# Optimal Cluster Expansion-Based Intrusion Tolerant System to Prevent Denial of Service Attacks
## 4 Performance Analysis  
Through extensive simulations, we show that our proposed scheme can provide reliable and secure service under massive DoS attacks. We used a CloudSim simulator in this work [18]. CloudSim is written in Java and has become one of the most popular open source simulators for modeling virtual environments. We ran simulation on a Windows 7 (64 bit) system with a 3.3 GHz Intel i3 processor and 8 GB memory. The details of the simulation environments and setup of our simulations are as Table 1.  
To evaluate our proposed system in terms of availability, reliability, and resource waste, we conducted simulations in three different scenarios: normal packets, continuous DoS packets, and one-pulse DoS packets. We compare our results with a conventional SCIT and ACT scheme to show the effectiveness of the proposed scheme. Moreover, we add an additional scheme (namely, an exponential-ACT) to show an extreme case: we expand cluster size exponentially to rapidly adjust cluster size. Exponential-ACT schemes are advantageous because they can maintain good QoS under a massive attack. However, it is likely that the number of VMs is increased above the necessary amount, leading to resource waste. Therefore, we simultaneously examined four different systems. Figure 3a shows the incoming requested packets per second during a simulation without a DoS attack. Approximately 100\(\sim\)220 packets(count) are incoming to the system every second. Figure 3b,c shows the response time and VM resource results for four different systems: SCIT, ACT, exponential-ACT, and the proposed scheme. Because the incoming packets are not from a DoS attack, a cluster expansion is not performed, and all four systems produce the same results. Figure 4a shows the incoming requested packets per second during a DoS attack. Approximately 1000\(\sim\)1120 packets(count) are incoming to the system every second. Figure 4b shows the service response time results under a DoS attack. The response times for SCIT and ACT increase linearly with time, but the response times for exponential-ACT and our proposed scheme are shorter than 770 ms, and are almost constant for the whole duration (i.e., QoS is maintained). Figure 4c shows the number of online VMs as a function of time. The number of VMs from the exponential-ACT system increased to 1038, while the remaining systems had fewer than 117 VMs. Therefore, the resource waste from the exponential-ACT scheme is significant, whereas our proposed scheme optimally expanded cluster size to maintain good QoS without wasting resources. Figure 5a shows a one-pulse DoS attack scenario. Approximately 2000\(\sim\)2150 packets are incoming between 1600\(\sim\)3900 s. Figure 5b shows the response time results for each system. The response times for SCIT and ACT increase continually, even after the DoS attack ends. This occurs because the requested packets from the DoS attack remain in the queue, and a limited number of online VMs is available to process them. In contrast, the response times for exponential-ACT and our proposed scheme are stable for the whole time, although there is a slight increase at the beginning of the one-pulse DoS attack. The performance of our proposed scheme is similar to that of an exponential-ACT scheme with respect to packet response time. However, the number of VMs in the exponential-ACT system is substantially higher than the number of VMs in our proposed scheme, as shown in Figure 5c. \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameters \& Descriptions** & **Values** \\ \hline VM processing element capacity (PE) & 512 MIPS \\ Maximum number of VMs in system & 10,000 \\ Highest acceptable response time [17] & 0.77 s \\ Initial number of VMs & 14 \\ VM cleansing time [7] & 146 s \\ VM exposure time & 900 s \\ VM attack follows a Poisson distribution with \(\mu\) & 0.000485 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Simulation environments. VM: virtual machine.