Analyzing Security and Energy Tradeoffs in Autonomic Capacity Management

Transcription

1 Analyzng Securty and Energy Tradeoffs n Autonomc Capacty Management Ítalo Cunha, Itamar Vana, João Palott, Jussara Almeda, and Vrgílo Almeda Department of Computer Scence, Federal Unversty of Mnas Geras Belo Horzonte, Brazl, {cunha, tamar, palott, jussara, vrglo}@dcc.ufmg.br Abstract Capacty management of a hostng nfrastructure has tradtonally focused only on performance goals. However, the qualty of servce provded to the hosted applcatons, and ultmately the revenues acheved by the provder, depend also on other aspects, such as securty and energy constrants. Ths paper extends our self-adaptve SLA-drven capacty management soluton to capture, n an unfed framework, key performance and cost tradeoffs that arse when operatng under securty attacks and energy constrants. A number of scenaros and strateges based on dynamc SLA contracts are desgned to help uncover, va smulaton experments, the man tradeoffs, consderng both the provder s nterests (.e., revenues) and the customer s nterests (.e., legtmate throughput, response tme dstrbuton and costs). Fnally, we also assess the cost-effectveness of our framework under hghly varable applcaton servce tmes. I. INTRODUCTION Capacty management of a hostng nfrastructure (.e., data center) has been tradtonally developed as a set of technques to acheve performance goals. However, the qualty of servce provded to customers (.e., the owners of hosted applcatons) and ultmately the revenues acheved by the nfrastructure provder depend on other aspects as well. One such aspect relates to the mpact of securty attacks on the cost-effectveness of alternatve capacty management decsons. Despte the plethora of defense/recovery technques avalable [1] [3], securty attacks, especally those amng specfc applcatons [3] [5], can stll cause great fnancal losses [1], [6]. Durng such an attack, llegtmate requests admtted nto the system consume avalable resources, thus mpactng the performance of concurrent legtmate requests to the same applcaton. The provder, on ts sde, s also penalzed, as t does not captalze over the resources allocated to accomodate the llegtmate traffc. Energy costs and constrants can also add extra challenges to the capacty management task, especally for heterogeneous applcatons sharng a complex mult-ter platform. Up to 1% of the budget of current enterprses s spent n energy, and ths fracton s expected to ncrease even further [7]. In such scenaro, new tradeoffs arse to couple wth the costs and benefts of resource allocaton, n partcular when energy restrctons are planned and thus must be enforced. Overall, many ssues challenge the management of large and complex data centers. Cost-effectve solutons can not afford to address only one ssue at a tme. The need to handle these ssues compounds the management task, demandng tools and models capable of handlng them all jontly. Nevertheless, most prevous capacty management strateges [8] [12] focus on performance ssues only. In partcular, we have proposed a self-adaptve capacty management framework that dynamcally allocates capacty among applcatons so as to maxmze the provder s revenues [11], [12]. Our framework combnes a prcng model, based on Servce Level Agreement (SLA) contracts, a queung-based performance model, and an optmzaton model. It provdes guarantees on throughput and response tme tal dstrbuton, and captures the tradeoffs of current mult-ter vrtualzed platforms [12]. Energy-related costs have been consdered by some prevous capacty management schemes [1], [13]. However, they are combned wth smplfed assumptons of sngle-ter platforms or guarantees only on average performance targets, whch may not be accurate for heterogeneous and varable workloads. Moreover, most pror efforts towards addressng securty ssues am at mprovng robustness ([3] and references wthn), and are dsconnected from the capacty management goal. Therefore, our man goal s to buld on our prevous efforts [11], [12] towards provdng a smple and yet cost-effectve framework to address jontly three ssues that are key to capacty management, namely, servce level (.e., performance), securty and energy constrants, under the same prcng model. To the best of our knowledge, ths s the frst study that jontly consders these three aspects n capacty management. More specfcally, we am at capturng the most prmary ssues related to performance, securty and energy constrants that are key to capacty management n a unfed framework, amng at sheddng some lght nto the followng questons: (1) what are the man performance and cost tradeoffs for managng capacty under securty attacks and energy constrants?, and (2) gven a hosted applcaton s under a securty attack (or the nfrastructure s under energy constrants), what are the cost-beneft tradeoffs of usng dynamc SLA contracts, both from the provder s and customer s perspectves? Towards ths goal, we extend our framework to capture prmary aspects related to securty attacks and energy consumpton, as well as to mplement alternatve strateges based on adaptve SLA contracts. We run smulatons, wth synthetc and realstc workloads, to understand the man tradeoffs consderng the provder s revenues, the customer s legtmate throughput (.e., goodput) and response tme dstrbuton, as well as the amount

