A study on cloud security issues

2.1.1 Data breaches

A data breach is an occurrence in which sensitive, confined or private information is theft, viewed or used by an unauthorized user. This incident can be the prime intention of a targeted attack or just be the effect of an individual error or insufficient security. This data breaches can devastating any sort of data such as trade secrets, personally identifiable information (PII), health and financial information. Cloud providers organize security regulations to defend their environments. Eventually, organizations itself are answerable and responsible for shielding their own information in the cloud. Data integrity, storage security, data backup and maintenance policies are considers as some key solutions to avoid data breaches in cloud.

2.1.2 Malicious insiders

Nearly all organizations conceal their policies concerning the level of access to the workers. However, using higher stage access, an employee can get access to confidential data and services. All activities of the insider are monitor by the Intrusion Detection System (IDS) and imagine it to be an authorized action, but a reliable insider may turn into an attacker. In such a condition, insiders can cause a significant consequence on cloud services, like for instance, attacker (malicious insider) is capable to use private data and manage the services of cloud without any risk of detection. Such type of threat will related to SaaS, PaaS and IaaS. Appropriate supervision to thwart such type of threats becomes very essential in the cloud.

2.1.3 Vulnerable interfaces and APIs

Cloud providers frequently bring out a set of APIs to permit their clients to create an interface for communicating with cloud services. Each and every service and application of the cloud offers APIs. Customers and IT organizations use this interfaces for communication. Inappropriate use of interfaces will leads to threats like content transmission, clear-text authorization, improper authorization etc., because Interfaces will be the exposed element of the system. Service models like IaaS, PaaS and SaaS will affect due to this threats. This can be eliminated by using an appropriate security method for cloud provider’s interface and providing capable authentication method.

2.1.4 Account hijacking

This is the kind of hijacking which diverts the user to an improper website. Clients, services and accounts can create a new foundation for intruders. Usage of software vulnerabilities, fraud, phishing attack, reused identifications and passwords can cause to such hijacking. Some of the detection approaches to this threat contain protection policies, robust authentication and activity auditing.

2.1.5 Data loss

Permanent information loss due to cloud provider fault is extremely unusual in cloud. However, adversaries have been aware to remove the data in cloud to damage businesses. Data centers of cloud are as defenseless to natural disasters or hazards. In addition, eluding the loss of data is not only responsible of cloud provider alone. If a client encrypts his/her information before transmitting it to the cloud but misplaces the particular encryption key then undoubtedly the information will be lost. So, sufficient data backup techniques and disaster recovery mechanisms are necessary to protect data in the cloud.

2.1.6 Identity theft

Identity theft is a purposeful use of someone’s identity, to use resources and gain credentials of innocent users. The victim agonizes due to this losses and unpleasant consequences. Weak password, recovery workflows, phishing attacks, keyloggers and so on are comes under this type of thefts. However, every centralized storage system having private data for instance, confidential database of customers, passwords, private keys and so on. This private data is particularly valued target for malicious users. So, supervising, observing, key managing and identity protection should considerably be high priority.

In SaaS model customers can able to access cloud providers applications with the assistance of user interface such as web browsers. The entire organization and management of storage, server, and required infrastructure are maintained by cloud service provider. Cloud customers may not be bothered about any supervision and management. Once the data or application moves over the internet then the security and confidentiality of the data turn into censorious [108]. Unfortunately cloud customers were unaware of these security issues. Cloud provider must ensure that customers information constantly be secure in shared environment.

Securing the clients data from unauthorized or illegitimate access is the major challenge for service providers [107]. The major key security elements in SaaS model are data integrity, data security, network security, data access, data breaches, data availability, data authentication and authorization. Malicious users exploit these vulnerabilities in SaaS model and launch the attacks such as malware injections, web applications and interface issues.

2.2.2 Security challenges in Platform-as-a-service (PaaS)

In PaaS, the service provider allows customers to develop their own applications and documents on top of the platform. However, any protection beneath the application level such as NIDS or HIDS will still be in the possibility of the service provider and the provider need to proffer efficient assurance and support that the information remains unavailable/inaccessible among applications. PaaS permits cloud users and developers to construct their individual applications. This pact broadens to the security efficiencies [109].

