Detecting Behavioral and Structural Anomalies in MediaCloud Applications

In the past years technological advances such as the increasing bandwidth in network infrastructures and new software developments such as message and agent-based systems gave rise to the field of cloud technologies, which have evolved from abstract concepts to concrete solutions, ranging from flexible, platform-independent systems to highly specialized software solutions. In this paper we introduce and evaluate two anomaly detection methods to achieve a higher level of security in a specific cloud solution for interactive media, the Media Cloud from Alcatel-Lucent. The Media Cloud focuses on real-time processing of interactive media applications, allowing for optimal resource planning using highly specific functional components. The proposed anomaly detection methods are designed to work complimentary to each other and are capable of detecting known and unknown vulnerabilities and security issues, offering very low false positive rates and very high detection rates, as is shown by the evaluation on real Media Cloud data and synthetic data. The proposed methods use behavioral and structural features, and are capable of locating the detected anomalies as well, giving the executing analyst easy insight into the running processes.