![](bg6.png)
0 2000 4000 6000 8000 10000
0
10
20
30
40
50
60
Elapsed time
Delay(ms)
967ms
Figure 5: Migration impact on response delay of web server.
As illustrated in the graph, the web service downtime due
to migration is 967ms.
0 10 20 30 40 50 60 70 80
0
0.2
0.4
0.6
0.8
1
1.2
Service#
Survivability possibility
Random Placement
New Placement
Figure 6: Comparison of survivability.
the system performance. Figure 5 presents a migra-
tion delay of Web server on our platform.
The cost on migration path happens when a new
placement plan is deployed. The cost may differ if
the VMs are migrated in a different order because im-
migrated VM should wait until the target node has
enough space. In addition, we should choose sus-
pended VMs to migrate first because migrating sus-
pended VMs will not cause performance loss. There-
fore, we should try to choose a migration path with
minimum costs. Calculation of the optimal migration
path is out of the scope of this paper due to limit of
space.
5 EXPERIMENTAL RESULTS
We apply our placement algorithm to the data set to
generate placement plans. The data set includes 81
VMs on 10 node. The capacity for 10 nodes are
20,15,10,10,10,5,5,5,5,5. Based on the data set, we
generated a random placement plan and optimize the
placement using our algorithm. We compared the new
placement plan with the random one to investigate the
improvement of security levels.
According to our experimental results shown in
Figure 6, 91.3% services obtained improved surviv-
ability. The maximum survivability enhancement is
74.28% and the average improvement of survivability
possibility is 27.15%. Our results also show reduced
number of compromised VMs.
ACKNOWLEDGEMENTS
This work was supported in part by NSF Grants CNS-
1100221 and CNS-0905153.
REFERENCES
Apte, R., Hu, L., Schwan, K., and Ghosh, A. (2010). Look
who’s talking: discovering dependencies between vir-
tual machines using cpu utilization. In Proceedings
of the 2nd USENIX conference on Hot topics in cloud
computing, HotCloud’10, pages 17–17, Berkeley, CA,
USA. USENIX Association.
CVE-2007-4993 (2007). Cve-2007-4993: Xen guest
root can escape to domain 0 through pygrub.
http://cve.mitre.org/cgibin/cvename.cgi?name=CVE-
2007-4993, 2007.
CVE-2007-5497 (2007). Cve-2007-5497: Vul-
nerability in xenserver could result in privi-
lege escalation and arbitrary code execution.
http://support.citrix.com/article/CTX118766, 2007.
CVSS (2012). Common vulnerability scoring system.
http://www.first.org/cvss/cvss-guide.
Hlavacs, H., Treutner, T., Gelas, J., Lefevre, L., and Orgerie,
A. (2011). Energy consumption side-channel attack
at virtual machines in a cloud. In Dependable, Au-
tonomic and Secure Computing (DASC), 2011 IEEE
Ninth International Conference on, pages 605 –612.
Lucas Simarro, J., Moreno-Vozmediano, R., Montero, R.,
and Llorente, I. (2011). Dynamic placement of virtual
machines for cost optimization in multi-cloud envi-
ronments. In High Performance Computing and Sim-
ulation (HPCS), 2011 International Conference on,
pages 1 –7.
Ristenpart, T., Tromer, E., Shacham, H., and Savage, S.
(2009). Hey, you, get off of my cloud: exploring infor-
mation leakage in third-party compute clouds. In Pro-
ceedings of the 16th ACM conference on Computer
and communications security, CCS ’09, pages 199–
212, New York, NY, USA. ACM.
Sahner, R., Trivedi, K., and Puliafito, A. (1997). Perfor-
mance and reliability analysis of computer systems
(an example-based approach using the sharpe soft-
ware. Reliability, IEEE Transactions on, 46(3):441.
Sindelar, M., Sitaraman, R. K., and Shenoy, P. (2011).
Sharing-aware algorithms for virtual machine colo-
cation. In Proceedings of the 23rd ACM symposium
on Parallelism in algorithms and architectures, SPAA
’11, pages 367–378, New York, NY, USA. ACM.
Yusoh, Z. and Tang, M. (2010). A penalty-based genetic al-
gorithm for the composite saas placement problem in
the cloud. In Evolutionary Computation (CEC), 2010
IEEE Congress on, pages 1 –8.
Zhang, Y., Li, M. L., Bai, K., Yu, M., Zang, W., and He, X.
(4-6 June 2012). Incentive compatible moving target
defense against vm-colocation attacks in clouds. In
IFIP International Information Security and Privacy
Conference 2012.
SECRYPT2012-InternationalConferenceonSecurityandCryptography
326