2 charged to the customer for each legtmate request served. Complementary, we also assess the senstvty of our framework to one of ts key assumptons, namely, that applcaton servce tmes are exponentally dstrbuted. Our man fndngs are: (1) when an applcaton s under attack, our new securty-aware framework sgnfcantly ncreases the provder s revenue by shftng capacty between applcatons accordngly, at the cost of great penaltes to the vctm s goodput; (2) these penaltes can be reduced (and even elmnated) f the vctm agrees to pay extra for each legtmate request served; (3) alternatvely, the penaltes may also be reduced f the vctm agrees to relax the response tme SLA, although the effectveness of ths strategy depends on both the orgnal SLA and the relaxaton factor; (4) beyond maxmzng resource utlzaton to save energy, our energy-aware framework captures key tradeoffs durng energy restrctons, turnng off more resources at the costler ters and favorng applcatons wth lghter demands; (5) response tme SLA relaxaton may also reduce the goodput degradaton of applcatons under energy restrctons; (6) our framework s cost-effectve for non-exponental servce tmes wth moderate coeffcents of varaton (under 3). Ths paper s organzed as follows. Secton II brefly revews our capacty management framework and other prevous work. The extensons ntroduced to the framework to capture securty and energy aspects are presented n Secton III. Smulaton results are dscussed n Secton IV. Secton V evaluates the senstvty of our framework to hghly varable servce tmes. Conclusons and future work are offered n Secton VI. II. BACKGROUND A. Autonomc Capacty Management for Mult-Ter Servces We consder the case of a provder hostng thrd-party applcatons on a shared nfrastructure. Applcaton owners,.e., the customers, sgn Servce Level Agreement (SLA) contracts wth the provder. Each hosted applcaton may be composed of multple request types, characterzed by dfferent workloads and resource demands. We refer to each such request type as an applcaton class, and assume the provder hosts N classes. The shared platform s composed of K ters. Each ter runs a vrtualzaton mechansm [14], [15] that allows the creaton and dynamc allocaton of ts local resources to N ndependent and solated vrtual machnes (VMs). Thus, each class runs on K dedcated VMs, one at each ter. After beng served at ter j, a class request leaves the system wth probablty p,j ( =1..N, j =1..K, p,k =1) or enters ter j +1. In ths target envronment, the capacty allocaton problem s defned as the determnaton of the fracton of the physcal capacty of each ter j to each class that maxmzes the provder s busness goal. Such decson has to be made n lght of estmates of each class expected workload, performance targets and prcng contracts (.e., SLAs) as well as system confguraton, and should be revsted n case of changes. In [11], [12], we propose a self-adaptve capacty management framework whch works as follows. Perodcally, the capacty manager takes predctons of the future workloads Fg. 1. Self-Adaptve Capacty Management (one ter s perspectve) for hosted classes, ther SLA requrements, per-ter average servce tmes and routng probabltes p,j,aswellassystem parameters to compute the capacty allocaton for the next nterval. It also computes the fractons of the expected request rate from each class that can be accepted nto the system. To that end, t reles on a workload forecastng module [16] to montor ncomng workloads and predct each class expected workload for the next nterval, as well as on an admsson control mechansm [17] to enforce per-nterval accepted request rates. Fg. 1 shows an teraton from one ter s perspectve. The capacty manager combnes a prcng model and a system performance model nto an optmzaton model to solve the capacty allocaton problem. The man characterstcs of each model component are summarzed next. 1) Prcng Model: The prcng model specfes QoS requrements and hostng costs and, thus, captures the SLA contracts. Our prcng model s based on two operaton modes, normal and surge. For the former, the model defnes X N, the vald throughput (.e., servce level) that s expected to satsfy class requrements most of the tme. In case of SLA volatons, the provder must refund the customer c for each unt of throughput below X N, provded class arrval rate s hgh enough. For the surge mode, the model defnes X S X N, the maxmum vald throughput up to whch the customer agrees to pay extra (r per unt of vald throughput above X N ) to accommodate occasonal load peaks. The vald throughput ncludes all accepted requests served wth a response tme that satsfes the SLA. We consder an SLA that specfes guarantees on the probablty that the system response tme experenced by each class request, R, exceeds threshold R SLA,thats,P (R >R SLA ) α.gven λ,class request arrval rate, and λ acc, the rate of requests accepted nto the system, computed by the capacty manager, the provder s revenues from class, g, s gven by: { ( ) c mn(λ,x N ) λ acc λ acc X N g = ( ) r λ acc X N X N <λ acc X S (1) 2) Performance Model: The analytcal queung-based performance model estmates, for each hosted class, per-ter resource utlzaton, system throughput and the probablty of system response tme SLA volatons. We defne d,j as the average servce tme of a class request runnng on ter j s full capacty, whch can be estmated n a pre-producton envronment and nflated to capture fxed vrtualzaton overhead [1]. The average servce tme of a class request at ts assgned

