![](bg7.png)
On the other hand, in case of the experienced at-
tacker, the behaviour seems cautious, not raising an
suspicion for heavy CPU utilization, Table 2 offers
additional information to be able to detect anoma-
lies. Regarding the cases of 40-50% and 70-80% of
CPU utilization, for example, anomalies seem clear,
especially taking the collected network traffic into ac-
count. In a normal behaviour around 600 incom-
ing packages were counted and outgoing around 500
packages for 40-50% CPU usage while in the anoma-
lous case only received four packages and sent only
three packages.
Enough information to detect anomalies was
found between the collected data in Table 1 and in
the plot in Figure 7. Although it was not as simple
as to detect the anomaly in the inexperienced attack-
ers case. Using this statistical approach was helpful
to generate more precise information to detect and
expose anomalies from different kinds of attackers.
Further research is needed to tackle the problem of
finding a simple approach to unmask most anomalies
properly while generating minimal amount of false
positives.
6 CONCLUSIONS AND FURTHER
WORK
In this paper an overview of our anomaly detection
approach is given. Also, special requirements in Le-
gal Metrology are pointed out and the resulting secure
cloud reference architecture was briefly described.
Furthermore, an anomaly detection module applica-
tion is presented with promising results. This ap-
proach was tested against simulated attacks on the se-
cure cloud reference architecture, especially against
the legal metrology processing service. The lifecycle
of this service was described and tested against two
extreme cases of the assumed attacker model; the in-
experienced and experienced attacker.
It was shown that in this early stage, anomalies
caused by an inexperienced attacker, can be easily de-
tected by the AD-Module, by simple pattern recog-
nition of the clustering. Whereas, the experienced
attacker caused anomalies that can only be detected
aided by other statistical approaches, such as used
data density technique.
Further work will concentrate in finding more cor-
relations between metrics to detect more anomalies in
distributed environments. Part of this future work will
be evaluating more metrics in depth and creating a test
pipeline for automated testing and anomaly detection,
as well as to improve the statistical methods and eval-
uation. This will give us a better understanding of se-
cure cloud reference architecture behaviour to assess
a full risk analysis of the system.
REFERENCES
Barbhuiya, S., Papazachos, Z. C., Kilpatrick, P., and
Nikolopoulos, D. S. (2015). A lightweight tool for
anomaly detection in cloud data centres. In CLOSER,
pages 343–351.
BSI (2013). Technische Richtlinie BSI TR-03109-1 An-
forderungen an die Interoperabilit
¨
at der Kommunika-
tionseinheit eines intelligenten Messsystems. Bunde-
samt f
¨
ur Sicherheit in der Informationstechnik, Bonn.
European Parliament and Council (2014). Directive
2014/32/EU of the European Parliament and of the
Council. Official Journal of the European Union.
Gentry, C. et al. (2009). Fully homomorphic encryption
using ideal lattices. In STOC, volume 9, pages 169–
178.
Hansen, S. E. and Atkins, E. T. (1993). Automated sys-
tem monitoring and notification with swatch. In LISA,
volume 93, pages 145–152.
Jiang, M., Munawar, M. A., Reidemeister, T., and Ward,
P. A. (2009). System monitoring with metric-
correlation models: problems and solutions. In Pro-
ceedings of the 6th international conference on Auto-
nomic computing, pages 13–22. ACM.
Kang, H., Chen, H., and Jiang, G. (2010). Peerwatch: a fault
detection and diagnosis tool for virtualized consolida-
tion systems. In Proceedings of the 7th international
conference on Autonomic computing, pages 119–128.
ACM.
Lou, J.-G., Fu, Q., Yang, S., Xu, Y., and Li, J. (2010). Min-
ing invariants from console logs for system problem
detection. In USENIX Annual Technical Conference.
Marhas, M. K., Bhange, A., and Ajankar, P. (2012).
Anomaly detection in network traffic: A statistical ap-
proach. International Journal of IT, Engineering and
Applied Sciences Research (IJIEASR), 1(3):16–20.
Oppermann, A., Seifert, J.-P., and Thiel, F. (2016). Se-
cure cloud reference architectures for measuring in-
struments under legal control. In CLOSER (1), pages
289–294.
Oppermann, A., Yurchenko, A., Esche, M., and Seifert, J.-P.
(2017). Secure cloud computing: Multithreaded fully
homomorphic encryption for legal metrology. In In-
ternational Conference on Intelligent, Secure, and De-
pendable Systems in Distributed and Cloud Environ-
ments, pages 35–54. Springer.
Prewett, J. E. (2003). Analyzing cluster log files using log-
surfer. In Proceedings of the 4th Annual Conference
on Linux Clusters.
Richardson, C. (2011). Pattern: Microservice
chassis. Dosegljivo: http://microservices.
io/patterns/microservice-chassis. html.[Dostopano
11. 7. 2016].
Anomaly Detection Approaches for Secure Cloud Reference Architectures in Legal Metrology
555