Research On Methods For Detecting Virtual Machine Abnormal Behaviors In Cloud Computing Platforms

As cloud computing develops continuously and matures, more and more businesssystems have been deployed on cloud computing platforms in order to improve thehardware resource utilization and reduce the IT operation cost. Virtual machines are thecore components in cloud computing platforms. They are responsible for providingbusiness systems with computing and storage resources to make business sytems runnormally. However, with the continuous increasing of the types and the number ofbusiness systems, scales of cloud computing platforms expand continuously and cloudcomputing platforms become more and more complex. Moreover, virtual machinesrunning on cloud computing platforms share hardware resources and it could incurresource contention problems. All of these make running virtual machines more proneto anomaly. Anomalies of virtual machines could not only cause business sytems to runabnormally and lead to inestimable loss, but also make enterprises be worried aboutcloud computing and block the development and application of cloud computing.Virutal machine abnormal behavior detection in cloud computing platforms discoversthe abnormal behaviors of virtual machines by monitoring running statuses of virtualmachines in cloud computing platforms continuously and notifies administrators to takenecessary actions in order to make virtual machines run normally. Therefore, researchon virtual machine abnormal behavior detection in cloud computing platforms showssignificant science significance and application value.This thesis does research on several key problems of virtual machine abnormalbehavior detection in cloud computing platforms. Based on the summarization and deepanalysis of related technologies and existing research results, this thesis proposes avirtual machine abnormal behavior detection framework for cloud computing platforms.At the same time, this thesis addresses several key problems such as the virtual machinerunning status information transmission strategies, virtual machine performance metricdata dimensionality reduction algorithm, virtual machine workload clustering algorithmand online anomaly detection scheme. Concretely speaking, main research contents andhighlights of this thesis are described as follows:①This thesis designs a virtual machine abnormal behavior detection frameworkfor cloud computing platforms by deploying the monitoring agent component andanomaly detection component separately. At the same time, this thesis also analyzes the working flow and features of our proposed virtual machine abnormal behavior detectionframework for cloud computing platforms.②This thesis abstracts a virtual machine running status information transmissionmodel and proposes three virtual machine running status information transmissionstrategies, which are the adaptive periodic push strategy, window-based event-drivenpush strategy, and window-based hybrid push strategy. These strategies could addressthe problems that the dynamic time interval cannot be aware of the change degree ofvirtual machine running status information and the dynamic threshold cannot be awareof the change trend of virtual machine running status information. Experimental resultsshow that our proposed strategies could meet the requirements of the virtual machinerunning status information transmission model and the window-based hybrid pushstrategy is better than current data transmission strategies in terms of the number of datatransmissions and data coherence.③This thesis designs a globality-aware locality preserving projection that reducesthe dimensionality of performance metric data and makes the reduced data obtain mostvariance information and neighbor relations between data from the original performancemetric data. Experimental results show that our globality-aware locality perservingprojection could not only improve the anomaly detection performance, but also reducethe average computational overhead and satisfy the real time requirement of anomalydetection.④An incremental virtual machine workload clustering algorithm is proposed togroup virutal machine running status information with similar virtual machine workloadinto the same clusters to improve the anomaly detection performance. Experimentalresults show that the proposed incremental virtual machine workload clusteringalgorithm could not only improve the anomaly detection performance, but also reducethe computation and then reduce the average computational overhead.⑤This thesis proposes an incremental local outlier factor algorithm-based onlineanomaly detection scheme that adopts the incremental local outlier factor algorithm toonly update the local outlier factor of each affected virtual machine running statusinformation in the cluster in order to reduce the computational complexity. Encouragingresults are obtained.