3 VM on ter j, d,j, s then computed as d,j = d,j /f,j, where f,j s the fracton of ter j s capacty assgned to class. The effectve arrval rate from class at ter j, gvenbyλ e,j,s computed from λ acc and probablty vector p,j, j =1..K. Fnally, the maxmum utlzaton planned for the VM assgned to class at ter j s set to ν,j to avod saturaton. For each hosted class, the model assumes Posson request arrvals wth rate λ, as observed n real systems [9], and exponentally dstrbuted servce tmes at each ter j, wth average d,j. Thus, each VM s modeled as an M/M/1 queue wth FCFS schedulng dscplne [18], as n other prevous work [8], [9]. Each class, n turn, s modeled as a sequence of M/M/1 queues wth ndependent resdence tmes. Under these assumptons, system throughput s gven by, and the utlzaton of ter j by class s gven by ρ,j = λ e,j d,j. The probablty that a class request volates ts system response tme SLA R SLA,.e., P (R >R SLA ), can be derved from the dstrbuton of system response tme R. Under the assumpton of M/M/1 queues, R follows a hypoexponental dstrbuton [18], wth parameters computed from λ acc d,j and λ e,j (see Equaton 1 n [12]). Alternatvely, a smpler approxmaton for P (R > R SLA ) based on Chebyshev s Inequalty [18] can be used [12]. However, snce the exact soluton based on the hypoexponental dstrbuton yelded somewhat more cost-effectve solutons wth reasonable soluton tmes [12], we consder t as baselne n ths paper. 3) Optmzaton Model: The prcng and performance models are combned nto an optmzaton model wth an objectve functon that expresses the provder s goal of maxmzng total revenues (summng Equaton 1 for all hosted classes). Moreover, constrants are added to specfy lmts on the accepted request rates, per-ter allocated capacty, VM utlzatons and effectve request rates as well as to express the SLA tal dstrbuton response tme requrement for each class. A detaled descrpton of the optmzaton model, as well as a dscusson on optmalty ssues, soluton tmes and results from an extensve evaluaton are presented n [12]. B. Related Work Capacty management has been addressed by many prevous studes. Some of them focus on admsson control strateges [19], others on shared capacty allocaton among hosted applcatons [8], [15]. Several prevous work [9] [12] combnes both schemes nto autonomc capacty management frameworks. However, most of these efforts lack one or more of the followng desrable characterstcs: busness-orented prcng models [14], [15], probablstc guarantees on performance targets [8], [15], and modelng of mult-ter platforms. In partcular, [9] [11] combnes SLA-based prcng models wth queung-based performance models to derve guarantees on response tme tal dstrbuton, amng at maxmzng the provder s revenues. However, these studes target sngle-ter platforms. Mult-ter platforms are addressed n [8], but the proposed soluton s not coupled wth a prcng model and focus on average performance targets. Overall, prevous capacty management schemes, ncludng ours (presented n Secton II-A), focus manly on performance, leavng out securty and energy ssues that may also mpact ther cost-effectveness. The Green Grd [2] s one ntatve towards energyeffcent nfrastructures endorsed by major vendors. Moreover, hardware-based methods towards energy savngs are studed n [21]. In software, a few capacty management frameworks have addressed energy costs. In [1], energy costs are ncluded n an optmzaton model that maxmzes the provder s revenues. In [13], fne-graned energy costs are consdered, allowng dynamc voltage scalng n the processors. A lst of references on DDoS attacks and defense mechansms, ncludng methods based on IP backscatter, waveletbased anomaly detecton and sgnature-based ntruson detecton, s gven n [3]. A framework to classfy DoS attacks usng spectral analyss s gven n [22]. Other defense mechansms deployed on the network [1] and at the vctm [2] to flter malcous traffc are also avalable. However, none of these efforts are embedded nto the capacty management context. Ths work extends our capacty management framework for mult-ter platforms [12] to nclude energy costs and capture key tradeoffs arsen by securty attacks and energy constrants. III. CAPACITY MANAGEMENT UNDER SECURITY ATTACKS AND ENERGY CONSTRAINTS Our goal s to desgn smple scenaros that allow us to (1) uncover prmary tradeoffs n managng capacty of a shared nfrastructure under securty attacks and energy constrants, and (2) evaluate the cost-effectveness of adaptve SLA contracts. These scenaros are presented below as alternatve capacty management solutons, bult from our orgnal framework. A. Securty Attacks We focus on securty attacks that target a specfc applcaton, by means, for nstance, of a floodng of llegtmate requests (e.g., floodng of HTTP requests [5] and spams), whch, despte consumng resources, do not generate revenue. The mpact of these attacks on the nfrastructure and applcatons s of partcular nterest because, even though they mght be detected 1, llegtmate requests can not be ndvdually blocked before beng processed, as they look lke legtmate ones. In fact, such attacks have been recently reported as causes of great fnancal losses [1], [5], [6]. Moreover, such attacks make for an nterestng case for our capacty manager to take alternatve measures to mnmze overall degradaton 2. In order to capture the prmary mpact of an attack to applcaton class, our framework s modfed as follows. The total request rate from class, λ,sbrokenntoλ +, the rate of legtmate requests, and λ, the rate of llegtmate requests,.e., λ = λ + + λ. Moreover, snce llegtmate requests can not be dentfed and, thus, may be admtted nto the system, class throughput s broken nto legtmate (.e., goodput), gven by λ acc (λ + /λ ), and llegtmate, 1 Typcal workload profles could be used to detect sudden changes that can not be explaned by flash crowds. 2 Infrastructure attacks (e.g., network bandwdth floodng) usually requre defense schemes deployed n the network [1], outsde the framework s scope.

