\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Managing DDoS Attacks on Virtual Machines by Segregated Policy Management},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014-01-15 (revised: 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014-01-15}
\title{Managing DDoS Attacks on Virtual Machines by Segregated Policy Management}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{E.S.Phalguna  Krishna}

             \affil[1]{  JNTU}

\renewcommand\Authands{ and }

\date{\small \em Received: 16 December 2013 Accepted: 1 January 2014 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


Security is considered as most crucial aspect in cloud computing. It has attracted lots of research in the recent years. On the other hand, attackers are exploring and exploiting the vulnerabilities in cloud. The heart of the Cloud computing lies in Virtualization technology. Attackers are taking the advantage of vulnerabilities in Virtual Machines and they can able to compromise virtual machines thereby launching DDOS attacks. Services such as Saas,IaaS which are meant to support end users may get affected and attackers may launch attacks either directly or by using zombies. Generally, Data Centres own security policies for dealing with security issues. Suppose incase of DDoS attacks, only the policies which deals with it ,can only been applied. However, in datacenters, all the security policies are commonly been applied on the applications irrespective of their category or security threats that it face. The existing approach consumes lots of time and wastage of resources. In this paper, we have developed an approach to segregate the applications as per the type or threats (by adapting detection mechanisms) being faced . Based on the zone in which it is lying , only the relevant security policies will only be applied. This approach is optimized where we can efficiently reduce the latency associated with applying security policies.

