Most Threat Analysis (TA) techniques analyze threats to targeted assets (e.g., components, services) by considering static interconnections among them. However, in dynamic environments, e.g., the Cloud, resources can instantiate, migrate across physical hosts, or decommission to provide rapid resource elasticity to its users. Existing TA techniques are not capable of addressing such requirements. Moreover, complex multi-layer/multi-asset attacks on Cloud systems are increasing, e.g., the Equifax data breach; thus, TA approaches must be able to analyze them. This paper proposes ThreatPro, which supports dynamic interconnections and analysis of multi-layer attacks in the Cloud. ThreatPro facilitates threat analysis by developing a technology-agnostic information flow model, representing the Cloud's functionality through conditional transitions. The model establishes the basis to capture the multi-layer and dynamic interconnections during the life cycle of a Virtual Machine. ThreatPro contributes to (1) enabling the exploration of a threat's behavior and its propagation across the Cloud, and (2) assessing the security of the Cloud by analyzing the impact of multiple threats across various operational layers/assets. Using public information on threats from the National Vulnerability Database, we validate ThreatPro's capabilities, i.e., identify and trace actual Cloud attacks and speculatively postulate alternate potential attack paths.

Moving Target Defense (MTD) can eliminate the asymmetric advantage that attackers have in terms of time to explore a static system by changing a system's configuration dynamically to reduce the efficacy of reconnaissance and increase uncertainty and complexity for attackers. To this extent, a variety of MTDs have been proposed for specific aspects of a system. However, deploying MTDs at different layers/components of the Cloud and assessing their effects on the overall security gains for the entire system is still challenging since the Cloud is a complex system entailing physical and virtual resources, and there exists a multitude of attack surfaces that an attacker can target. Thus, we explore the combination of MTDs, and their deployment at different components (belonging to various operational layers) to maximize the security gains offered by the MTDs.We also propose a quantification mechanism to evaluate the effectiveness of the MTDs against the attacks in the Cloud.

A variety of Threat Analysis (TA) techniques exist that typically target exploring threats to discrete assets (e.g., services, data, etc.) and reveal potential attacks pertinent to these assets. Furthermore, these techniques assume that the interconnection among the assets is static. However, in the Cloud, resources can instantiate or migrate across physical hosts at run-time, thus making the Cloud a dynamic environment. Additionally, the number of attacks targeting multiple assets/layers emphasizes the need for threat analysis approaches developed for Cloud environments. Therefore, this proposal presents a novel threat analysis approach that specifically addresses multi-layer attacks. The proposed approach facilitates threat analysis by developing a technology-agnostic information flow model. It contributes to exploring a threat's propagation across the operational stack of the Cloud and, consequently, holistically assessing the security of the Cloud.

As the usage of the Cloud proliferates, the need for security evaluation of the Cloud also grows. The process of threat modeling and analysis is advocated to assess potential vulnerabilities that can undermine the Cloud security goals. However, given the plethora of distinct services involved in the Cloud ecosystem and the varied attack surfaces entailed in the Cloud-specific architectures, performing threat analysis for the Cloud is a challenging task. Consequently, contemporary Cloud threat analysis approaches, typically using relational security models (e.g., attack graphs, trees...), primarily focus on specific services/layers of the Cloud. Also, these schemes often fail to include the variants of the identified vulnerabilities in their analysis. Hence, a comprehensive threat analysis approach is required that can (a) model and analyze threats across the multilayer Cloud operational stack, and (b) include variants of the vulnerabilities in the threat analysis procedure. We target achieving a holistic Cloud threat analysis by designing a novel multi-layer Cloud model, using Petri Nets, to comprehensively profile the operational behavior of the services involved in the Cloud operations. We subsequently conduct threat modeling to identify threats within and across the different layers of the Cloud operations. Our proposed threat analysis approach also investigates the variants of the potential vulnerabilities to comprehensively infer the Cloud attack surface.

Cloud monitoring is an established support mechanism for securing Cloud services. Over the last few years, various Cloud monitoring mechanisms have been proposed with different level of monitoring efficacy. To achieve effective monitoring, the monitoring mechanism is required to address the basic challenge that the information of the target-to-monitor may be inaccessible due to (i) access controls, (ii) privacy protection, or (iii) technical difficulties. Therefore, the indirect monitoring mechanism is particularly proposed for addressing the challenge. Specifically, the indirect mechanism makes inferences about the inaccessible information of monitoring targets with the help of the "monitoring path" that contains a special set of accessible monitoring data underpinning the inference task. However, the process to effectively discover the monitoring path is an open issue. To address this problem, we present our preliminary studies in this paper. Firstly, we review existing work and reveal the limitations for discovering monitoring paths. Secondly, we analyze real cases to provide insights for designing monitoring paths. Finally, we propose a framework and planned research tasks for developing a novel monitoring path discovery mechanism that facilitates performing indirect Cloud monitoring as the expected contribution of our research.

Covert-and side-channel attacks, typically enabled by the usage of shared resources, pose a serious threat to complex systems such as the Cloud. While their exploitation in the real world depends on properties of the execution environment (e.g., scheduling), the explicit consideration of these factors is often neglected. This paper introduces InfoLeak, an information leakage model that establishes the crucial role of the scheduler for exploiting core-private caches as covert channels. We show, formally and empirically, how the availability of these channels and the corresponding attack feasibility are affected by scheduling. Moreover, our model allows security experts to assess the related threat, posed by core-private cache covert channels for a particular system by considering solely the scheduling information. To validate the utility of InfoLeak, we deploy a covert-channel attack and correlate its success ratio to the scheduling of the attacker processes in the target system. We demonstrate the applicability of the InfoLeak model for analyzing the scheduling information for possible information leakage and also provide an example on its usage.

In this paper we present the first comparative study of evolutionary classifiers for the problem of road detection. We use seven evolutionary algorithms (GAssist-ADI, XCS, UCS, cAnt, EvRBF,Fuzzy-AB and FuzzySLAVE) for this purpose and to develop better understanding we also compare their performance with two well-known non-evolutionary classifiers (kNN, C4.5). Further we identify vision based features that enable a single classifier to learn to successfully classify a variety of regions in various roads as opposed to training a new classifier for each type of road. For this we collect a real-world dataset of road images of various roads taken at different times of the day. Then, using Information Gain (I.G) and CfsSubsetMerit values we evaluate the efficacy of our features in facilitating the detection. Our results indicate that intelligent features coupled with right evolutionary technique provides a promising solution for the domain of road detection.