4 gven by λ acc (λ /λ ). Thus, the servce of a fracton of class legtmate requests mples extra costs to the provder, as some of the llegtmate requests wll also be admtted nto the system, consumng resources. Ths creates nterestng scenaros to explore the tradeoffs between provder s nterests and customer s nterests. Moreover, we also assume legtmate and llegtmate requests have the same average per-ter servce tmes (d,j ), as would be expected from attacks that try to mmc user behavor [5]. The mpact of attacks wth heterogeneous demands, such as semantc attacks [4], are not captured n ths model, but we expect the general tradeoffs dscussed n Secton IV to hold under those types of attacks, thus provdng nsghts for cost-effectve management decsons. Extendng the model and the solutons presented below to consder more sophstcated attacks s left for future work. Under these assumptons, the provder s revenues from class, computed only over ts goodput λ good { ( ) g s c mn(λ = (,X ) N ) λ good r λ good X N X N =λ acc λ good <λ good λ + /λ,are: X N X S We consder four alternatve capacty management solutons, bult from varants of our baselne framework: Attack-Oblvous (AO): the provder s unaware that applcaton (class) s under attack,.e., λ s unknown. Capacty management s done usng our orgnal framework, whch reles on estmates of revenues gven by Equaton 1. However, actual revenues are computed usng Equaton 2. Attack-Aware (AA): capacty management s performed usng the extended framework descrbed n ths secton. We also consder two other strateges based on adaptve SLA contracts. In face of an attack, the vctm customer may agree to ether pay extra for each legtmate request served wthn the pre-defned (fxed) SLA, or, for fxed costs, relax the response tme target. Adaptve SLAs can be benefcal to both customers, who wll have more legtmate requests served, and to provders, who wll receve hgher revenues or have addtonal flexblty, and thus may help acheve a better compromse n case of conflctng nterests. The next two solutons apply these strateges to the extreme, allowng us to assess ther man tradeoffs and potental benefts: Adaptve Cost (AC): the vctm customer agrees to pay an amount for each legtmate request served that s nflated by the attack weght (.e., λ /λ ). In other words, t pays the orgnal fxed cost for each request served, legtmate or not. Adaptve R SLA (S-AR): the vctm agrees to relax R SLA by a factor proportonal to the attack weght,.e., R SLA,s R SLA (2) = (1 + w s(λ /λ )), wherew s s an nflaton factor. B. Energy Constrants In face of energy constrants, the goal of the capacty manager s to reduce the capacty allocaton, thus savng energy by ncreasng VM utlzatons, whle stll meetng SLA targets. Moreover, even under normal energy condtons, t may be more benefcal to the provder to turn some of the resources off, f costs assocated wth the energy consumed by them s not payed off by revenues from customers. We extend our framework to defne e j, the cost per tme unt of operaton of ter j at ts full capacty. The total energy N cost (per tme unt) assocated wth ter j s thus e j =1 f,j. Ths model makes two assumptons: (1) capacty allocaton s contnuous, (2) energy cost ncreases lnearly wth allocated capacty. Although smplfed, ths model allows us to capture prmary tradeoffs ntroduced by energy costs, especally for systems wth homogeneous components 3. Prevously used n [1], ths s the frst effort to apply ths model for mult-ter platforms wth possbly heterogeneous costs. The orgnal expresson for revenues s then extended as: K g e = (e jf,j)+g (3) j=1 In order to explctly capture energy restrctons, we add a constrant on the total capacty allocated across all ters to the optmzaton model. That s, we set K j=1 s N j =1 f,j C, where C s the total avalable capacty and constants s j are used to normalze ter capactes. We consder the followng solutons for evaluaton: Energy-Oblvous (EO): capacty s managed usng the orgnal framework [12], whch does not capture energy costs. Energy-Aware (EA): capacty management uses the extended framework wth the aforementoned changes. Adaptve R SLA (E-AR): suppose the energy consumed by the nfrastructure must be reduced by a fracton S, reducng the total avalable capacty to C e = C(1 S). In ths case, the owner of applcaton class may agree to relax ts response tme SLA by a factor proportonal to S to acheve hgher throughput under the reduced allocaton. That s, R SLA,e R SLA (1 + w e S), wherewe s an nflaton factor. = We do not consder an adaptve cost scheme to avod unfarness. If a customer pays extra durng a perod of energy restrcton, he wll certanly receve a hgher fracton of resources, whereas others wll experence servce degradaton. Although benefcal to the provder, ths would not be far to the other customers. In the case of securty attacks, on the other hand, the extra cost charged to the vctm s to ts own beneft, and does not ncur penaltes on the other customers. IV. EVALUATION Ths secton shows smulaton results to llustrate the man tradeoffs that arse when managng capacty under securty attacks (Secton IV-B) and energy constrants (Secton IV-C), takng nto account the provder s revenues as well as the customers goodput, response tme dstrbuton and cost per legtmate request served. The workload and system confguratons used n our evaluaton are descrbed n Secton IV-A. 3 In a real deployment, the amount of resources (e.g., servers) to be turned off could be set to the nearest dscrete value. Moreover, n case of ters wth heterogeneous components and non-lnear energy costs, the framework could operate by takng the resource wth the worst capacty per energy rato frst. Fnally, fxed energy costs, although not explctly modeled, should not mpact the man tradeoffs, as they represent constants n the objectve functon.

