# Agent-Based Virtual Machine Migration for Load Balancing and Co-Resident Attack in Cloud Computing
## 2 Related Works
### Co-Resident Attack  
A co-resident attack is a two-phase attack that aims to co-locate the attacker's VMs on the same physical server as their intended victim. Once the attacker gains co-residency, they proceed to create side channels to collect sensitive information about the victim [36; 37; 38]. To achieve co-residency, the attacker may utilize brute force tactics, such as launching numerous VMs, subject to cost limitations, or taking advantage of sequential and parallel positions in VM placement. Notably, in the Amazon EC2 cloud [39; 40], launching one VM soon after the termination of another VM or launching both VMs almost simultaneously increases the likelihood of these VMs being allocated to the same server. In theory, co-resident VMs should not interfere with one another, but this is not always the case in existing cloud systems. This interference enables attackers to construct side channels between VMs and gain access to sensitive data. For instance, experiments [39] have shown that an attacker can use the Prime+Probe [41; 42] approach to deduce cache utilization and workload information of the victim, as cache usage significantly affects cache read operation execution time. Additionally, an attacker can assess the victim's network traffic. Furthermore [43], attackers can leverage common hardware resources, such as instruction caches, to recover cryptographic keys. Previous research has identified several potential co-resident attack defenses, which can be broadly categorized into five types. The first category involves side-channel removal, which refers to techniques described in [44; 45]. These strategies operate at the hardware layer and may include deleting high-resolution clocks [46], introducing delays for potentially malicious activities [47], and removing all internal reference clocks [48]. Another approach involves imposing isolation by prohibiting the sharing of critical resources. For example, page coloring [49] can be utilized to limit cache-based side channels, and hypervisors [50] can be replaced with hardware techniques to separate access to shared resources. However, the implementation of these techniques often requires significant modifications to current cloud platforms, making their adoption by cloud service providers doubtful. The second category aims to increase the challenge of confirming coexistence by utilizing network measurements to identify whether two VMs are on the same server [39]. To conceal Dom0's IP address, which is used to administer all VMs on the host, cloud providers can block the customer's access to it. However, the effectiveness of simply hiding Dom0's IP address as a means of detecting co-residence is increasingly challenged by the emergence of new detection methods. Various approaches have been proposed to identify co-residence, including those described in [51; 52; 53]. Therefore, additional measures beyond IP address hiding are needed to mitigate the security risks associated with co-resident attacks. The third category involves detecting abnormalities in system calls, CPU and RAM consumption, and cache miss behavior that may indicate an attacker is using the Prime+Probe [54; 55] approach to harvest information from a victim. Researchers have proposed several methods for detecting these characteristics and constructing defense systems appropriately. The fourth category involves utilizing VM allocation rules that make colocation difficult. One such strategy is the co-resident co-build (CLR) system [56], which classifies servers as open or closed based on their ability to accept more VMs. The system maintains a constant number of open servers and assigns a new VM at random. If the selected server cannot accept further VMs, it will be designated as closed, and a new server will be started. The greater the number of open servers, the greater the algorithm's co-resident resistance. The fifth and final category involves using the Vickrey-Clarke-Groves (VCG) [57; 58] technique to periodically move VMs to different hosts to reduce the likelihood of coresidence.