云环境下基于拟态防御的科学工作流执行系统

王亚文; 邬江兴; 郭云飞; 扈红超; 刘文彦; 程国振

doi:10.1631/FITEE.1800621

Your Location：

Home >

Browse articles >

云环境下基于拟态防御的科学工作流执行系统

网络空间安全专辑 | Updated：2022-05-19

- 云环境下基于拟态防御的科学工作流执行系统
- Scientific workflow execution system based on mimic defense in the cloud environment
- 信息与电子工程前沿（英文） 2018年19卷第12期页码：1522-1536
- Affiliations：
  
  National Digital Switching System Engineering Technology Research Center, Zhengzhou 450002, China
- Author bio：
  
  Jiang-xing WU, E-mail: JiangXing_WU_NDSC@163.com
- Funds：
  
  Project supported by the National Natural Science Foundation of China (Nos. 61521003 and 61602509), the National Key Technologies R & D Program of China (Nos. 2016YFB0800100 and 2016YFB0800101), and the Key Technologies R & D Program of Henan Province, China (No. 172102210615)
- DOI：10.1631/FITEE.1800621
  中图分类号： TN915.08
- 收稿：2018-10-07，
  
  修回：2018-12-17，
  
  纸质出版：2018-12
- Accepted：
Scan QR Code
王亚文, 邬江兴, 郭云飞, 等. 云环境下基于拟态防御的科学工作流执行系统[J]. 信息与电子工程前沿（英文）, 2018,19(12):1522-1536.

Ya-wen WANG, Jiang-xing WU, Yun-fei GUO, et al. Scientific workflow execution system based on mimic defense in the cloud environment[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(12): 1522-1536.
王亚文, 邬江兴, 郭云飞, 等. 云环境下基于拟态防御的科学工作流执行系统[J]. 信息与电子工程前沿（英文）, 2018,19(12):1522-1536. DOI： 10.1631/FITEE.1800621.

Ya-wen WANG, Jiang-xing WU, Yun-fei GUO, et al. Scientific workflow execution system based on mimic defense in the cloud environment[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(12): 1522-1536. DOI： 10.1631/FITEE.1800621.

摘要

随着越来越多大规模科学计算任务交付云计算平台，云工作流系统被设计用于管理和安排这些复杂任务。然而，云计算中多租户共存服务模式存在严重安全风险，可能威胁云工作流的正常执行。为加强云工作流安全性，提出一种面向科学工作流的拟态云计算任务执行系统。拟态防御的思想主要涉及3个方面：异构性、冗余性和动态性。在异构性方面，集成物理服务器、管理器和操作系统的多样性以创建鲁棒的系统架构。在冗余性方面，工作流中每个子任务由多个执行体同时执行。综合考虑效率和安全性，提出滞后裁决机制检查任务执行结果。在动态性方面，设计动态任务调度机制切换工作流执行环境并缩短执行体生命周期，以混淆攻击者并净化任务执行体。实验结果表明，该系统有效增强了云工作流执行的安全性。

Abstract

With more large-scale scientific computing tasks being delivered to cloud computing platforms

cloud workflow systems are designed for managing and arranging these complicated tasks. However

multi-tenant coexistence service mode of cloud computing brings serious security risks

which will threaten the normal execution of cloud workflows. To strengthen the security of cloud workflows

a mimic cloud computing task execution system for scientific workflows is proposed. The idea of mimic defense contains mainly three aspects: heterogeneity

redundancy

and dynamics. For heterogeneity

the diversities of physical servers

hypervisors

and operating systems are integrated to build a robust system framework. For redundancy

each sub-task of the workflow will be executed simultaneously by multiple executors. Considering efficiency and security

a delayed decision mechanism is proposed to check the results of task execution. For dynamics

a dynamic task scheduling mechanism is devised for switching workflow execution environment and shortening the life cycle of executors

which can confuse the adversaries and purify task executors. Experimental results show that the proposed system can effectively strengthen the security of cloud workflow execution.

关键词

Keywords

references

B Ainapure , , , D Shah , , , AA Rao . . Adaptive multilevel fuzzy-based authentication framework to mitigate cache side channel attack in cloud computing . . Int J Model Simul Sci Comput , , 2018 . . 9 ( ( 5 ): ): 1850045 DOI: 10.1142/S1793962318500459 http://doi.org/10.1142/S1793962318500459 . .

MF Aktas , , , G Haldeman , , , M Parashar . . Flexible scheduling and control of bandwidth and in-transit services for end-to-end application workflows . . 4 th IEEE Int Workshop on Network-Aware Data Management , , 2014 . . p.28 - - 31 . . DOI: 10.1109/NDM.2014.9 http://doi.org/10.1109/NDM.2014.9 . .

