# Optimal Cluster Expansion-Based Intrusion Tolerant System to Prevent Denial of Service Attacks
## 5 Discussion  
In this section, we discuss several considerations in designing our proposed ITS. First, it is necessary to determine the threshold value at which a cluster size expansion or reduction process will be performed, because overall system performance can vary under different threshold values. Additionally, we need to account for the user-requested service level in order to adjust the threshold value. For example, when the user requested service level is high, the threshold value can be adjusted to a lower value in order to provide stable service. However, when the user-requested service level is low, the higher threshold value can be used to provide less stable service. Second, the total number of available VMs and hosts must be sufficient to protect the system from a massive DoS attack. Even if we use an optimal cluster expansion scheme, system QoS cannot be guaranteed when a limited number of VMs are available to support a massive DoS attack. Thus, our proposed scheme is appropriate for cloud environment scenarios where the number of VMs is not limited. Third, whenever a VM is created by the expansion process, it takes time for the VM to be able to provide actual services. This VM waiting time is not negligible. Therefore, it would be interesting to study how to minimize this VM waiting time. Estimating the cluster expansion timing is important, because it then becomes possible to prepare available VMs in advance and begin providing services whenever needed. Analyzing packet history and patterns in an ITS using machine learning techniques can also be applied to the estimation of the cluster expansion. For example, when we analyze the daily packet patterns by using machine learning, we can easily observe that the packet amount during daytime is significantly different from the nighttime packet amount. Thus, it is easy to detect a DoS attack when the packet amount is increasing during the nighttime. Fourth, an appropriate application service for the proposed ITS is a Web service or Domain Name System (DNS) service, because those services have short-term sessions. In contrast, a database service that does not have a short-term session will require more time whenever  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Description** & & **Normal Packet** & **Continuous DoS** & **One-Pulse DoS** \\ \hline \multirow{4}{*}{Total average response time (ms)} & SCIT & 7.41 & 1406.36 & 1810.25 \\  & ACT & 7.41 & 955.95 & 529.78 \\  & Exponential & 7.41 & 186.61 & 197.19 \\  & Proposed & 7.41 & 87.41 & 200.98 \\ \hline \multirow{4}{*}{Total average VM processing rate (\%)} & SCIT & 100 & 100 & 100 \\  & ACT & 100 & 100 & 100 \\  & Exponential & 100 & 74.42 & 73.29 \\  & Proposed & 100 & 100 & 100 \\ \hline \multirow{4}{*}{Total VMs running time (s)} & SCIT & 1106 & 1106 & 1106 \\  & ACT & 1106 & 2374 & 2002 \\ \cline{1-1}  & Exponential & 1106 & 25,082 & 12,699 \\ \cline{1-1}  & Proposed & 1106 & 8625 & 5499 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Total average response time and VM processing rate and total VM running time in three scenarios. DoS: denial of service, SCIT: self-cleansing intrusion tolerance, ACT: adaptive cluster transformation.  
a cluster expansion or reduction process is performed. Fifth, the proposed ITS must cooperate with the pre-existing IDS and IPS. It is possible that the ITS can protect a system from unknown attacks that the IDS and IPS cannot detect. Then, the ITS will inform the IDS and IPS of the unknown attack information in order to prevent future attacks. Sixth, for security purposes, the RCC that controls the overall system must be physically unreachable from outside of the system. If an attacker can reach the RCC, the complete ITS system can be broken down. Therefore, we believe that the proposed ITS system will provide good QoS to Web-based cloud services, by taking into account the multiple considerations mentioned above.