5 The smulator perodcally calls the capacty manager to compute, analytcally, the optmal capacty allocaton. The queues at each ter are then smulated, wth servce demands nflated accordng to the allocaton, n order to capture workload fluctuatons. Smulaton results presented are averages of 5 runs wth standard devatons under 2% of the means. A. Workload and System Parameters We consder two scenaros descrbng the workload and system confguratons. Both scenaros consst of nfrastructures wth two ters (K =2), whch requests always vst (.e., p,1 =, ). We assume applcaton classes have homogeneous SLA parameters, and set α =.1, c = 1, r =.5, ν,j =.95, and, unless otherwse noted, R SLA =2 K j=1 d,j.theworkload s assumed to be known apror, and the capacty manager s executed whenever (legtmate and llegtmate) request rates change. The mpact of ths smplfcaton on revenue s shown to be under 11% n [12]. Revenues are expressed consderng SLA payments and thus are non-negatve. Scenaro 1 conssts of two classes wth requests arrvng accordng to the step-lke non-homogeneous Posson processes shown n Fg. 2, whch cover dfferent patterns of competng synthetc workloads. Each step lasts 1 seconds. Average servce tmes, d,j, shown n Table I, are chosen so that the nfrastructure s under-provsoned for the total load most of the tme (except near step 19). Table I also shows the throughput and response tme SLA parameters for each class. Scenaro 2 s bult from logs to a real Web portal, contanng per-hour arrval counts for sx months (1/1-3/6/6). We buld realstc workloads by breakng the log nto sx subtraces, one per month, and takng each one as pertanng to a class. Per class arrvals are assumed to follow a non-homogeneous Posson process wth rates gven by each subtrace. The nfrastructure s under-provsoned wth classes parameters gven n Table I. The workloads have typcal daly varatons wth request rates λ + shown n Table II. B. Securty Attacks We frst dscuss the most relevant results for scenaro 1, augmented wth an attack to class 1 at rate λ 1 =5 requests per second throughout smulaton,.e., an attack weght λ 1 /λ 1 varyng from.81 to.96. Class 2 s not under attack, and energy costs are not modeled. Fg. 3-a shows the provder s revenues for the four capacty management solutons analyzed. Fgs. 3-b and 3-c show the goodput of classes 1 and 2, respectvely, wth dfferent ranges n the y axs. The man dfferences between the Attack-Oblvous (AO) and Attack-Aware (AA) solutons are prmarly due to AA shftng capacty from class 1 (under attack) to captalze upon a hgher goodput of class 2. AA avods wastng capacty wth llegtmate requests, thus ncreasng overall goodput and the provder s revenues. The fracton of resources shfted to class 2, and thus the revenue gans of AA over AO, ncrease wth the load on class 2. For nstance, durng steps 5 and 3, when class 2 workload s heavy (see Fg. 2), revenues under AA are sgnfcantly hgher than under AO (Fg. 3-a), at the expense TABLE I APPLICATION CLASSES PARAMETERS Scenaro d,1 d,2 R SLA X N X S ms.6 ms.3 s 5 1 (Synthetc) 2.6 ms.9 ms.3 s , 3, 5 12 ms 8ms.4 s (Realstc) 2, 4, 6 8ms 12 ms.4 s TABLE II SCENARIO 2(REALISTIC)WORKLOAD CHARACTERISTICS Class λ + (req/s) Attack Characterstcs (mn, avg, max) Start Tme Duraton (mn) λ (req/s) 1.1, 24, 42 h1m44s , 13, 27 17hms , 18, , 2, 39 36h26m32s , 13, 25 3hms , 18, 34 of a reducton n class 1 goodput (Fg. 3-b) and an ncrease n class 2 goodput (Fg. 3-c). Moreover, f the attack s too heavy (e.g., up to step 7), the vctm class may be completely turned off by AA so as to maxmze profts from class 2. However, f class 2 load s lght, there s no beneft n shftng capacty, and both solutons yeld smlar results (between steps 12 and 18). Overall, AA provdes sgnfcant revenue gans over AO (16% on average). From the customers perspectve, response tmes and costs are unaffected, but the vctm class goodput s greatly penalzed (.e., 41%) whereas class 2 benefts from extra capacty, reachng a total goodput that s 34% hgher. We now turn our attenton to the adaptve SLA solutons (AC and S-AR) as strateges to reduce the penaltes on the vctm s goodput. Unlke AA, the Adaptve Cost (AC) soluton does not shft capacty away from the vctm class, as the extra costs pad completely mtgate the mpact of the attack on the provder s revenues. In fact, Fg. 3-a shows that revenues under AC are the greatest of the four solutons, and on average 59% hgher than AA. Moreover, Fgs. 3-b,c show that the goodput of both classes (n partcular of the vctm) s as hgh as under AO, and 7% hgher than under AA, on average. However, ths comes at the expense of a cost per legtmate request served that s almost 7 tmes hgher, on average, whch may be nterestng only to the most crtcal applcatons. The S-AR soluton takes advantage of the response tme relaxaton (w s 1=5) to admt a larger number of class 1 requests, ncreasng VM utlzatons. Compared to AA, t ncreases the vctm s average goodput n 18% wth mnor mpact on class 2 goodput (unlke AC). In return, response tme 9 th percentle grows from.3s to.13s. If the ncreased delay s acceptable, S-AR may be a cost-effectve opton to applcatons under attacks. On the provder s sde, S-AR results n average revenues that are only 1.2% hgher (Fg. 3-a). These results are summarzed n Table III, whch show averages of the provder s revenues and the customers cost per request and goodput. Compared to AO, AA yelds greater revenues by ncreasng class 2 resource allocaton and, thus, goodput, but the vctm goodput drops sgnfcantly. AC yelds the hghest revenues, and the vctm class has the same goodput as n AO, but at a sgnfcantly hgher cost per request.