I Casas , , , J Taheri , , , R Ranjan , , , 等 . . A balanced scheduler with data reuse and replication for scientific workflows in cloud computing systems . . Fut Gener Comput Syst , , 2017 . . 74 168 - - 178 . . DOI: 10.1016/j.future.2015.12.005 http://doi.org/10.1016/j.future.2015.12.005 . .

WW Chen , , , E Deelman . . Workflowsim: a toolkit for simulating scientific workflows in distributed environments . . 8 th IEEE Int Conf on E-Science , , 2012 . . p.1 - - 8 . . DOI: 10.1109/eScience.2012.6404430 http://doi.org/10.1109/eScience.2012.6404430 . .

A Deldari , , , M Naghibzadeh , , , S Abrishami . . CCA: a deadline-constrained workflow scheduling algorithm for multicore resources on the cloud . . J Supercomput , , 2017 . . 73 ( ( 2 ): ): 756 - - 781 . . DOI: 10.1007/s11227-016-1789-5 http://doi.org/10.1007/s11227-016-1789-5 . .

YS Ding , , , GS Yao , , , KR Hao . . Fault-tolerant elastic scheduling algorithm for workflow in cloud systems . . Inform Sci , , 2017 . . 393 47 - - 65 . . DOI: 10.1016/j.ins.2017.01.035 http://doi.org/10.1016/j.ins.2017.01.035 . .

N Evans , , , M Thompson . . Multiple operating system rotation environment moving target defense . . US Patent , , 2016 . . 9 294 504 . .

M Garcia , , , A Bessani , , , I Gashi , , , 等 . . OS diversity for intrusion tolerance: myth or reality . . 41 st IEEE Int Conf on Dependable Systems & Networks , , 2011 . . p.383 - - 394 . . DOI: 10.1109/DSN.2011.5958251 http://doi.org/10.1109/DSN.2011.5958251 . .

M Garcia , , , A Bessani , , , I Gashi , , , 等 . . Analysis of operating system diversity for intrusion tolerance . . Softw Pract Exp , , 2014 . . 44 ( ( 6 ): ): 735 - - 770 . . DOI: 10.1002/spe.2180 http://doi.org/10.1002/spe.2180 . .

B Grobauer , , , T Walloschek , , , E Stocker . . Understanding cloud computing vulnerabilities . . IEEE Secur Priv , , 2011 . . 9 ( ( 2 ): ): 50 - - 57 . . DOI: 10.1109/MSP.2010.115 http://doi.org/10.1109/MSP.2010.115 . .

MZ Guo , , , P Bhattacharya . . Diverse virtual replicas for improving intrusion tolerance in cloud . . 9 th Annual Cyber and Information Security Research Conf , , 2014 . . p.41 - - 44 . . DOI: 10.1145/2602087.2602116 http://doi.org/10.1145/2602087.2602116 . .

I Gupta , , , MS Kumar , , , PK Jana . . Compute-intensive workflow scheduling in multi-cloud environment . . Int Conf on Advances in Computing, Communications and Informatics , , 2016 . . p.315 - - 321 . . DOI: 10.1109/ICACCI.2016.7732066 http://doi.org/10.1109/ICACCI.2016.7732066 . .

HC Hu , , , ZP Wang , , , GZ Cheng , , , 等 . . MNOS: a mimic network operating system for software defined networks . . IET Inform Secur , , 2017 . . 11 ( ( 6 ): ): 345 - - 355 . . DOI: 10.1049/iet-ifs.2017.0085 http://doi.org/10.1049/iet-ifs.2017.0085 . .

G Juve , , , E Deelman . . Scientific workflows in the cloud . . In: Cafaro M, Aloisio G (Eds.), Grids, Clouds and Virtualization. Springer, London , , 2011 . . p.71 - - 91 . . DOI: 10.1007/978-0-85729-049-6_4 http://doi.org/10.1007/978-0-85729-049-6_4 . .

C Kallenberg , , , J Butterworth , , , X Kovah , , , 等 . . Defeating Signed BIOS Enforcement . . https://www.mitre.org/sites/default/files/publications/defeating-signed-bios-enforcement.pdf https://www.mitre.org/sites/default/files/publications/defeating-signed-bios-enforcement.pdf , , 2013 . . .

YC Lee , , , H Han , , , AY Zomaya , , , 等 . . Resource-efficient workflow scheduling in clouds . . Knowl-Based Syst , , 2015 . . 80 153 - - 162 . . DOI: 10.1016/j.knosys.2015.02.012 http://doi.org/10.1016/j.knosys.2015.02.012 . .

HW Lv , , , JY Lin , , , HQ Wang , , , 等 . . Analyzing the service availability of mobile cloud computing systems by fluid-flow approximation . . Front Inform Technol Electron Eng , , 2015 . . 16 ( ( 7 ): ): 553 - - 567 . . DOI: 10.1631/FITEE.1400410 http://doi.org/10.1631/FITEE.1400410 . .