\end{abstract}


\keywords{Suppose incase of DDoS attacks, adapting detection mechanisms, Saas, IaaS.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
irtualization is considered as back bone for cloud computing ,With which users can access multiple instances of apps, resources etc.Virtualization technology will allow one computer to do the job of multiple computers.This environment let one computer host multiple operating systems at the same time.It transforms hardware into software.It is emulation of a fully functional virtual computer that can run its own applications and operating system and also Creates virtual elements of the CPU, RAM, and hard disk. Hardware-independence of operating system and applications. Hence, using virtualization it is possible to run operating systems and multiply applications on the same SERVER at the same time, thereby it raises the utilization and flexibility of hardware. Some of the virtualization technologies include VMWare, Hyper V,Virtual Iron etc., These are the things that can manage OS and application as a Single unit by encapsulating them into Virtual Machines. A Virtual machine (VM) is an efficient, isolated duplicate of a real machine. Virtual machines can be provisioned to any system. 
\section[{i. Duplicate}]{i. Duplicate}\par
The behaviour of the VM should be identical to the real machine. There is no differentiation with respect to the execution of the program at the low level.\par
ii. Isolated Multiple Virtual Instances corresponding to different VMs execute without interfering with each other.\par
iii. Efficient VM should operate at the speed of the underlying hardware.\par
All the resources of the physical computer are shared to create the virtual machines.By virtualization, it creates an emulation that user is actually using owned resources.But at the implementation level,these resources are shared between multiple number of users at any given point in time.Further,Disks are partitioned into virtual disks and a normal user time sharing terminal serves as Virtual machine operators console.  They are also Called Hypervisors or virtual machine monitor or VMM.Hypervisors of this type is dependent of bare metal (bare machine) and always interacts with the machine. They Sit just above the HW and virtualizes the complete hardware. It runs at the physical hardware and is the real operating system. Normal unmodified operating systems, like Linux or Windows runs atop of the hypervisor. The server which is hosting Type 1 Hypervisor requires some form of persistent storage for storing the files of concern. In ESX server, the kernel uses device drives to actually get interfaced with bare metal.\par
? Example: Xen, VMware ESX server b) Type 2 hypervisor It is considered as most common type of hypervisor and depends on the underlying OS.Such hypervisors requires to be directly installed on bare metal.It runs within an OS, and rely on OS services to manage HW. A normal unmodified host operating system like Linux or Windows runs on the physical hardware.\par
A type 2 hypervisor like VMware Workstation runs on the host operating system.Once after installing host operating system, we can now deploy hypervisor and it doesn't modify it. Examples include QEMU, VMware Workstation etc.\par
ii. 
\section[{Threats on VMS}]{Threats on VMS}\par
Like any other technology, Virtual Machines are prone to different categories of threats.Some attacks against virtual machine, or VM, environments are variations of common threats such as denial of service etc. Others are still largely theoretical but likely approaching as buzz and means increase, these are the critical weaknesses. 
\section[{a) VM Sprawl}]{a) VM Sprawl}\par
VMs are easy to deploy, and many organizations view them as hardware-like tools that don't merit formal policies. This has led to VM sprawl, which is the unplanned proliferation of VMs.\par
Attackers can take advantage of poorly monitored resources. More deployments also mean more failure points, so sprawl can cause problems even if no malice is involved. 
\section[{b) Hyperjacking}]{b) Hyperjacking}\par
Hyperjacking takes control of the hypervisor to gain access to the VMs and their data. It is typically launched against type 2 hypervisors that run over a host OS although type 1 attacks are theoretically possible but practically difficult.\par
In reality, hyperjackings are rare due to the difficulty of directly accessing hypervisors. However, Hyperjacking is considered a real-world threat, and administrators should take the offensive and plan for it. c) VM escape A guest OS escapes from its VM encapsulation to interact directly with the hypervisor.By doing so, the attacker can gain access to all VMs and, if guest privileges are high enough, the host machine can also be targeted as well. Although few, if any instances are known, experts consider VM escape to be the most serious threat to VM security. 
\section[{d) Denial of Service}]{d) Denial of Service}\par
Considered most common threat.These attacks exploit many hypervisor platforms and range from flooding a network with traffic to sophisticated leveraging of a host's own resources. The availability of botnets continues to make it easier for attackers to carry out campaigns against specific servers and applications with the goal of derailing the target's online services. 
\section[{e) Incorrect VM Isolation}]{e) Incorrect VM Isolation}\par
To remain secure and correctly share resources, VMs must be isolated from each other. Improper control over VM deployments can lead to isolation breaches in which VMs communicate. Attackers can exploit this virtual drawbridge to gain access to multiple guests and possibly the host. The attacker can take the loop holes in the interfaces and can attack. 
\section[{f) Unsecured VM migration}]{f) Unsecured VM migration}\par
This occurs when a VM is migrated to a new host, and security policies and configuration are not updated to reflect the change. Potentially, the host and other guests could become more vulnerable. Attackers have an advantage in that administrators are likely unaware of having introduced weaknesses and will not be on alert. 
\section[{g) Host and guest vulnerabilities}]{g) Host and guest vulnerabilities}\par
Host and guest interactions can magnify system vulnerabilities at several points. Their operating systems, particularly Windows, are likely to have multiple weaknesses. Like other systems, they are subject to vulnerabilities in email, Web browsing, and network protocols. However, virtual linkages and the co-hosting of different data sets make a serious attack on a virtual environment particularly damaging. 
\section[{h) Dynamic environment}]{h) Dynamic environment}\par
Tracking and updating what you have can be a challenge as people create, suspend and move virtual machines. If you don't update your golden image from which virtual machines are deployed, you can end up needing to find and patch many virtual machines. 
\section[{i. Mitigating Risk}]{i. Mitigating Risk}\par
Inorder to overcome the existing problem with respect to the security, one can take Several steps to minimize risk.\par
? Characterization:The first task is to accurately characterize all deployed virtualization and any active security measures beyond built-in hypervisor controls on VMs. ? Standards: Security controls should be compared against industry standards to determine gaps. Coverage should include anti-virus, intrusion detection, and active vulnerability scanning. Additionally, consider these action steps:\par
ii. VM traffic monitoring Efficient monitoring of VM backbone network traffic is critical. Conventional methods will not detect VM traffic because it is controlled by internal soft switches. However, hypervisors have effective monitoring tools that should be enabled and tested.Also , by maintaining traffic logs ,one can have vigilance over the network traffic.\par
iii. Administrative control Procedures such as authentication, authorization, Identity management etc must be done as a regular process by the concerned admins.Sometimes, Secure access can become compro-mised due to VM sprawl and other issues. iv. Customer security Outside of the VM, make sure protection is in place for Customer interactive interfaces such as websites. 
\section[{v. VM segregation}]{v. VM segregation}\par
In addition to normal isolation, strengthen VM security through functional segregation.\par
For example, consider creating separate security zones for desktops and servers. The goal is to minimize intersection points to the extent feasible.\par
iii. 
\section[{Virualization Vulnerabilities}]{Virualization Vulnerabilities}\par
Virtualization has eased many aspects of IT management but has also complicated the task of cyber security. The nature of virtualization introduces a new threat matrix. a) Single Server A perfection of properties like isolation is yet to be completely achieved. b) Ease of reconfiguration Ability to flexibily reconfigure restart and also movement of VM's to other servers. Because of this easeness, an optimal environment to propagate vulnerabilities and unknown configuration errors has been created. 
\section[{c) Dormant machines}]{c) Dormant machines}\par
