# Optimal Cluster Expansion-Based Intrusion Tolerant System to Prevent Denial of Service Attacks
## 2 Related Work  
The generic architecture for an intrusion-tolerant system consists of various Web servers and proxies [11]. Duplicated Web servers provide the same services but manage different applications and OS on different hardware platforms. Proxies play an important role in monitoring Web servers and other proxies. Thus, they are used to control user service requests, and can be applied to IDS. In a generic ITS, a malicious attacker can reside inside the system until it shuts down the whole system. Therefore, a preemptive recovery process is needed to prevent systems from shutting down due to the malicious attacks. However, this general ITS system is not cost-effective, because it requires multiple servers and various hardware platforms.  
As virtualization computing technologies evolve, VM-based ITS is considered as a cost-effective system. Redundancy is achieved by increasing the VMs, and diversity is achieved with various operating systems and applications. A recovery method is also achieved by using snapshots in the VM-based ITS systems [6; 7]. [PERSON] et al. [12] introduce a method for finding an optimal exposure time by considering resources in the rotation process of the VM. Using reactive recovery, they proposed  
Figure 1: Overview of a self-cleansing intrusion tolerance (SCIT) system. VM: virtual machine.  
an additional scheme that restores abnormal VMs first by changing the order of VM rotations [13]. Most existing SCIT-related works have focused on adjusting VM rotation schedules to improve system performance. However, these SCIT systems can be significantly affected by a massive-scale attack like DoS or DDoS, because the number of online VMs are fixed in a SCIT system.  
[PERSON] et al. [14] proposed an adaptive cluster transformation (ACT) scheme to enable systems to survive various types of intrusions. This ACT scheme was able to maintain quality of service (QoS) by adopting a variable cluster size depending on the system status. However, the ACT increases the number of VMs by two at a time, regardless of the number of current online VMs. Therefore, the efficiency of cluster expansions under a massive packet attack is limited. Moreover, the ACT scheme only focuses on analyzing service response time, without considering available resources. In other words, it does account for resource waste phenomena, because it assumes unlimited resources. [PERSON] et al. [15] introduced a VM migration scheme to preserve QoS by replacing exhausted VMs. Additionally, a cluster expansion scheme like ACT was applied in order to mitigate DoS attacks. [PERSON] et al. [16] proposed another ACT-based cluster expansion scheme to preserve QoS under malicious intrusions by using proactive and reactive recovery. However, none of the above-mentioned schemes considered the number of current online VMs at the point where the cluster is expanded. As a result, QoS is significantly degraded under massive DoS attacks. Therefore, in this paper, we propose an optimal cluster expansion scheme to maintain good QoS even under massive DoS attacks, by optimally adjusting the number of online VMs. We also analyze resource waste efficiency by comparing the total number of increased or decreased VMs from the proposed scheme with the necessary number of VMs for preserving QoS.