S Pandey , , , LL Wu , , , SM Guru , , , 等 . . A particle swarm optimization-based heuristic for scheduling workflow applications in cloud computing environments . . 24 th IEEE Int Conf on Advanced Information Networking and Applications , , 2010 . . p.400 - - 407 . . DOI: 10.1109/AINA.2010.31 http://doi.org/10.1109/AINA.2010.31 . .

W Peng , , , F Li , , , CT Huang , , , 等 . . A moving-target defense strategy for Cloud-based services with heterogeneous and dynamic attack surfaces . . IEEE Int Conf on Communications , , 2014 . . p.804 - - 809 . . DOI: 10.1109/ICC.2014.6883418 http://doi.org/10.1109/ICC.2014.6883418 . .

M Platania , , , D Obenshain , , , T Tantillo , , , 等 . . Towards a practical survivable intrusion tolerant replication system . . 33 rd IEEE Int Symp on Reliable Distributed Systems , , 2014 . . p.242 - - 252 . . DOI: 10.1109/SRDS.2014.16 http://doi.org/10.1109/SRDS.2014.16 . .

M Platania , , , D Obenshain , , , T Tantillo , , , 等 . . On choosing server- or client-side solutions for BFT . . ACM Comput Surv , , 2016 . . 48 ( ( 4 ): ): Article 61 DOI: 10.1145/2886780 http://doi.org/10.1145/2886780 . .

P Stewin , , , I Bystrov . . Understanding DMA malware . . 9 th Int Conf on Detection of Intrusions and Malware, and Vulnerability Assessment , , 2012 . . p.21 - - 41 . . DOI: 10.1007/978-3-642-37300-8_2 http://doi.org/10.1007/978-3-642-37300-8_2 . .

H Topcuoglu , , , S Hariri , , , MY Wu . . Performance-effective and low-complexity task scheduling for heterogeneous computing . . IEEE Trans Parall Distrib Syst , , 2002 . . 13 ( ( 3 ): ): 260 - - 274 . . DOI: 10.1109/71.993206 http://doi.org/10.1109/71.993206 . .

A Verma , , , M Mittal , , , B Chhabra . . The mutual authentication scheme to detect virtual side channel attack in cloud computing . . Int J Comput Sci Inform Secur , , 2017 . . 15 ( ( 3 ): ): 83 - - 98 . . . .

JW Wang , , , P Korambath , , , I Altintas , , , 等 . . Workflow as a service in the cloud: architecture and scheduling algorithms . . Proc Comput Sci , , 2014 . . 29 546 - - 556 . . DOI: 10.1016/j.procs.2014.05.049 http://doi.org/10.1016/j.procs.2014.05.049 . .

J Wu , , , MX Dong , , , K Ota , , , 等 . . Big data analysis-based secure cluster management for optimized control plane in software-defined networks . . IEEE Trans Netw Serv Manag , , 2018 . . 15 ( ( 1 ): ): 27 - - 38 . . DOI: 10.1109/TNSM.2018.2799000 http://doi.org/10.1109/TNSM.2018.2799000 . .

T Yadav , , , AM Rao . . Technical aspects of cyber kill chain . . 3 rd Int Symp on Security in Computing and Communication , , 2015 . . p.438 - - 452 . . DOI: 10.1007/978-3-319-22915-7_40 http://doi.org/10.1007/978-3-319-22915-7_40 . .

GS Yao , , , YS Ding , , , LH Ren , , , 等 . . An immune system-inspired rescheduling algorithm for workflow in cloud systems . . Knowl-Based Syst , , 2016 . . 99 39 - - 50 . . DOI: 10.1016/j.knosys.2016.01.037 http://doi.org/10.1016/j.knosys.2016.01.037 . .

GS Yao , , , YS Ding , , , KR Hao . . Using imbalance characteristic for fault-tolerant workflow scheduling in cloud systems . . IEEE Trans Parall Distrib Syst , , 2017 . . 28 ( ( 12 ): ): 3671 - - 3683 . . DOI: 10.1109/TPDS.2017.2687923 http://doi.org/10.1109/TPDS.2017.2687923 . .

D Yuan , , , Y Yang , , , X Liu , , , 等 . . A data dependency based strategy for intermediate data storage in scientific cloud workflow systems . . Concurr Comput Pract Exp , , 2012 . . 24 ( ( 9 ): ): 956 - - 976 . . DOI: 10.1002/cpe.1636 http://doi.org/10.1002/cpe.1636 . .

ZB Zheng , , , TC Zhou , , , MR Lyu , , , 等 . . Component ranking for fault-tolerant cloud applications . . IEEE Trans Serv Comput , , 2012 . . 5 ( ( 4 ): ): 540 - - 550 . . DOI: 10.1109/TSC.2011.42 http://doi.org/10.1109/TSC.2011.42 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Output difference feedback and system benefit control based dynamic heterogeneous redundancy architecture