In public-cloud environments, VM is available to any application even though it is offline.\par
? For example, a Web server that can access the physical server on which it resides. ? So a remote user on one VM can access another dormant VM if both reside on the same physical server. ? As Dormant machines can't perform malware scans, they are highly susceptible to malware attacks.  
\section[{Global}]{Global} 
\section[{c) Decision Maker}]{c) Decision Maker}\par
This Module applies "Outlier Analysis" technique to discriminate and differentiate different types of flows or vulnerablilities. For example: Normal traffic, Flash Crowd traffic, DDOS traffic etc. Our approach using Outliers requires lesser amount of computations and considered to be effective in discriminating the attacks. 
\section[{d) Zone Manager}]{d) Zone Manager}\par
Based upon the nature of VMs, it is prescribed to adopt necessarily relevant policies. 
\section[{i. Advantages}]{i. Advantages}\par
? Optimizes the application of rule sets on different categories of applications. ? This approach significantly reduces the time taken by the data center admin by applying only essential set of security policies.\par
ii. Block diagram V. 
\section[{Methodology}]{Methodology}\par
Users from various locations sends the service requests in the stream of packets to the Virtual servers/ Virtual machines, which internally utilizing virtualization technology. The packets arrived are feeded into the "Packet Feeder" module which acts as entry point for this approach. The responsibility of the packet feeder is to collect packets from various incoming streams and feed them to the module "Flow Discriminator".\par
The flow discriminator which takes various streams of packets as input differentiates what type of packet stream it is based on its properties like file extension, contents in the packet etc and categorizes them accordingly such as multimedia, voice, text, images etc. The discrimation is done mainly to adopt the relevant decision strategies and appropriate security policies. All categorized packet streams are given as input next module named "Decision Maker". Decision Maker is the most important module which applies Outlier Analysis technique to discriminate and differentiate different types of vulnerablilities in the flow. For example : Normal traffic, Flash Crowd traffic, DDOS traffic. An advantage of using Outliers in this approach just not only requires lesser amount of computations but also considered to be effective in terms of discriminating the attacks.\par
Finally the identified malicious traffic from normal traffic is sent to the "Zone Manager" which in turn discriminates the DDOS traffic from FLASH CROWD traffic. Based upon the nature of VMs it is prescribed to adopt necessarily untypical policies to safeguard users trust. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XIV Issue VI Version I22 ( D D D D )\par
Year 2014\par
This paper consists of three cases: Normal Traffic, DDoS, Flash Crowd. Based on the case, we apply the relevant necessary security policies. This is in converce with the previous approach, where in which the admins of the data centre used to adopt common security policies for discrete set of applications. The previous approach not only consumes time but also leads to consuming more number of processor cycles. 
\section[{VI.}]{VI.} 
\section[{Analogy}]{Analogy}\par
Normally datacenter own discrete categories of applications. Inorder to provide the security, each and every data center maintains set of security policies.It specifies what it means to be secure for a system, organization or other entity. But the scenario is like data center admins or tools apply complete set of security policies irrespective of the concept thereby consuming lots of processor cycles and raises latency.\par
In this paper, we have used an approach to segregate the applications as per the type or threats (by adapting detection mechanisms) being faced and we segregate them into zones. Based on the zone in which it is lying, only the relevant security will only be applied. This approach is optimized where we can efficiently reduce the latency associated with applying security policies.\par
Consider a scenario in which a data center hosts different set of software applications on their infrastructure. Let S be the main rule set, there exists Subsets S i , S j , S k . For example A, B, C, D applications belong to a particular type of application (multimedia) or facing particular threat (DDoS). Let P, Q, R \& X, Y be different categories. Then suppose, A, B, C, D, are the applications that are facing DDo S attack as a threat at this instance, Then it may be relevant to apply for example Si set of rules on those machines which are affected by it, Instead of applying S. Where Si, Sj, Sk ? S. We assumed applications A,B,C,D as web apps and they are prone to DDoS attacks and Si as the subset of rule set that consists of the security policies and mitigation strategies to be applied for DDo S. Similary S j ? (P,Q,R,S) and S k ? (X,Y).\par
vii. 
\section[{Applcations}]{Applcations}\par
? The approach can be adopted to the data centres consisting diversified applications. ? The approach is applicable to the data centers which considers security as a service.\par
viii. 
\section[{Security Policies}]{Security Policies}\par
A security policy is a comprehensive document that defines a companies' methods for prevention, detection, reaction, classification, accountability of data security practices and enforcement methods.It generally follows industry best practices as defined by ISO 17799, 27001-02, PCI, ITIL, SAS-70, HIPPA , SOX or a mix of them. It is the key document in effective security practices. Following are some of the policies of data centers:\par
? Develop a checklist for standard operating procedures to follow in the event of an attack, including internal firewall teams, intrusion detection teams and network teams. Identify who should be contacted during an attack, what processes should be followed by each and what information is needed. ? ISPs and hosting providers might provide mitigation services. Be aware of the service-level agreement provisions. ? Identify and prioritize critical services that should be maintained during an attack so as to keep resources turned off or blocked as needed to limit the effects of the attack.\par
? Ensure that critical systems have sufficient capacity to withstand an attack.  
\section[{a) Mitigation Strategies of DDOS attacks in data centres}]{a) Mitigation Strategies of DDOS attacks in data centres}\par
Data centres cannot rely on their ISP alone to provide a complete DDoS solution that includes application layer protection.\par
To protect against application-layer DoS, several mitigation strategies can be considered: iii. Two-factor authentication to validate user roles, especially at admin levels. iv. Advanced next generation firewalls (NGFWs), such as Fortinet's FortiGate products, offer DDoS and IPS services. v. Dedicated DDoS Attack Mitigation Appliances:\par
These are dedicated hardware-based devices that are deployed in a data centre used to detect and stop basic (layer 3 and 4) and advanced (layer 7) DDoS attacks. vi. Deployed at the primary entry point for all webbased traffic, they can both block bulk volumetric attacks and monitor all traffic coming in and leaving the network to detect suspicious patterns of layer 7 threats. 
\section[{b) Top three mitigation solutions}]{b) Top three mitigation solutions}\par
To make services more robust against a DDoS attack, the following combination of strategies are proposed, they are: i. Increase the barrier to entry by using a Pricing-Based Scheme\par
Price of entry varies with the load level. This will throttle the machines used in the attack, thereby forcing the attacker to employ (or subvert) a larger number of machines.\par
ii. Differentiated model Allocating a mechanism to desirable clients is key which Provides prioritized access to classes of users though a DDoS attack will raise the price so high that lower priority classes get locked out, higher priority clients can still access the service.\par
iii. Dynamic and Differential pricing mechanism This will be applied to penalize clients who are responsible for a load on the server and it typically requires flow monitoring and isolation capabilities. c) Flash Crowd Mitigation Strategies  
\section[{Conclusion}]{Conclusion}\par
The flow differentiator is responsible to identify and discriminate attack ,normal flows.Further, we apply zone managers,which will move VM's \& its applications to respective zones .Only the relevant security policies will only be applied on the VM's which are running those applications that are affected with security vulnerabilities. Our approach is considered to be effective in optimizing the security policies. Further, this approach is considered to be effective and consumes less resources and time.\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Global}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-6.png}
\caption{\label{fig_4}?}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.85\textwidth}}
IX.\end{longtable} \par
 