Normally, in SaaS clients rely on the service provider for maintaining security and privacy of the application but in PaaS, management and security of the application is replaced to the client, whereas the service provider protects the primary cloud infrastructure such as operating systems, firewalls etc. Consequently, handling with major concerns like application configurations, vulnerabilities in SSL protocol and illegitimate privileges on data are turn into a client’s necessity [110]. By utilizing this flaws and vulnerabilities in PaaS malicious clients can raise some security issues like Man-In-The-Middle attack, Server injections to gain the control over legitimate user’s data.

OPEN IN VIEWER

IaaS offer virtualized computing resource through the internet. It provides resources which are extremely scalable and can be adapting on-demand. This causes the IaaS compatible for all types of workloads. With this service the customer have enhanced control by the privacy and security since there is no security gap/hole in the virtualization administrator. Practically, there are several security issues in virtualization environment [78].

One more aspect is the consistency and reliability of the information that is stored inside the service provider’s hardware. Considering the rapid development of virtualization, holding the control and maintenance over the data despite of its physical position will turn into critical. Several mechanisms have to be practiced, to gain utmost trust, privacy and security on resources of the cloud. IaaS provides only environmental security [105, 106]. Consequently the cloud user is in charge for the security maintenance of operating system, information and applications. The security issues such as denial of service, de-duplication attacks, VM migration and escape makes IaaS more vulnerable.

3.1.1 DoS/DDoS attacks

In this attack, malicious user tries to flood the victim’s system by sending useless traffic/requests from innocent hosts. This kind of hosts is called as Zombies. The typical difference between DoS and DDoS is, in Denial of service (DoS) attack the attacker uses one computer and one internet connection to flood a targeted system and in DDoS attack [21, 22] computers and internet connections are used by the intruder to flood the victim’s system. The intension of the attacker is to exhaust all resources like computational power, performance time of the victim and this can be achieved by flooding huge amount of requests through zombies. This malicious attack interrupts the actual behavior of cloud and obviously it will affect the availability of cloud services.

Various types of packets like Transmission Control protocol (TCP) packet [23], User Datagram protocol (UDP) packet, and Internet Control Message Protocol (ICMP) echo request packet are sent by the attacker to its victim (server). First type of attack (TCP-SYN) is the most happening attack. In this attack the attacker overwhelmed plenty of TCP packets with SYN flag set to its victim [24, 25]. Victim thinks that these packets are coming from regular client and then he will make a TCP connection with the assistance of three way handshake protocol with the malicious user. For each and every request victim preserves resource and waits for acknowledgement from client. Certainly, attacker never sends any acknowledgement to the victim. The buffer in the server side is capable of containing only limited number of connections. This scenario finally leads to buffer overflow and as a result, service unavailable to the legitimate user. The second type of packet (UDP) flooding occurs when a malicious client sends Internet protocol packets containing UDP data grams with the intention of slowing down the victim to the moment that the victim can no longer handle valid connections. In the third type of packet, malicious user can flood huge number of Internet Control Message protocol “Echo request” packets to the victim’s network [28, 29]. Apparently the victim will respond with corresponding number of reply packets. This

attack is also known as smurf attack. In the presence of this flooding attack, the cloud provider needs to give more computational power to serve or handle massive number of requests. Recently, several efforts has been done to identify different types [26, 27] of DDoS attacks.

Yan et al. [30] described Software Define Networking (SDN) which provides an advanced and dynamic network architecture for cloud computing. Various capabilities in SDN like software-based traffic analysis, centralized control, global view of the network, dynamic updating of forwarding rules will cause easier detection of DDoS attacks. In this paper authors covered the various novel trends and characteristics of distributed denial of service attacks in cloud computing and they gave overview of defense mechanism against this DDoS attacks using Software Define Networking. Strength of this paper includes the SDN can act as a promising technology to defeat DDoS attacks in cloud environment, but they gave a concise description about how present technologies associated to SDN.

To overcome the DDoS attacks Yu et al. [31] proposed a dynamic allotment method of cloud resources to the customers who are facing denial of service attacks and then authors provided a queuing theory based mechanism for the Denial of service attack avoidance approach in cloud. In this paper performance evaluation of proposed mitigation mechanism is done from different perspectives. The proposed mechanism is capable to overcome the DDoS attacks and it assurance the quality of service for cloud customers. However, the authors described mitigation techniques of DDoS attacks which effects only on individual cloud hosted services.

