Method for detecting attacks and for protection

摘要

A method is provided for attack detection and protection of a set of virtual machines in a system, which includes at least one first host server hosting said set of virtual machines. The method includes: receiving an attack detection message regarding a virtual machine, triggering a first migration of the virtual machine from the first host server toward a security system, and receiving an attack treatment message regarding the migrated virtual machine.

主权项

1. A method of attack detection and protection of a set of virtual machines in a system comprising at least one first host server hosting said set of virtual machines, wherein the method comprises:
receiving, by a device, an attack detection message regarding a virtual machine, said attack detection message being received when the virtual machine has been subjected to a number of migrations from the first host server toward a second host server greater than a first threshold value during a first set time period or when the virtual machine is at an origin of a number of migrations of co-tenant machines of said virtual machine greater than a second threshold value during a second set time period, triggering, by the device, a first migration of the virtual machine from the first host server toward a security system, said security system comprising security virtual machines dedicated to treating attacks, including a security virtual machine associated to the migrated virtual machine to treat the attack, receiving, by the device, an attack treatment message signaling that the attack detected against the migrated virtual machine has been treated, and triggering a second migration of the virtual machine toward the first host server when the security system has treated the attack.