\caption{\label{tab_2}}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US)} 			\footnote{© 2014 Global Journals Inc. (US) Managing DDoS Attacks on Virtual Machines by Segregated Policy Management} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Arbor Application Brief: "The Growing Threat of Application-Layer DDoS Attacks ()]{b3}\label{b3} 	 		\textit{Arbor Application Brief: "The Growing Threat of Application-Layer DDoS Attacks},  		2011.  	 
\bibitem[Yu et al. (2012)]{b0}\label{b0} 	 		‘Discriminating DDoS Attacks from Flash Crowds Using Flow Correlation Coefficient’.  		 			Shui Yu 		,  		 			Weijia Jia 		,  		 			Song Guo 		,  		 			Yong Xiang 		,  		 			Feilong Tang 		.  	 	 		\textit{IEEE Transactions On Parallel And Distributed Systems}  		June 2012. 23  (6) .  	 
\bibitem[Li et al. ()]{b1}\label{b1} 	 		‘Distinguishing DDoS Attacks from Flash Crowds Using Probability Metrics’.  		 			Ke Li 		,  		 			Wanlei Zhou 		,  		 			Ping Li 		,  		 			Jing Hai 		,  		 			Jianwen Liu 		.  	 	 		\textit{Third International Conference on Network and System Security},  				2009. p. .  	 
\bibitem[Employing Kad to Mitigate Flash Crowds and Application Layer DDoS Attacks Against Web Servers]{b4}\label{b4} 	 		\textit{Employing Kad to Mitigate Flash Crowds and Application Layer DDoS Attacks Against Web Servers},  		 	 
\bibitem[Fu et al. (2012)]{b2}\label{b2} 	 		‘Mitigating Distributed Denial of Service Attacks in Multiparty Applications in the Presence of Clock Drifts’.  		 			Zhang Fu 		,  		 			Marina Papatriantafilou 		,  		 			Philippas Tsigas 		.  	 	 		\textit{Ieee Transactions On Dependable And Secure Computing}  		May/June 2012. 9  (3) .  	 
\bibitem[Ari et al. ()]{b5}\label{b5} 	 		\textit{Modeling, Analysis and Simulation of Flash Crowds on the Internet},  		 			B Ari 		,  		 			E L Hong 		,  		 			S A Miller 		,  		 			D D E Brandt 		,  		 			Long 		.  		 \url{http://ssrc.cse.ucsc.edu/}  		Feb. 28. 2004. Santa Cruz Santa Cruz, CA. p. 95064.  		 			Storage Systems Research Center Jack Baskin School of Engineering University of California 		 	 	 (ech. Rep. UCSC-CRL-03-15) 
\end{bibitemlist}
 			 		 	 
\end{document}