Ha et al. [32] proposed a traffic sampling strategy for software-define networking (SDN) that completely uses checkup ability of any suspicious activity. Authors discussed that if the network traffic which is to be checked is more than the capacity of IDS then, IDS is not able to inspect every packet in the network. So, it is enviable to sample a particular amount of traffic from network switches and forward it to the Intrusion Detection System using the functionalities of SDN. In this paper authors proposed a sampling rate adjustment scheme that regulates the proper sampling rates at the network switches for completely using the checking capability of malicious traffic. According to authors this proposed scheme improves the performance of intrusion detection by evaluating the sampling rate for every switch.

IDS/IPS can be used to thwart cloud from various attacks. Scarfone et al. [33] presented an overview of intrusion detection and prevention systems (IDPS) which monitors a system or a network for malicious action and reported to an administrator. In this paper authors characterized the key capacities that IDS and IPS technologies will perform.

Port scanning is a kind of damaging attack which normally does not cause much impact on virtual machines. However, it gives the precise information concerning the condition of ports which can be used in further attacks such as Denial of Service attacks [34]. The primary move to initiate the malicious activity is to find the information regarding the system by port scanning. Consequently, attacker can get information like open ports, host based network services and protocols. Based on the gathered data, intruder tries to get the better and enhanced rights over target (victim). After obtaining the essential rights of the target intruder then injects/inserts malicious code.

A brief analysis of port scanning attacks and response of intrusion detection system is discussed in Deshpande et al. [35]. In these paper the authors explained tools like ‘Scapy’, ‘Nmap’ and ‘Metaslpoit’, which are utilized to initialize these attacks. These tools can offer complete information concerning the target machine and its status and SNORT Intrusion Detection system is used to detect the port scanning attacks. This work does not specify how private cloud will affect due to this port scan attacks.

To detect port scanning attacks, analysis of the attack plan sequence and logs (audit logs and alert logs) are elaborated in Chen et al. [36]. Hidden Markov mechanism is used in this approach to identify time sequence actions and to notice corresponding attacks. The simulation results in this paper show that the proposed mechanism is capable to detect port scan attack sequences.

Requet et al. [37] proposed on the effects on large scale coordinated attacks on cloud environment and its recent security remedies. The experimental results shows that distributed coordinated attacks can be launched without being noticed or identified. But in this paper authors concentrated only on distributed port scan further analysis of distributed attacks is not discussed.

3.1.3 IP spoofing

It is a process of counterfeiting or forging the source address in Internet protocol packet for the purpose of concealing the identity of the sender (intruder) or masquerading another computing system [38]. It is also called as IP packet forgery or host file hijack. This malicious activity is used by attackers in the network to overcome security limitations in the network. Due to this activity a huge part of the internet is sensitive and vulnerable.

An Inter domain packet filter (IDPF) framework is described in Duan et al. [38] which overcomes the Internet protocol packet spoofing attacks on the internet. The proposed packet filters are rely on Border Gateway Protocol route update messages transferred on the network to guess the legitimacy of the source address of a packet. According to simulations inclined by the authors this architecture is capable enough to identify valid or legitimate packets by investigating true origins of the intruders within a small number of candidate networks.

An intruder can masquerade Internet Packet header fields. However, he cannot forge all the hops an Internet Protocol packet takes to reach its end (destination). Wang et al. [39] presented a new filtering mechanism called Hop Count Filtering (HCF) to identify and eliminating spoofed packets by constructing a perfect Internet Packet-to-hop-count (IP2HC) mapping table. This mechanism is able to remove 90% spoofed traffic, but the proposed filtering technique does not experienced or deployed in sophisticated servers to observe its efficiency to defeat the spoofed traffic.

Jeyanth et al. [40] proposed a detection algorithm to identify the legitimate traffic by inspecting the IP address and related MAC address of each and every incoming packet. If the incoming packets contain same MAC address but different IP address then it will be considered as intruder and automatically packets will be rejected. This technique is capable to detect address spoofing for each request to a service, but this mechanism didn’t examine in real-time cloud environment.

