## 3 Attacks and Attackers
### Attacker  
The scope of an attack may greatly vary, depending on who perpetrates the attack. System administrators take the appropriate actions: to exclude or to ensure a quick recovery and allow subsequent investigations. [PERSON] and [PERSON] [19] identify four categories of attackers that we will describe in the context of cloud computing.
* _Insider vs. Outsider_. In such a case, the insider belongs to the network that is under attack: he is an authenticated user with privileged access to critical data. Of course, the insider can do more harm than the outsider since the latter would be considered an intruder from the network perspective. Moreover, he would have fewer resources to begin an attack. In the case of Cloud Computing, an insider could be an employee of the Cloud infrastructure, or someone controlling one or several VMs inside the Cloud network, whereas an outsider would not be part of the network at all. For example, an insider attacker may be able to execute arbitrary commands on the behalf of a legitimate Cloud user, thus performing a DoS or DDoS on the user's services or to create a botnet for charging the Amazon Elastic Cloud Computing costs on the user's invoice [20].
* _Malicious or Rational_. Malicious attackers have a general goal of harming the network or the network users (employees or customers of the network). Whatever the costs or the consequences, all means can be deployed to achieve his goal and such attackers are usually harder to stop or to track since no logic is involved. On the contrary, rational attackers can be more predictable in the way the attacks are led and which specific targets are reached. Consider the example of a DoS attack in Cloud Computing: a malicious attacker may want to destabilize an organization without any claim or consistent reasons to motivate his actions: he simply wants to be famous. However, a rational attacker could be a competitor desiring to create a commercial threat or an organisation leading a DoS or DDoS against a company or a government for ideological reasons.
* _Active vs. Passive_. Active attackers lead attacks by consciously or unconsciously sending packets or signals while passive attackers may simply eavesdrop. Victims may not even be aware that their machine is under the control of a master machine that forces it to contribute to the attack (a botnet is such an example). In DoS and DDoS attacks, this defines the difference between the zombies and the master entity (active attacker): both participate in the attack, but zombies are never aware that they are vehiculing an attack. In the context of Cloud Computing, an active attacker would have taken control of one or several VMs inside the Cloud network, for instance, and would send huge amounts of traffic or malformed packets to a specific host or subnet in the network. Hence, a legitimate user such as a zombie whose VM was taken over by a master attacker, also performs the attack. A passive attacker consists on sniffing traffic to discover vulnerable links for future exploitations. In addition, passive attackers may launch eavesdropping attacks to capture the communication.
* _Local vs. Extended_. The scope of the attacker depends on the number of machines he can control. More than just a number, it really is about how those machines are linked together and scattered across the network. An attacker controlling thousands of machines outside the cloud to perpetrate a DoS or DDoS would be considered an extended attacker. On the other hand, an attacker in the Cloud, with one or several entities, would be described as local.