Networked infrastructures underpin most social and economical interactions nowadays and have become an integral part of the critical infrastructure. Thus, it is crucial that heterogeneous networked environments provide adequate resilience in order to satisfy the quality requirements of the user. In order to achieve this, a coordinated approach to confront potential challenges is required. These challenges can manifest themselves under different circumstances in the various infrastructure components. The objective of this paper is to present a multi-level resilience approach that goes beyond the traditional monolithic resilience schemes that focus mainly on one infrastructure component. The proposed framework considers four main aspects, i.e. users, application, network and system. The latter three are part of the technical infrastructure while the former profiles the service user. Under two selected scenarios this paper illustrates how an integrated approach coordinating knowledge from the different infrastructure elements allows a more effective detection of challenges and facilitates the use of autonomic principles employed during the remediation against challenges

Bhandari, A.

Marnerides, Angelos

Mauthe, Andreas Ulrich

Murthy, Hemma

Angelos K. Marnerides

Akshay Bhandari

Hema Murthy

Andreas U. Mauthe

Crossref

A multi-level resilience framework for unified networked environments

Lancaster E-Prints

A Multi-Level Resilience Framework for UnifiedNetworked EnvironmentsAngelos K. Marnerides∗†, Akshay Bhandari ‡, Hema Murthy‡ and Andreas U. Mauthe†∗School of Computing & Mathematical Sciences, Liverpool John Moores University, Liverpool, UKa.marnerides@ljmu.ac.uk†InfoLab21, School of Computing & Communications, Lancaster University, Lancaster, UKa.marnerides2,a.mauthe@lancaster.ac.uk‡Department of Computer Science & Engineering, Indian Institute of Technology Madras, Chennai, Indiaakshayb,hema@cse.iitm.ac.inAbstract—Networked infrastructures underpin most social andeconomical interactions nowadays and have become an integralpart of the critical infrastructure. Thus, it is crucial that hetero-geneous networked environments provide adequate resilience inorder to satisfy the quality requirements of the user. In order toachieve this, a coordinated approach to confront any challenges isrequired. However, there is additional complexity since challengesmanifest themselves under different circumstances in the variousinfrastructure components. The objective of this paper is topresent a multi-level resilience approach that goes beyond thetraditional monolithic resilience schemes that focus mainly on oneinfrastructure component. The proposed framework considersfour main aspects, i.e. users, application, network and system.The latter three are part of the technical infrastructure whilethe former profiles the service user. Under two selected scenariosthis paper illustrates how an integrated approach coordinatingknowledge from the different infrastructure elements allows amore effective detection of challenges and facilitates the use ofautonomic principles employed during the remediation againstchallenges.Index Terms—Resilience, Autonomic Networks, Network Ar-chitectures, Anomaly Detection, SecurityI. INTRODUCTIONComputer networks constitute the backbone of today’s in-formation society by providing connectivity between peopleas well as ICT (Information Communication Technology)systems. Consequently, they are increasingly mission-critical,especially when used as part of always-on services and appli-cations (e.g., Web-services, Internet Television, Cloud appli-cations, etc.), domain specific safety-critical services (e.g., AirTraffic Control (ATC) networks), critical management servicesfor operators (e.g., Utility networks), and critical real-timefinancial services (e.g., stock-market systems). The securityand resilience of such infrastructures is therefore paramountbut at the same time becomes increasingly difficult to achieve.Hence, the development of resilience mechanisms has to bea prime objective within the design and engineering process ofany system or network [1]. However, in the past, availabilitywas the main concern in the design and operation of computernetworks [1] and less emphasis was placed on resilienceaspects. Moreover, within the actual deployment of networksand ICT systems resilience aspects have also often been treatedas add-on and resilience mechanisms have been implementedwithout reference to a generic resilience framework [1]. Tryingto increase system resilience later by deploying such a genericresilience framework leads to monolithic solutions that mainlyconsider a part or a particular communication layer only.Thus, they usually focuses on a particular resilience sub-domain (e.g., security [2], or survivability [3]) and do notlook at the overall system resilience. More advanced resilientschemes that propose cross-layering methods tend to neglecthigher-layer features that express the explicit requirementsand characteristics of service users. Hence, their formulationresults in one-dimensional performance-oriented solutions thatstrictly focus on traditional network performance