Various defense mechanisms for IP spoofing such as IP Puzzles, Martian filtering, SAVE, BASE, IDPF StackPi and Hop-count filtering are indexed and discussed in Ehrenkranz and Li [41]. This work is advantageous to upcoming development of enhanced and better defenses.

3.1.4 Phishing

Phishing attacks are known for managing and manipulating a web link and deflecting a client to a fake link to gain sensitive information [42]. In Cloud, it can be possible that an intruder use the services of the cloud to host a phishing attack site to take control of accounts and services of other customers in the Cloud [43].

Khorshed et al. [42] classified top most security attacks which are threatening the cloud environment. In this approach authors proposed a database which contains number of packets sent and receive, number of open ports, usage of network and CPU for automatic detection of these attacks.

To secure cloud from various attacks an Elliptic Curve Cryptography (ECC)-based anti-phishing protocol is proposed in Kalra et al. [43] which is based on the idea of one-time password. This protocol useful in identifying phishing attacks efficiently particularly for legitimate users in cloud but, real time simulations of the protocol against attacks are not specified.

A Dynamic Security Skins mechanism proposed by Dhamija and Tygar [44] which permits a remote web server to confirm its uniqueness an identity in an approach that is trouble-free for a legitimate client to verify and tough to an intruder to spoof. This approach presents novel techniques to thwart spoofing. The strength of this scheme includes it places an incredibly low burden on the user in terms of time, effort and memory.

To beat phishing attacks Huang et al. [45] discussed a verification mechanism that authenticates all the users with one-time passwords rather than permanent user-defined password. The proposed mechanism is able to decrease the costs of deployment to almost zero, at the same time it increases the possibility of the solution. However, this instant report/message accounts will turn into selective targets for the attackers.

3.1.5 SQL Injection

An SQL query is a request of action executed on database. SQL Injection is a kind of code injection method, which is used to attack the applications in the cloud by inserting malicious code in the entry field of SQL statement. These injection activities can permits the intruders to perform identity spoofing, tampering the data, denial of service etc. [46] presented detailed description of the Structural Query language.

To detect SQL injection attacks in cloud application Wu et al. [46] suggested Cloud Computing SQLIA Detection (CSSD) mechanism. Moreover, this method can be useful and applicable to any cloud environment with high accurateness and low consumption of cost, but this mechanism is only useful for detecting injection attacks.

Bisht et al. [47] proposed a new approach CADID used to dynamically infer the programmer intended Structural Query Language queries structure and efficiently change applications so that they protect themselves against SQL injection attacks. This proposed technique is scale to most web applications.

Cloud Computing Adoption Framework is offered by Chang et al. [48] and this work is done by incorporating three major security technologies such as firewall, encryption and identity management. According to the authors this approach provides protection and security and capable to detect SQL injection issues in cloud. This technique is capable to identify and block 9995 viruses and Trojans. Conversely, the proposed mechanism is not able to detect false alarms.

3.1.6 Man-In-The-Middle attack

It is a malicious activity where the intruder stealthily alters the communication between two parties who thinks they are communicating with each other directly [49]. An instance of Man-In-The-Middle attack is eavesdropping, in which the intruder makes separate connections with two parties (victims) and delivers messages between them. In cloud, a malicious user is capable to access the information which transfers between datacenters [7, 50].

Karadsheh [51], Grobauer et al. [52] elaborated various major security issues which decreases the development of cloud computing and discussed various existing solutions. Authors gave a detailed description about common threats, vulnerabilities and risks in cloud.

Based on public key encryption a security mechanism is proposed by Sujitha et al. [53] to defense against various malicious activities. This technique affords an enhanced level of security by utilizing Rivest Shamir Adleman (RSA) algorithm. The advantage of this proposed mechanism is, it is adoptable for running any application.

Ma et al. [54] proposed an attacker detection mechanism using Bayesian-based prediction algorithm. This approach used Software Define Networking (SDN) technology to route ARP packets and manage communication and association of the entire network, but this approach is not been analyzed in real environment.

3.1.7 Sniffer attack

If packets in the network are not ciphered or encrypted, a sniffer (device or application) can examine, read and capture data exchanges in network and it can give complete outlook of packets data. Moreover, it can able to check the packets which are encapsulated except they are encrypted [55]. This malicious activity leads to victim network to crashes and turn into corrupted.