6 Arrval Rate (req/s) Class 1 Class 2 Fg. 2. Synthetc Workload Revenue/s 1 8 AC S AR AA AO Goodput (req/s) AO, AC S AR AA (a) Revenues (b) Class 1 Goodput (c) Class 2 Goodput Fg. 3. Provder s Revenues and Customer s Goodput (Scenaro 1, λ 1 = 5 req/s, ws 1 =5) Goodput (req/s) AA S AR AO, AC Average Revenue/s TABLE III SUMMARY OF IMPACT OF SECURITY ATTACKS:AVERAGE RESULTS (SCENARIO 1, λ 1 =5 REQ/S, ws 1 =5) Soluton Revenues Class 1 Class 2 per sec Cost/Req Goodput Cost/Req Goodput AO req/s req/s AA req/s req/s AC req/s req/s S-AR req/s req/s 1 8 AC S AR AA AO 8 1 λ 1 Fg. 4. Avg. Revenues vs. λ 1 (Scenaro 1, w s 1 =5) P(R < r) AA / tght SLA.2 AA / loose SLA S AR / tght SLA S AR / loose SLA Response Tme r Fg. 5. Impact of S-AR on R (Scenaro 1, λ 1 =5 req/s, ws 1 =5) Fnally, S-AR s able to ncrease revenues and goodput, at the cost of longer response tmes for the vctm class (not shown). We now analyze the mpact of varyng attack rates. Fg. 4 shows that the dfference between AA and AO ncreases wth λ 1, as expected. Perhaps less ntutve s the small revenue ncrease acheved wth AC, when class 1 s under attack (λ 1 >). Ths s due to dle capacty beng used to serve, and captalze upon, llegtmate requests (around step 19). The gans ncrease wth the fracton of dle capacty avalable. Next, we dscuss the dfference between AA and S-AR n detal. Three key ponts are worth mentonng. Frst, revenue and goodput dfferences depend on the attack weght. The heaver the attack, the smaller the fracton of legtmate requests served, and smaller s the beneft from relaxng the vctm s R SLA. Fg. 4 shows S-AR s revenues convergng to AA s as λ ncreases. Goodput curves for both classes (not shown) have smlar behavor. Second, the tghter the orgnal R SLA, the greater the mpact of relaxng t. Snce VM utlzatons and response tme are related by a non-lnear functon, the gans from relaxng the orgnal R SLA are greater when t s before the knee of the curve. Ths s llustrated n Fg. 5, whch shows the response tme dstrbutons for both AA and S-AR wth orgnal R SLA equal to 1d (tght) and 5d (loose), where d = K j=1 d,j. The dstance between AA and S-AR curves for each case (tght and loose) gves an dea of the ncrease n utlzaton, and thus, goodput. The relaxaton TABLE IV IMPACT OF SECURITY ATTACKS:AVERAGES (SCENARIO 2, w s =5) Interval Class Metrc AO AA AC S-AR Revenues/s All =1 6 Cost/Req Attacks (Avg.) 9% R (s) Goodput (req/s) Cost/Req Attack to =5 9% R (s) Class 5 Goodput (req/s) of the tght R SLA gves more room for mprovement. In fact, the average gans n the vctm goodput (revenues) provded by S-AR goes from 4% (.5%) for the loose SLA to 77% (3.1%) for the tght SLA, wth no mpact on class 2 goodput. Fnally, all results shown are for a relaxaton factor w1 s =5. Greater values of w1 s lead to smlar results as VM utlzatons are already close to the maxmum allowed (ν,j ). Lower values lead to smaller dfferences between S-AR and AA. We now consder scenaro 2, bult from realstc workloads, augmented wth 4 attacks wth duratons and rates λ derved from [22]. Attacks target classes 1, 2, 4 and 5, each wth start tme (from smulaton startup), duraton and rate shown n Table II. In order to hghlght the tradeoffs due to the attacks, we report, n Table IV, average results for the total nterval durng whch at least one class s under attack, and for the nterval durng the attack to class 5. For the latter, we show metrcs only for the vctm class. Both aggregated and per-class results llustrate the same tradeoffs dentfed n scenaro 1. AA greatly mproves revenues over AO at the cost of penaltes to the vctm goodput. AC elmnates the penaltes at a sgnfcant ncrease n costs, whereas S-AR provdes some gan for the vctm at a compromse n response tme. The gans of R-SLA are modest due to the loose orgnal SLA. C. Energy Constrants Our man goal s to show key tradeoffs that arse when energy costs are ncluded nto capacty management, comparng the EA and E-AR solutons when energy savngs are desrable (S=) or must be enforced (S>). The benefts of consderng such costs,.e., EA over EO, are dscussed later. We show results for scenaro 1, wth no attacks, keepng the term goodput to refer to an applcaton class throughput. Ters have equal capacty (s 1 =s 2 =1, C=2), and per-ter energy costs are set to a percentage of the maxmum possble revenue, K/(d,1 +d,2 ). Gven a fxed total energy cost, two confguratons are consdered, namely, homogeneous costs fxed at 18%

7 Revenue/s E AR/S=.1 EA/S= EA/S=.1 (a) Revenues/s (Hom/Het) Goodput (req/s) Class 1, EA/Hom Class 1, EA/Het Class 2, EA/Het Goodput (req/s) Class 1, E AR/Het Class 1, EA/Hom Class 1, EA/Het Class 2, EA/Het Energy Reducton S (%) (b) Goodput (EA soluton, S= ) (c) Goodput (S =.1) (d) Impact of E-AR on Goodput Fg. 6. Results for Energy Constrants (Scenaro 1, s 1 = s 2 =1, C =2, w e =25) R SLA Relaxaton No penalty Penalty=1% Penalty=2% (.e., e 1 =e 2 =24), and heterogeneous costs of 3% (e 1 =) and 6% (e 2 =8). The tradeoffs shown hold for other costs. We start by evaluatng the EA soluton for S=. Revenues, shown n Fg. 6-a, are the same for both homogeneous and heterogeneous confguratons, as total energy cost s fxed. Fg. 6-b shows per-class goodput for each confguraton. Class 2 goodput for the homogeneous case (omtted) s smlar to class 1, shfted accordng to the workload. For the