metrics (e.g.throughput, delay, jitter) but avoid mapping these metrics ontothe overall end-user QoE and QoS. Therefore, such approacheslead to what we consider "single-level" approaches.In this paper we first present a multi-level resilience frame-work that allows the construction of case-specific resiliencearchitectures that consider the various infrastructure levelsand further allowing the construction of user related meta-data to better control and identify challenges. User-specificrequirements are considered in order to ensure that QoEobjectives related to a given resilience strategy are met. Dueto the multi-level persona of this framework it overcomesthe drawbacks of the traditional monolithic, single systemapproaches as currently employed in some ICT infrastructure.This is achieved by the joint analysis of challenge indicatorsand co-ordinated detection actions that also help to coordinatethe remediation process at the different system elements.The remainder of this paper is structured as follows: Sec-tion II is dedicated at presenting the concepts behind ourresilience framework and Section III illustrates the practicalaspect of our framework within two case studies. FinallySection IV concludes and summarises this work.II. MULTI-LEVEL (ML) RESILIENCE FRAMEWORKAs evidenced by Fig. 1, the most important functional blockwithin our design is the adequate representation of a user ofan infrastructure. Thus, we aim at describing a user based onthree levels of observation; the application/service, networkand system levels. Our design argues that measurements offeatures related with any of these three levels is feasibleunder the assumption that a given resilience architecture thatFig. 1. Conceptual representation of Multi-Level Resiliencefollows our framework will be deployed under standardizedmonitoring and measurement methods (e.g. SNMP, NetFlow,syslog etc.).A. Self-awareness & self-defenceAll gathered information from all the three different levelswill be pre-processed at the management plane and furtheranalysed on the knowledge plane. Fig 2 provides a visualexample of how initially a client is meta-represented by the00.511.52x 10405010015020001234567x 106Application/Service − bytes/sUser Snapshot  (1 minute)System − MB/sNetwork − bytes/sFig. 2. An example of representing a single user based on the three levelsof system, network and application/service.three different levels within the knowledge plane. The exem-plar profiling case of Fig 2 illustrates the scenario of a ramp-upbehaviour in all the three levels of observation due to the byteconsumption caused by a particular application/service.Given an initial user (or group of users) profiling, theknowledge plane will enforce a dedicated component withinits internal structure to perform a statistical characterisationof a user’s activities within the observational timeframe.Apart from developing a user-specific profile, this statisticalcharacterisation will also be aggregated for all the usersand further correlated with the monitoring and measurementcomponents of the control and the data plane. Hence, anoverall characterisation of the environment is achieved andself-awareness is ensured.Naturally, the overall characterisation complies with a par-ticular mathematical model which is in a position to determinethe levels of normality, thus detecting abnormal characteristicsin real-time. Under the scenario of detecting an anomalouspattern, components within the management plane will be incharge of informing the knowledge plane. Consequently, theknowledge plane will update the overall statistical characteri-zation of its profiling on a set of users and further trigger fine-grained analysis in order to diagnose the exact cause of theanomaly. Given the outcome of this fine-grained analysis, theknowledge plane will inform the management plane in order totrigger remediation techniques and dimension the environmentresources accordingly. Thus, the property of self-defence isaccommodated.B. Self-management & self-optimizationRemediation of challenges is resulted after a coordinated actby the management and knowledge planes. In particular, themanagement plane is the actual co-ordinator at the onset of anevent. Thus, the decision regarding the type of anomaly pro-duced by the knowledge plane is sent over to the managementplane. Subsequently, the management plane initiates a policiescomponent that holds all the rules regarding the optimisationand management procedures that need to be taken within theICT environment.According to the rules provided by the policies compo-nent, immediate policies regarding traffic engineering actions(e.g. refined routing decisions, blocking) will be triggeredand further received by the control plane. Eventually, theinternal mechanisms of the control plane will re-configurethe associated settings on the hardware (e.g. routers, sensors)and subsequently update the forwarding schemes within thedata plane. Given all the remediation operations described,the properties of self-management and self-optimization forthe ICT environment are empowered by our generic multi-level resilience framework.III. ML RESILIENCE FRAMEWORK : IN