To improve the capability to defend against sniffer attack, SDN-based double hopping communication (DHC) is proposed in [55]. According to the authors this proposal will be helpful as an efficient anti-sniffer by actively transmitting the data across several paths by altering routing path, but this proposal is tested under a centralized controller.

Xiong et al. [56] elaborated an identity-based secure document self-destruction scheme by incorporating identity-based encryption algorithm and distributed hash table network for securing the confidentiality of the user’s private data in the cloud. This approach concentrated more on Sybil and brute force attacks. Moreover, this approach supports flexible policies of access control during the lifetime of the original documents.

Debar et al. [57] presents a classification that elucidates the characteristics of various security attacks and intrusion-detection systems and described recent developments appropriately. Further, authors delineate number of examples from past and present activities, but this paper does not provide sufficient information about identification of major attacks like insider attacks.

3.1.8 Theft of service

An intruder initially identifies all the vulnerabilities of hypervisor and is capable of using the VM for longer period time and that will cause a financial effect on cloud infrastructure consequently, there will be no record of legitimate client’s activity which originates a significant risk to cloud environment [58].

Ahmad et al. [58] reviewed the all the imperfections of Kernel Virtual machine and presented a key solution by implementing an Application Program Interface, on the basis of virtual machine power consumption that will detect and thwart theft-of-service attacks. This proposed technology is able to give additional secure cloud platform to practitioners, but this approach is processed on private cloud along with minimal processor cores and storage.

Insider threats which are associated with cloud are reviewed in Claycomb and Nicoll [59]. Authors gave brief presentation of occurrences of insider threats and elaborated the classification of service providers in cloud, but this paper gave solutions and explanations on exiting issues only there is no detection mechanisms are discussed which are deal with actual threats in cloud environment.

Quantum verification/authentication mechanism is proposed in Dong et al. [60] to thwart malicious users from interfering into services of the cloud. According to this paper, any individual who tries to break the identity of cloud service provider, data owner and data user of a cloud model to harm the data in the cloud then he can be identified, but this paper not discussed about protection of confidentiality and privacy in cloud computing based on quantum authentication.

3.1.9 DNS spoofing

DNS (Domain Name Server) spoofing or poisoning is a kind of cyber-attack or hacking of the computer that uses vulnerabilities of the system in the domain name server to redirect traffic away from genuine servers and manage it to intruders computer. i.e., it is a malicious activity in which fraudulent Domain Name System data is suggested into a DNS resolver’s cache (client side of the DNS) inducing the name server to send back a false or fake IP address [61, 62]. Consequently, traffic will be sidetracked to malicious user’s computer.

An anomaly based IDS (Intrusion Detection System) for DNS is presented in Satam et al. [61] to identify abnormal activities in DNS. In this proposed detection mechanism, an anomaly metric is developed for Domain Name System protocol and considered it as a metric of temporal statistics for both genuine and malicious activities.

Bassil et al. [63] offered an S-DNS (secure-DNS) protocol for preventing DNS poisoning attacks and man-in-the-middle attacks by using a capable Identity Based Encryption key mechanism which mitigates DNS collaborating/interacting systems, but this protocol is not able to avert other attacks like Denial of service.

By tracing the anomalous/abnormal actions of name servers Wang et al. [64]proposed a feature analysis/examination mechanism. In this paper real time analysis of DNS traffic in the extensive network environment is done, but this approach was analyzed normal/common domain servers not suspicious name servers.

3.2.1 VM migration attack

The Virtual Machine Migration is a procedure of relocating a VM to a different physical machine without shutting down the VM. This process is implement for the various reasons like maintenance, balancing the load and fault tolerance with respective to sharing and storage space management. At the time of the migration, VM contents are uncovered to the network that will bring out privacy, confidentiality and integrity issues [66, 67].

Wang et al. [68] Discussed the mechanism of evaluating possible threats which are concealed behind the regular Virtual Machine Migration and investigated the pitfalls of present Intrusion Detection and Prevention system for protecting a novel Distributed Denial of Service attack such as CDF (Cloud-Droplet-Freezing) attack, which is capable to obstruct/congest cloud servers network communication, but this approach doesn’t specify any definite mitigation mechanisms.