heterogeneous case, however, t s more cost-effectve to turn off more resources from the costler ter (ter 1), removng them from the class wth heaver (local) demand (class 1). Class 1 s thus penalzed, as shown n Fg. 6-b, wth an 8% decrease n ts goodput. Occasonally, the reducton n class 1 goodput may lead to some resources of ter 2 beng shfted to class 2, favorng t. These results are summarzed n Table V. Note the ter allocatons (two rghtmost columns), wth more resources beng turned off from ter 1 n the heterogeneous case. When there s a 1% energy constrant (S=.1), revenues and goodput of both classes decrease due to the reduced capacty, as shown n Fgs. 6-a and 6-c. The same tradeoffs observed for S= hold n ths case. However, n the heterogeneous confguraton, EA s even more aggressve n removng ter 1 capacty from class 1. Fgs. 6-b and 6-c show that class 2 goodput s less penalzed by the reducton n capacty (6% versus 1% for class 1, on average). Moreover, Table V shows that, comparng the two confguratons for S=.1, class 1 average goodput decreases n 5%, whereas class 2, wth the lghter demand on the costler ter, s favored wth an average goodput 3% hgher n the heterogeneous case. We now consder the use of the E-AR soluton, based on adaptve response tme SLAs, when S=.1, wth an nflaton factor w e =25 for both classes. Revenues and class 1 goodput are shown n Fgs. 6-a and 6-c. Average results are summarzed n Table V. Compared to EA, the relaxaton of response tme yelds around 22% more revenues for both confguratons. In the heterogeneous case, the average goodput of class 1 (2) ncreases n 14% (19%). Both classes have a 16% hgher goodput n the homogeneous case. Ths comes at the cost of a 9 th percentle of response tmes that s 3 tmes longer. In order to understand the tradeoff between R SLA relaxaton and goodput when energy s constraned, we consder only class 1 runnng on the homogeneous confguraton, wth fxed λ acc 1 =33 req/s, for varous values of S (energy reducton). Fg. 6-d shows, for ncreasng values of S, the relaxaton w1 e S that should be appled so that class 1 goodput s not TABLE V SUMMARY OF IMPACT OF ENERGY CONSTRAINTS:AVERAGE RESULTS (SCENARIO 1, s 1 = s 2 =1,C =2,w e = 25) Sol. Confg. Rev./s λ acc 1 λ acc 2 f,1 f,2 EA S=, Hom S=, Het EA S=.1, Hom S=.1, Het E-AR S=.1, Hom S=.1, Het penalzed f compared to EA soluton for S=. For nstance, f 1% of energy must be saved (S=.1), R1 SLA must be 2.5 tmes longer so as to guarantee the same throughput λ acc 1 acheved wth EA and S=. For small energy reductons (.e., S<6%), a small relaxaton s enough to guarantee no penaltes. However, the requred relaxaton grows to nfnty quckly. In ths example, energy reductons above 18% are not achevable wthout penalzng goodput, as the maxmum goodput achevable s constraned by VM utlzatons (lmted to ν,j ), and, thus, by the maxmum capacty allocaton. Fg. 6-d also shows curves for 1% and 2% penaltes, llustratng the tradeoff between the relaxaton factor and goodput degradaton. Regardng results n Table V, the value of w e =25 used s large enough to guarantee no goodput penaltes. Regardng the benefts of consderng energy costs (EA versus EO), we fnd that, as n [1], EA provdes great gans by turnng dle resources off durng lght load perods. For a lghter scenaro 1, wth d,j and RSLA dvded by 1.5, EA saves 73% energy, ncreasng revenues n 2%. We also fnd that the mpact on revenues of the tme nterval taken to turn resources on (reboot tme), durng whch they consume energy but are not used to serve requests, depends on allocaton varablty. For scenaro 1, t s under 4% for reboot tmes as long as half the control nterval. Fnally, the tradeoffs dscussed above for scenaro 1, also hold for the more realstc scenaro 2. These results are omtted due to space constrants. V. HIGH VARIABILITY IN SERVICE TIMES We now turn our focus to performance, leavng out securty and energy ssues, to assess the senstvty of our orgnal framework to the assumpton of exponental servce tmes. We run experments wth scenaro 1, assumng per ter servce tmes follow lognormal dstrbutons wth varous coeffcents of varaton (CV). Exponental servce tmes are taken as baselne. We then consder three estmates of P (R >R SLA ):

8 TABLE VI AVERAGE REVENUES AND PROBABILITY OF VIOLATIONS (SCENARIO 1) Servce Tme Hypoexp. Cheb. M/M/1 Cheb. M/G/1 Dstrbutons Rev. Prob. Rev. Prob. Rev. Prob. Exponental 926 9% % % Lognormal (CV=2) 81 24% % % Lognormal (CV=3) 71 35% 79 15% % Lognormal (CV=5) 56 49% 73 26% % Hypoexponental: uses the hypoexponental dstrbuton whch s exact for exponental servce tmes (M/M/1 queues). Chebyshev (M/M/1): assumes M/M/1 queues, and uses the upper-bound P (R R SLA Var[R ] ) (R SLA E[R ]),gvenby 2 Chebyshev s Inequalty [18], where E[R ] and Var[R ] are the mean and varance of system response tme, whch are easly computed for M/M/1 queues [12]. Chebyshev (M/G/1): Chebyshev s Inequalty s used but each ter s modeled as an M/G/1 queue. Mean and varance of response tme are computed from correspondng metrcs of per-ter resdence tmes, whch, n turn, are estmated from the servce tme dstrbutons (lognormal) and watng tmes. Watng tme metrcs are estmated usng the frst three moments of the servce tme dstrbutons, as detaled n [18]. Models based on G/G/1 queues (derved from [23]) yelded smlar results wth hgher complexty, and are thus