PRACTISEA. Case Study 1: ML Resilience over the Cloud for MalwareDetectionBased on the generic ML resilience framework we havederived a prototype resilience architecture explicitly for theidentification and detection of malware over cloud environ-ments where its detailed description can be found in [4].The overall architecture of our approach can be seen inFigure 3 where for simplicity only three nodes are shownand the network connections between nodes are omitted.Each node has a hypervisor, a host Virtual Machine (VM)and a number of guest VMs. Within the host VM of eachnode there is a dedicated Cloud Resilience Manager (CRM)which comprises one part of the wider detection system.The software components within the CRM are the NetworkAnalysis Engine (NAE), the System Analysis Engine (SAE),the System Resilience Engine (SRE) and the Coordinationand Organisation Engine (COE). Nevertheless, the case studyof this section is explicitly addressing the operations of theNAESAESRECOEExternal NetworkCRMCloud NodeIngress/Egress RouterNetwork MonitorCloud InfrastructureFig. 3. Resilience Architecture over a Cloud Scenario for Malware DetectionNAE and SAE engines using the example of characterisingand detecting the Kelihos malware [5].Both SAE and NAE are composed by mechanisms thatautomate all the processes referring to the pre-processing ofeither network or system data. Their pre-processing outputsare subsequently fed as the primitive input for the analysisalgorithms which are also integrated and they employ PrincipalComponent Analysis (PCA) [6] and statistical timeseries onthe jointly gathered system and network features. Hence theproduced outputs are also considered as important aidingelements towards the establishment of the self-awareness andself-defence properties where the former enables the adequatecharacterisation of the three levels of network, system andapplication/service and the latter achieves malware detection.In our experiments, we aimed at assessing the fundamentalproperty of VM/service “live” migration of an HTTP server asinitiated in todays’ cloud environments and further investigateon how malware can be detected in such a scenario withina controlled experimental testbed. The experiment lasted for20 minutes and the Kelihos malware strain, Trojan.Kelihos-5,was injected on the 9th minute in one of the HTTP serverswhereas on the 10th minute the infected VM was migrated tothe second ”clean” physical host as manually commanded bythe management host. Throughout the whole experiment therewas the consistent aggreagted monitoring of system-relatedfeatures (e.g. counts of processes) and network packets for allVMs on both physical hosts from the hypervisor level usingcustom monitoring scripts embedded in the NAE and SAE.Finally, the aggregated system and network features wheresubsequently fed to our implemented PCA algorithm in orderto firstly chartacterize the joint dataset and further pinpointpossible anomalous characteristics.1) Case Study 1: Results: As evidenced by Fig. 4, eachjoint dataset is divided into 3-second bins, and each binis converted into a feature vector per each VM node. Thecombined feature vector was submitted to PCA to obtainthe k-subspace which corresponds to the normal behaviourof the traffic, and spans from a principal component pc1,through pck, whereas the remaining subspace with the lesssignificant principal components (i.e, pck+1 through pcm)maps the anomalous behaviour with respect to the variance ofthe dataset. Subsequently, we compute a distance metric thatdescribes the magnitude of the projection of the original datapoints into the anomalous subspace to quantify their maliciousbehaviour which we use to produce the anomaly score graph(ASG) in Fig. 4. In practise, this plot that is generated bythe NAE is a time-series representation which summarizes theanomalous score of each bin in the trace and thus indicatesthe level of how anomalous is each tested timebin with respectto the other measurement bins. Overall, the PCA performedextremely well and was able to show a sharp increase on theASG plot as demonstrated by Fig. 4 as soon as the Kelihosmalware was injected (≈ 160th bin in Fig. 4). Moreover,the ASG plot also shows that the PCA algorithm could alsoidentify anomalous activity after the VM migration performedright after the 200th time bin.B. Case Study 2: Multi-level Resilience in Access Networksfor Characterization & Detection of Systematic DownloadsGiven the properties of the ML resilience framework wehave derived timeseries analysis formulations in order toadequately detect systematic downloads that have becomecommonplace and consequently lead academic institutionalcampus networks being blacklisted.In this work, the number of requests per second made to aspecific publisher as obtained from the proxy logs captured ata proxy server on the Indian Institute of Technology Madrascampus is used to model the time series. In order to buildrobust models, the data is obtained for 106 such publisherswhere each one is represented by a different timeseries sincelicense agreements with each is likely to be different. Inparticular we have considered the number of downloaded files,the