A novel securing VM migration auction process is proposed by Majhi and Dhal [69] to increase the accessibility of the resources of the cloud by the business association of cloud provider. This work analyses possible threats and related security necessities for Virtual Machine Migration Auction system, but this approach illustrates finite number of threats and vulnerabilities.

To avoid downtime of Virtual Network in migration process a virtual network clone migration mechanism is proposed by Melo et al. [70]. This approach performs cloning function of Virtual Router and relocates the Virtual router to other physical machine, but this mechanism is vulnerable under suspicious hypervisor.

By considering and analyzing the necessity for physical isolation between reliable and unreliable virtual resources, Liu et al. [71] presented security specifications of virtual network. Authors proposed two algorithms to resolve the security and privacy-aware network embedding issue, but in this approach parameters of the algorithms are chosen statistically.

In virtualization environment, to generate a preview of processor status, disk and memory of the VM, the hypervisor is able to suspend a virtual Machine during its execution and later it can resume that snapshot. This functionality is useful for maintenance of Virtual Machine and fault tolerance. Unfortunately, malicious users leverage this process to launch the rollback attacks by bypassing some security checks in the Virtual Machine and are able to employ brute force attack to damage the privacy of the VM. Specifically, a hypervisor is compromised by the attacker capable to run a Virtual Machine from a previous preview/snapshot without client’s awareness. This leads to confidentiality and integrity issues [7].

Various rollback security issues were discussed and analyzed in Shoundic et al. [73]. Authors proposed a key solution to Virtual Machine issues by designing extended hyper-wall framework, which persuade integrity and privacy of user’s data in a cloud environment, but the proposed architecture is capable for thwarting only rollback attacks.

Zhang et al. [74] discussed an approach named as CloudVisor which affords efficient integrity and privacy assurance of data in virtual environment, even if the Virtual Machine Monitor (VMM) and software management are compromised by the attackers. This mechanism can be achieved by using available hardware backing for virtualization and reliable computing, but the functionality of this proposed mechanism is quite simple and not feasible to employ in firmware.

For proper identification of virus in Virtual Environment, an antivirus scheme VirtAV is proposed in Tang et al. [75]. This proposed scheme uses signature of the memory to identify infectious actions. By sampling three thousand samples VirtAV achieved cent percent finding rate from open virus specimen, but this approach is will possibly take more time to scan the virus.

Yields additional attacks that can be migrated to the cloud Dunlap et al. [76] introduced a new technology called ReVirt to solve integrity issues of logger in virtualization environment by employing audit logging. This mechanism wraps the target system (applications and OS) inside a VM and then the logging system is resided below under VM.

3.2.3 VM based side-channel attack

Resource sharing is one of the major benefits of the cloud, but allowing malicious users access to the same resource causes cache-based side channel attacks. This attack functions by building an association between the software and basic hardware. Intruders used to identify the actions of a co-resident Virtual Machines by inspecting utilization of cache and able to take out or extract the confidential cryptographic keys of innocent hosts. This kind of malicious actions bypasses the VM isolation in the cloud environment also.

Godfrey and Zulkernine [77] discussed a pair of techniques to mitigate this side channel attacks. Among them first technique is flushing the cache selectively among the Prime and Trigger steps, in that way thwarting the inquiring occurrence from ever seeing a pattern in the shared cache hit information. The second one is, partitioning the cache into several smaller chunks and permits each Virtual Machine access to a division of these sections. According to authors the proposed mechanisms are efficient to detect and prevent side channel attacks in shared environment, but these techniques are probably overhead to deploy in the cloud.

The discussion of various security concerns occurred from sharing the physical resources is presented in Ristenpart et al. [78]. In this approach, authors elaborate probability of mapping the infrastructure of the cloud and categorize the location of victims Virtual Machine and then incorporates the new Virtual Machine. Authors described this prevention technique to defense against cache-based side-channel attacks.

The scenario of cache-based side-channel in a shared environment is explained by Shi et al. [79]. Authors presented a novel coloring technique to cache division vigorously to thwart side-channel attacks during an application executing secure sensitive-operations, but this method is not applicable to authenticate another virtualization mechanisms.

