DEVELOPMENT OF A RESOURCE FREEING ATTACK DETECTION SYSTEM ON VIRTUAL MACHINE USING CPU USAGE AND NETWROK TRAFFIC DATA ANALYSIS PROGRAM

• Main Author: Insanu Muttaqien, Arief
• Format: Final Project
• Language: Indonesia
• Online Access: https://digilib.itb.ac.id/gdl/view/66624
• Institution: Institut Teknologi Bandung

iii ABSTRACT DEVELOPMENT OF A RESOURCE FREEING ATTACK DETECTION SYSTEM ON VIRTUAL MACHINE USING CPU USAGE AND NETWROK TRAFFIC DATA ANALYSIS PROGRAM By Arief Insanu Muttaqien NIM: 18118014 (Telecommunication Engineering Program) The development of computer science and telecommunications engineering today resulted in the computer equipment needed to run the system is getting bigger and more complex. This results in increased resources on computer equipment that must be met, both from processing (CPU, GPU), storage memory (SSD, RAM) and other resources. Telecommunication service providers or companies that use and require computers or servers, especially companies in the technology sector, also have increasingly large and increasingly complex needs. Therefore, NFV technology provides services that make it easier for users to process resources, design, deploy and manage network services on servers. This NFV technology also has many advantages including more efficient service operations, optimizing the allocation of required resources, and reducing energy consumption. Every technology must have advantages and disadvantages, including NFV technology, of course, it is also not free from shortcomings, one of which is in terms of threats to security systems. In NFV technology, it is possible to get interference due to many hosts on the same server, side channel attacks, or interference due to imperfect isolation on the hypervisor when sharing system devices. One of the threats due to interference with this NFV technology is RFA (Resource Freeing Attack). RFA is a form of attack on a VM by increasing the workloads on a VM target (VM victim) which is attacked with the aim of obtaining more resources on the VM belonging to the perpetrator of the RFA attack (VM attacker). With this threat, a system is needed to detect RFA so that the condition can then be handled. The RFA detection system on the VM can be done by creating and running a program that will filter whether an event indicated by RFA will be classified as RFA or not. The program is run by analyzing CPU usage data and network traffic data. Of course, the program can only be run if the required NFV infrastructure is available. In addition, RFA simulation is also needed to test whether the program made is running well or not. In addition, to complete the program created, an alert notification is also needed as a feature to mark the occurrence of RFA indications to alert notifications to notify the results of the RFA detection carried out. iv From the results of the research on the RFA detection system that was made, it will contribute to the scientific treasures of NFV technology. NFV technology in the future can be applied with a more secure system so that more users can choose to use NFV. However, the system created in this research can be continuously refined and developed, especially the system for program automation and for the RFA prevention system. Keywords: NFV, RFA, VM, CPU usage, network traffic.