataset and the results show that our systemachieves the desired goals

This paper is organized as follows Section 2 states theorigin of autonomic computing theory and its related workSection 3 analyzes how to establish a security monitoring

Monitor Execute

PlanAnalyse

Sensors Effectors

Managed resource

Sensors Effectors

Knowledge base

Figure 1 MAPE autonomic computing model diagram

model based on autonomic computing for the cloud plat-form Then we analyze the existing security model andsafety monitoring method of autonomic computing to thecloud platform oriented metrics and the calculation methodSection 4 analyzes method of simulation and experiment andpresents a security monitoring model based on autonomiccomputing analysis for the cloud platform Section 5 gives thesummary and points out the future research directions

2 Related Work

The concept of autonomic computing was proposed byIBMrsquos Paul Horn in 2001 which has self-configuring self-optimization self-healing self- protection and other goodfeatures that have been accepted by the computer scientists[6 7] Autonomous computing refers to the computingenvironment with self-management capabilities dynamicallyadapting to the increasingly complex environment and self-discipline since calculation unit (Autonomic ComputingElement) is an essential part of the autonomic computingsystem [8] At present the research on autonomic computingis based on a model of control loop proposed by IBM in2003 It is called the MAPE-K (Monitor Analyze PlanExecute and Knowledge) cycle Based on this model astrategy module has been added to allow IT managers tofacilitate the management of autonomic computing units Itsstructure is shown in Figure 1 The monitor assembly meanscollecting information from the managed resource that isfrom the external environmentThe analyze assembly is usedto analyze the complexity of the internal environment of thesystem so that the self-regulatory manager can understandthe running state of the system in real time so as to predictthe future situation and take right strategy for the futurecondition The plan generates a sequence of actions thatcan be achieved based on the monitoring component andthe analysis componentrsquos data information from the externaland internal environments as well as previous policies Theexecute is given to the effector to adjust the state of themanaged resource The actions generated by the above fourcomponents are all based on the knowledge in the knowledgebase














Knowledge




















119862 = [[[[[120590211 sdot sdot sdot 12059021119898 d

12059021198981 sdot sdot sdot 1205902119898119898]]]]] (1)















(6)




1198831 = 1198751 otimes 1198831198790 11990511198841 (7)




















Accuracyrate ()


20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986





20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal



0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)










Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia















Knowledge




















119862 = [[[[[120590211 sdot sdot sdot 12059021119898 d

12059021198981 sdot sdot sdot 1205902119898119898]]]]] (1)















(6)




1198831 = 1198751 otimes 1198831198790 11990511198841 (7)




















Accuracyrate ()


20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986





20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal



0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)










Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia






119862 = [[[[[120590211 sdot sdot sdot 12059021119898 d

12059021198981 sdot sdot sdot 1205902119898119898]]]]] (1)















(6)




1198831 = 1198751 otimes 1198831198790 11990511198841 (7)




















Accuracyrate ()


20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986





20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal



0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)










Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia




1198831 = 1198751 otimes 1198831198790 11990511198841 (7)




















Accuracyrate ()


20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986





20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal



0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)










Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia









Accuracyrate ()


20 982 02 98630 977 01 97040 981 01 98350 982 01 98660 982 01 986





20 40 60 80 100 120 140 160 180 200 220 240 260 280 3000Concurrency

0

02

04

06

08

1

The d

egre

e of a

bnor

mal



0

50

100

150

200

250

300

Mon

itorin

g pe

riod

(sec

onds

)










Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia








Acknowledgments


References



























RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia







RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia


a security monitoring method based on autonomic computing

Documents