3.2.4 Virtual machine escape

VMs are intended to run in self-supported and confined situation. However, malicious user executes the program on a virtual machine that permits an OS running within it to come out and communicate with the hypervisor directly [80]. By doing this an intruder will able to get root privileges and able to access the host machine and each and every VM running on the host. This malicious activity causes disruption in the confidentiality and security of the virtual environment.

Rehman et al. [80] reviewed various security issues in the virtual environment. The main intension this approach is clear understanding of the risks and vulnerabilities by the cloud client while scheming and employing the VM. In this paper, authors provided simulations regarding some familiar attacks on virtualization.

A secured architecture is presented in Luo et al. [81] which is used to effectively resolve the risks occurring in the virtualization. This proposed security scheme which presents some key possibilities to tackle the growth of virtual Machine issues, vulnerabilities and risks, but this work didn’t provide any real time simulations of these defense mechanisms.

Hardware based mechanism is discussed in Jin et al. [82] to secure guest Virtual machines beneath unreliable hypervisor. This method increases the hardware maintenance for storage virtualization on the basis of nested paging with reduced hardware cost. This approach decreases the complexity and provides security against various physical intrusions in cloud datacenter.

3.2.5 VM scheduling attack

In Virtual environment a hypervisor is able is offer a number of VMs (Virtual Machines) on a particular PM Physical Machine. Each VM executes a unique OS instance. All the scheduling functionalities of these VMs such as Input output performance, load balancing are handled by the scheduler in virtual machine. The scheduler become vulnerable [83] to malicious activities done by the intruders [84] who are trying to do theft-of-service or exploiting more usage of resources by the same admin domain.

By considering flaws in the scheduler utilized by the Xen hypervisor and Amazon EC2 Zhou et al. [83] elaborated timing-based manipulation vulnerabilities. Authors gave detailed description about the mechanisms that Xen and Amazon EC2 schedulers using to thwart scheduler layer attacks. This paper presented detail analysis-based modifications which are used to prevent scheduling issues.

An input and output performance analysis mechanism named as vExplorer is introduced in Yang et al. [84]. This proposed method facilitates to recognize the features of disk Input/Output scheduler in Xen and VMware hypervisors. However, this approach identified I/O scheduling issues only on hypervisor. But the Scheduling based vulnerabilities on Virtual Machine are not specified.

To resolve the issues of resource scheduling, a variety of scheduling algorithms based on factors like security conscious, energy efficiency are addressed by Prajapati et al. [85]. This survey found that in cloud computing there is inadequacy of security-aware scheduling mechanisms and algorithms. The analysis of existing algorithms is based on criteria’s like performance, cost, and utilization of resource, computation time, priority, bandwidth and availability of resources.

It is method that stores only single copy of a redundant data in cloud storage and links the repeated copies of the data to the original data copy. This procedure is used decrease bandwidth and storage of the cloud. On the other hand, this process raises security issues in cloud computing [88, 89]. An intruder is capable to identify the files as well as the contents of legitimate user and there is a possibility for the attackers to install harmful software in genuine users system.

Kaaniche and Laurent [89] presented a detailed preview of de-duplication mechanism in cloud environment and demonstrated that how this scheme will be a communication channel to identify the data inside the genuine users files. This work discusses other security issues regarding de-duplication and presented a novel mechanism that permits cross-client de-duplication used to decrease leakage of the data. This proposed technique used to enhance privacy assurance to the cloud customers regarding their data.

A novel de-duplication encryption mechanism is proposed in Miao et al. [90] which is used to defend the collision attack between various key servers and cloud server and this scheme is based on threshold signature. This security system is helpful to oppose the brute force attack and achieved the required security and privacy properties.

To attain confidentiality and integrity, a security-based mechanism is proposed in Puzio et al. [9] named as CloudDedup. This proposed mechanism facilitates block level de-duplication. This approach is completely adaptable with storage Application Program Interfaces (APIs) and evident for cloud providers, but this mechanism analyzed only storage and retrieval operations. Complete analysis of performance is not provided.

3.3.2 Data scavenging

While erasing information from a repository, the system does not remove the data completely. As a result, the erased data is recovered by the malicious user this process is referred as data scavenging [92, 93]. In multi-tenant environment, data scavenging is occurring when same resource is allocated to multiple users. The information and storage of earlier/previous customer may available to new customer.