files downloaded at random intervals, the file sizes andthe random ordering of files of different sizes as our datafeatures. We formed the timeseries by computing the numberof requests at different polling intervals varying from 5-30seconds in 5 second bins. The time-dependent AR processwas modelled with a framelength of 3 minutes and we furthercomputed the AR process roots.1) Case Study 2: Results: The type and order of our modelis obtained by first considering the autocorrelation function(ACF) of the time series. It was observed that the ACF of thedifferenced timeseries was stationary and could be modeled asan Auto Regressive (AR) process∆(xn) = yn = xn − xn−1 (1)50 100 150 200 250 300 350 4000.20.30.40.50.60.70.80.9Time (1 bin = 3 seconds)Anomaly statisticsAnomaly Score Graph (ASG)Kelihos InjectionVM MigrationFig. 4. Output of the resulting PCA-based anomaly detection as jointly performed on network and system data that were monitored by the NAE and SAE.yn =p∑k=1akyn−k + en (2)where en is the prediction error assumed to be a generatedby a white noise process. In parallel, the order of the modelis estimated again from the ACF of the differenced series asshown in Figure 6. The differencing operation aims to addressthe non-anomalous structural breaks disclosed within networkdata where average statistics can vary depending upon thedownloading time (prime versus nonprime time).0 5 10 15 20−0.200.20.40.60.8LagAutocorrelation(a)0 5 10 15 20−0.6−0.4−0.200.20.40.60.81LagAutocorrelation(b)Fig. 5. Autocorrelation function of differenced data before (left) and afterdifferencing (right) in order to estimate the order of the model regarding apublisher(s) timeseries.−1 −0.5 0 0.5 1−1−0.500.5155Real PartImaginary PartCABFig. 6. Roots of the time-varying AR model during periods of both systematicdownloads (clusters A,B) and normal downloads (cluster C)We have identified a specific root that characterised theanomaly and was obtained by using ground truth data (i.e.the location of the region when systematic downloads arein progress), and feature selection was performed. The ARprocess roots are shown in Figure 5 where different colours areassociated with the roots corresponding to that of systematicdownload and normal traffic. It is evidenced that the rootsassociated to that of systematic downloads (marked with Aand C) are closer to the unit circle and belong to a differentcluster compared to a normal download (marked with B).IV. CONCLUSIONSToday’s networked ICT environments are increasingly chal-lenged by misuse and security issues manifested at differentlevels of the system architecture and are so far dealt withindependently. This paper introduces a multi-level resilienceframework in which the resilience activities (such as anomalydetection) are co-ordinated in order to provide better andearly defence and awareness regarding threats and challenges.This paper illustrates that architectures that comply with therequirements derived from the generic multi-level resilienceframework can adequately relate several types of informationwith respect to application, system and network-specific char-acteristics. Further, we show how mechanisms that confrontparticular challenges at the different levels at which theyare likely to manifest themselves can be co-ordinated andhence produce a better result. This is demonstrated throughcase studies focusing on the central aspects of analysis andaggregation of heterogeneous types of information.ACKNOWLEDGMENTSThe authors would like to thank the UK EPSRC and DSTIndia funded IU-ATC research project, the EU FP7 SECCRITproject and the EPSRC Situation-Aware Information Infras-tructure project for supporting this work.REFERENCES[1] Smith, P., Hutchison, D., Sterbenz, J., P., G., Scholler, M., Fessi, A.,Karaliopoulos, M., Lac, C., Plattner, B., Network Resilience: A SystematicApproach, in IEEE Communications Magazine, Vol. 49, I: 7 , pp 88-97,July 2011[2] Marnerides, A., K., Pezaros, D. , P., Hutchison, D., Detection andMitigation of Abnormal Traffic Behaviour in Autonomic Networked En-vironments, in Proceedings of ACM SIGCOMM CoNeXT Conference,Student Workshop, 2008[3] Sterbenz, J., P., G., et. al., Resilience and Survivability in CommunicationNetworks: Strategies, Principles and Survey of Disciplines, in ElsevierComputer Networks (COMNET), Special Issue on Resilient and Surviv-able Networks, vol. 54, no. 8, June 2010[4] Watson, M., Shirazi, N., Marnerides, A., K., Mauthe, A., Hutchison, D.,Towards a Distributed, Self-Organizing Approach to Malware Detectionin Cloud Computing , in 7th IFIP International Workshop on Self-Organizing Systems, IFIP/IFISC IWSOS 2013, May 2013[5] Garnaeva, M. "Kelihos/Hlux Botnet Returns with New Techniques."Securelist, http://www.securelist.com/en/blog/655/Kelihos_Hlux_botnet_returns_with_new_techniques.[6] Lakhina, A., Papagiannaki, K., Crovella, M., Diot, C., Kolaczyk, E. D.,Taft, N., Structural analysis of network traffic flows. in ACM SIGMET-RICS Perform. Eval. Rev. 32, 1, June 2004

A multi-level resilience framework for unified networked environments

Abstract

Similar works

Full text

Available Versions

Crossref

Lancaster E-Prints

Enlighten