omtted. Note that all three models ntroduce extra errors by assumng Posson arrvals at the back-end ter. Table VI shows average revenues and probabltes of SLA volatons, for varous dstrbutons and models. The very aggressve allocaton decsons made by the hypoexponental model [12], yeldng a probablty of volatons close to target α =.1 n the baselne, leaves lttle room to accommodate extra varance. As CV ncreases, the number of volatons escalates and revenues drops. The more conservatve Chebyshev (M/M/1) model [12] stll meets the SLA for CVs under 3, wth small mpact on revenues. By capturng servce tme varablty, the more complex Chebyshev (M/G/1) estmate always satsfes the SLA, at the cost of very conservatve admsson control decsons, and ultmately very low revenues. Smlar results are obtaned for other dstrbutons of servce tmes. Thus, n case of nonexponental dstrbutons, our framework, usng the smple Chebyshev s bound and assumng M/M/1 queues [12], yelds satsfactory results for moderate CVs (under 3). Note that the conclusons drawn n Secton IV, usng the hypoexponental model and assumng exponental servce tmes, should hold also for the Chebyshev (M/M/1) model, as both yeld the same tradeoffs for exponental servce tmes [12]. VI. CONCLUSIONS Ths paper extends our capacty management framework to capture key cost and performance tradeoffs ntroduced by securty attacks and energy constrants. Based on experments wth synthetc and realstc workloads, we reached the followng conclusons. Frst, ntroducng energy and securty awareness nto our framework provdes great revenue gans at the cost of goodput degradaton, partcularly for applcatons under attacks or wth heavy demands on the costler ters. Second, dynamc SLA strateges can help reduce goodput degradaton. In the case of an applcaton under attack, degradaton may be elmnated f t agrees to pay extra for each legtmate request served. Moreover, response tme SLA relaxaton also reduces degradaton due to an attack or energy constrant, although ts beneft depends on the orgnal SLA, on the relaxaton factor and on target utlzatons. Complementary, we also showed that our framework s cost-effectve even for non-exponental servce tmes wth moderate varablty. Future work ncludes the desgn of more sophstcated models of energy costs and securty attacks and extensons to take the end-user perspectve nto the desgn of servce reputaton, workload forecastng and request prortzaton mechansms. ACKNOWLEDGMENT Ths work was done n collaboraton wth HP Brazl R&D. REFERENCES [1] E. Gelenbe and G. Loukas, A Self-Aware Approach to Denal of Servce Defence, Computer Networks, vol. 51(5), 7. [2] M. Walfsh, M. Vutukuru, H. Balakrshnan, D. Karger, and S. Shenker, DDoS Defense by Offense, n Proc. SIGCOMM, Psa, Italy, Sep. 6. [3] J. Mrkovc and P. Reher, A Taxonomy of DDoS Attack and DDoS Defense Mechansms, ACM SIGCOMM Computer Communcaton Revew, vol. 34(2), 4. [4] S. Crosby, et al., Denal of Servce va Algorthmc Complexty Attacks, n Proc. USENIX Securty Symp., Washngton, DC, Aug. 3. [5] S. Kandula, et al, Botz-4-Sale: Survvng Organzed DDoS Attacks That Mmc Flash Crowds, n Proc. 2nd NSDI, Boston, MA, May 5. [6] M. Lesk, The New Front Lne: Estona under Cyberassault, IEEE Securty & Prvacy, vol. 5(4), 7. [7] Gartner, Gartner Urges IT and Busness Leaders to Wake up to IT s Energy Crss, September 6. [Onlne]. Avalable: [8] B. Urgaonkar, et al., Dynamc Provsonng of Mult-ter Internet Applcatons, n Proc. 2nd IEEE ICAC, Seattle, WA, June 5. [9] Z. Lu, M. Squllante, and J. Wolf, On Maxmzng Servce-Level- Agreement Profts, Performance Evaluaton Rev., vol. 29(3), Dec. 1. [1] J. Almeda, V. Almeda, D. Ardagna, C. Francalanc, and M. Truban, Resource Management n the Autonomc Servce-Orented Archtecture, n Proc. 3rd IEEE ICAC, Dubln, Ireland, June 6. [11] B. Abrahao, V. Almeda, J. Almeda, A. Zhang, D. Beyer, and F. Safa, Self-Adaptve SLA-Drven Capacty Management for Internet Servces, n Proc. 1th IEEE/IFIP NOMS, Vancouver, Canada, Apr. 6. [12] Í. Cunha, J. Almeda, V. Almeda, and M. Santos, Self-Adaptve Capacty Management for Mult-Ter Vrtualzed Envronments, n Proc. 1th IEEE/IFIP IM, Munch, Germany, May 7. [13] Y. Chen, et al., Managng Server Energy and Operatonal Costs n Hostng Centers, n Proc. SIGMETRICS 5, Banff, Canada, June 5. [14] N. Bobroff, A. Kochut, and K. Beaty, Dynamc Placement of Vrtual Machnes for Managng SLA Volatons, n Proc. 1th IEEE/IFIP IM, Munch, Germany, May 7. [15] M. Stender, I. Whalley, D. Carrera, I. Gaweda, and D. Chess, Server Vrtualzaton n Autonomc Management of Heterogeneous Workloads, n Proc. 1th IEEE/IFIP IM, Munch, Germany, May 7. [16] B. Abraham and J. Ledolter, Statstcal Methods for Forecastng. John Wley and Sons, [17] H. Perros and K. Elsayed, Call Admsson Control Schemes: A Revew, IEEE Communcatons Magazne, vol. 34(11), 3. [18] L. Klenrock, Queueng Systems. John Wley and Sons, [19] F. Popovc and J. Wlkes, Proftable Servces n an Uncertan World, n Proc. SuperComputng, Seattle, WA, Nov. 5. [2] [Onlne]. Avalable: [21] C. Lefurgy, et al., Energy Management for Commercal Servers, IEEE Computer, vol. 36(12), 3. [22] A. Hussan, et al., A Framework for Classfyng Denal of Servce Attacks, n Proc. ACM SIGCOMM, Karlsruhe, Germany, Aug. 3. [23] W. Whtt, Approxmatons for the GI/G/m Queue, Producton and Operatons Management, vol. 2(2), 1993.