# Optimal Cluster Expansion-Based Intrusion Tolerant System to Prevent Denial of Service Attacks
## 3 Proposed ITS System
### Cluster Size Expansion  
To continuously maintain reliable service under a massive DoS attack, an appropriate cluster size expansion method must be used. That is, when online state VMs are not properly processing requested packets, cluster size expansion is needed to increase the number of online VMs. In a conventional ACT scheme, the cluster size increases when the response time for a packet is greater than a predetermined threshold value:  
\[X_{delta}=f(\mathit{res}_{time}),\]  
\[f(\mathit{res}_{time}) = \left\{\begin{array}{ll}2&\text{if }\mathit{res}_{time}>\Theta_{ \mathit{res}_{time}\mathit{size}_{\mathit{up}}}\\ -2&\text{if }\mathit{res}_{time}<\Theta_{\mathit{res}_{time}\mathit{size}_{ \mathit{down}}}\\ 0&\text{otherwise}\end{array}\right.\]  
\[X_{next}=X_{current}+X_{delta}, \tag{1}\]  
where \(\mathit{res}_{time}\) is the requested packet response time and \(X\) is the number of online VMs. \(\Theta\) is a specific threshold value. The cluster size will be increased by two regardless of the \(X_{current}\) value. When the \(X_{current}\) value is small, adding two VMs can be sufficient to process the packets in the queues. However, when the \(X_{current}\) value is large, a two-VM increase cannot be sufficient to process every packet in the queues. That is, the service response time of a conventional ACT scheme can be significantly delayed as the \(X_{current}\) value increases. To overcome this problem, it is possible to exponentially expand the number of online VMs under a massive DoS attack, thereby maintaining QoS. However, it is then inevitable that some resources will be wasted. Therefore, it is important to calculate an optimal cluster  
Figure 2: Architecture of the proposed scheme. HW: hardware.  
size that can minimize the waste of resources while preserving good QoS. In our proposed scheme, we consider both the incoming packet amount and the online VM packet processing time to compute the exact number of VMs that are needed to preserve QoS. We also consider additional parameters such as CPU usage and queue length, as well as packet response time, in order to determine the exact timing of the changing cluster size:  
\[Z=\{\textit{res}_{time},\textit{use}_{cpu},\textit{len}\},\]  
\[X_{next}=f(Z,\lambda),\]  
\[f(Z,\lambda)\ =\ \left\{\begin{array}{ll}\frac{\lambda}{\mu_{T}}&\text{if \ }\textit{res}_{ time}>\Theta_{\textit{res}_{time}\textit{size}_{up}}\\ &\text{and \ }\textit{use}_{cpu}>\Theta_{\textit{cpu}_{use}\textit{size}_{up}} \\ &\text{and \ }\textit{len}>\Theta_{\textit{len}\textit{size}_{up}}\\ \frac{\lambda}{\mu_{T}}&\text{if \ }\textit{res}_{time}<\Theta_{\textit{res}_{ time}\textit{size}_{time}}\\ &\text{and \ }\textit{use}_{cpu}<\Theta_{\textit{cpu}_{use}\textit{size}_{up}} \\ &\text{and \ }\textit{len}<\Theta_{\textit{len}\textit{size}_{up}}\\ 0&\text{otherwise}\end{array}\right. \tag{2}\]  
where \(Z\) is a set of three input parameters: packet response time (\(\textit{res}_{time}\)), CPU usage (\(\textit{cpu}\_use\)), and VM queue size (\(\textit{len}\)). \(\lambda\), \(\gamma\), and \(\textit{a}\) represent the incoming packet amount per second, the user-requested service level, and the VM processing packet amount per second, respectively. Cluster size expansion is performed when all three parameters satisfy the predetermined conditions. The number of increased online VMs is determined by simultaneously considering the incoming packet numbers and the VM packet processing capabilities. Therefore, the increased number of online VMs can process the requested packets, maintaining QoS under a massive QoS attack.