A detailed description for cloud computing security is presented in Hashizume et al. [92]. The vulnerabilities due to data scavenging are addressed and to mitigate this activity, detection strategies on Service level agreements (SLA) are specified.

A digitized signature mechanism for providing secured communication of data is described in Somani et al. [93]. The proposed approach utilized RSA algorithm. A message digest is hashed and consequently encrypted. For further verification the encrypted text is then decrypted. In the same way, Kaaniche and Laurent [94] presented an approach for data sharing on a cloud using de-duplication. This mechanism facilitates security and privacy by encrypting/enciphering data and wrapping up security rights in isolated record. The deciphering/decryption of data is able to carry out only by legitimate or authorized customers.

The web services use several protocols like E-Business XML, Block Extensible Exchange Protocol (BEEP), and Simple Access Object Protocol (SOAP). An attacker can exploit and manipulate the message headers with invalid requests [95]. For assuring valid request and executing of the services safely, the verification scheme and security strategies can be employed. To handle various possible web services layer attacks, firewalls can be utilized to detect and mitigate [96].

Intrusion detection and Prevention system (IDPS) is used to monitor and analyze suspicious incidents and generate reports to network administrator in Scarfone et al. [33]. This system examines the application protocol behavior to detect and mitigate the unauthorized access and abnormal traffic flow.

The Detection mechanism of signature wrapping attacks in web services is presented in Gruschka and Iacono [95]. This approach describes the validation mechanism needed to effectively monitor the arriving Simple Access Object Protocol requests. By analyzing the vulnerabilities of Amazon Elastic Cloud, a realistic directive for managing a vigorous and efficient SOAP request security verification scheme is provided.

3.4.2 Malware injection

If a cloud platform permits a customer to an insecure and unprotected interface for developing the application then an intruder can capable to perform malicious service implementation. Such type of malware possibly will serve any specific purpose the intruder is intended in. Specifically, in malware injection attack an intruder uploads a falsified copy of a genuine user’s service instance in order that a few service instances to victim (genuine user) service are managed and processed inside that malicious instance. So as to achieve this, the intruder has to obtain control over the data of victim in the cloud environment.

A novel mechanism which identifies malware attacks using historical information is discussed in Liu and Chen [97]. This approach utilizes logs to developing and scripting of files in PE (Portable Executable) format. Whichever changes are made to Portable Executable files due to malware injections subsequently, log manager will capture all the suspicious activities. Simulations of this approach show that it is efficient to detect the attacks with 83% accuracy.

A scheme for active analysis of malware and malicious code is presented in Martignoni et al. [98]. Once the code is submitted to the cloud, then examination of code is done systematically to find out whether it is a normal code or malicious code. This mechanism performs efficiently to detect and mitigate the suspicious malware activities in the cloud.

3.4.3 Shared architecture issues

On a multi-tenant environment, malicious client can able to trace normal user’s execution path. This activity can be additionally used to identify victim’s movements/actions and take control over his (victims) account.

Coppens et al. [111] discussed if-conversion mechanism which is used to handle time based side-channel attacks. The recommended mitigating mechanism facilitates control-flow based side channels in which the execution of the program is traced by detecting the path pursue through the program execution. The code transformation for conditional execution safeguard in opposition to the side channel attacks.

A mitigation mechanism which examine cache based side channel issues is characterized in Doychev et al. [112]. For analysis and detection of the such attacks, this scheme considered cache parameters and a binary file. This mechanism utilizes the components like iterator and parsers to analyze the issues.

3.4.4 Steganography attacks

During file transmission in a network, the Intruders insert malicious code inside the files. Security mechanisms ignored the files which contains the malicious content and treated them as regular files. Therefore, in recent times, analysts discovered that such attacks will be very severe in certain hazards on security and integrity in cloud storage.

To thwart steganography attacks Liu et al. [113] proposed a scheme called stegAD which integrates two algorithms named as enhanced-RS and SADI for identifying the damaged files and regulate hidden places with random noise correspondingly. The main intention of this scheme is to defend the audio steganography attacks.

Categorization of steganographic communication schemes in cloud computing based on steganograms receiver locations is discussed in Mazurczyk and Szczypiorski [114]. These mechanisms and threats have to be taken into account while designing secure and protected cloud services.