Classifying malicious behavior in paas services

Cloud computing is a popular concept for companies to outsource their virtual machine, storage, application or data center over the Internet. Cloud computing services are classified into three types. First type of service is IaaS (Infrastructure-as-a-Service) which provides operating system on a system virtual machine to cloud customer. Other type is SaaS (Software-as-a-Service) model which provides ready to use software as Google Drive and Dropbox. Finally PaaS (Platform-as-a-Service) model is in the middle of the layers and provides the specific hardware and customized applications to their users. Moreover, different users can be build and run their applications in the same platform and this ability refers as multi-tenancy. Multi-tenant structure of PaaS model comes with many advantages and disadvantages. Most of PaaS providers offer web application platforms to their tenants because it is expected that PaaS development will be web oriented. Since popular scripting languages such as Python and Ruby and virtualized platforms such as Java and .NET are commonly used in web development, providers build compatible servers with these technologies. Thus deploying many tenants' applications turns into an easy and cheap process for PaaS providers. However, different cloud customers share PaaS platform resources and it requires isolation between different applications. In this work, a security framework is developed for PaaS providers that hosts customer web applications in the same process virtual machine. In this case, applications share the same address space and threads serve to cloud application during request-response life cycle. Proposed security framework for multi-tenant PaaS providers detects malicious behavior of threads using data mining techniques. The main difference between the proposed system and the intrusion detection systems is proposed system measures thread metrics,it does not trace network activities or connections. In addition, the proposed system differs from virus scanners. It dynamically analyzes malicious behavior of threads without using a signature database. However, virus scanners statically detect malicious files or scripts. Intelligent malware detection systems have already been proposed. Operating system API calls and machine instructions are the main features in previous work, these features are usually used with different classifiers in these systems. In addition, N-Gram algorithm is also applied to feature vector to get better result using sequence mining technique in the obtained data. However, this security systems runs on operation system level which is not manageable by PaaS web application. PaaS customer needs a runtime security system that needs access just application level metrics. The measured features by the system for each user request is instant CPU share, cumulative CPU share, resource access type (CRUD) and resource access duration. In addition, resource access type sequences are also recorded to detect pattern of sequence data. N-Gram algorithm is used to analyze sequences data to enhance prediction performance with the more and the better features. Fist, a Spring Boot web application is developed within this work. This application is a simple e-commerce web site and the functionality of the operation can be mapped to CRUD. PostgreSQL relational database is connected to application. Then, this web application is deployed to Heroku PaaS platform to get more realistic cloud data from the application. Second, proposed security framework integrated into cloud application, which measures feature set of the user requests, collects them and builds a classification model from collected training data. Finally, experimental tests are running and their results are measured to evaluate system's accuracy. 100000 requests are sent to developed PaaS web application. 1% of requests are malicious and 99% of them are regular requests. Regular request scenarios are produced according to e-commerce customer regular usage of the web site. Requests mapped to CRUD operations can be illustrated with adding a product to basket, reading content of a product, updating quantity of a product in the basket or deleting an incorrect e-mail address from a user information. Malicious scenarios are implemented according to the Open Web Application Security Project (OWASP) top 10 application security risk report in 2017. After these, each risk is mapped to a CRUD operation in the scope of this work and attack scenarios are recorded. All the scenarios are running parallel using Apache JMeter. Meanwhile, proposed system measures the features and save them into the database. After the data generation process, N-Gram module runs on the data to generate features according to operation sequences of the request. Frequencies, counts, and transitions between operations are evaluated by this module. In the end of the process, N-Gram module generates 57 more features to improve classification accuracy. Ensemble learning algorithms; Random Forest, Bagging and Adaboost run on the two different data to obtain prediction results. The fist data does not contain sequence information and the N-Gram features, but the second data have them. Comparison of two different data results makes N-Gram module impacts measurable. 10 folds cross-validation technique is used in the test process. For each data and each classifier, an experiment is done to calculate misclassified instance percentage, precision, recall, f-measure and confusion matrix by Weka tool. Without N-Gram module, Random Forest classifier gets the most accurate results. 146 instances are classified incorrectly and this experiment has 0.96 precision, 0.88 recall and 0.92 f-measure values. After N-Gram features are also added to feature vector, Random Forest still obtains the most accurate results. Only 22 instances out of 100000 are classified incorrectly, and this time the experiment has 0.99 precision, 0.98 recall and 0.98 f-measure values. Experimental results show that N-Gram module improves the accuracy of the system for all classifiers. It is obvious that operation sequence data is valuable if it is processed with N-Gram algorithm. Also Random Forest algorithm has the best result not only for the N-Gram integrated system, but also for the simple system that just have resource usages in the feature vector. Proposed system can classify a malicious request correctly with the probability of 0.99 according to precision value. Recall value shows that a malicious request can be detected by the proposed system with the probability of 0.98. Finally, f-measure value, which is optimal at 1.0, shows the classifier accuracy for different classes. Since experiment has unbalanced classes with 9900 regular and 1000 malicious instances, f-measure is also evaluated. 0.98 value shows that the proposed system is accurate for both regular and malicious classes. More precise measurements and more features and data can lead the system to have better prediction results. New regular and malicious request scenarios can be run to enrich the data in the future.