PrivateEye: Scalable and Privacy Preserving Compromise Detection in the Cloud

on YouTube ↗17m

" summary

System uses vSwitch flow summaries polled every 10 seconds and a deployed collection agent running in all data centers for two years to avoid VM introspection or packet captures. It converts flows into temporal and spatial hashed features (anonymized, short-lived) and trains a random forest classifier on labels from the 5% of VMs with strong detectors. Evaluation reports AUC 0.96 and ~95.8% true positive at ~1% false positive, with detection latency around 10 minutes.

AI-written summary · about

" chapters (21)

1. 0:00Intro
2. 0:20CUSTOMER VMS DON'T INSTALL THE CLOUD PROVIDER'S COMPROMISE DETECTION SYSTEMS
3. 1:05THE NEED FOR SCALABLE PRIVACY PRESERVING COMPROMISE DETECTION
4. 1:45COMPROMISED VMS ATTACK OTHER CUSTOMER'S VMS
5. 2:37DATA CENTERS ARE UNDER CONSTANT ATTACK
6. 3:47IT IS IMPORTANT THAT OPERATORS BE ABLE TO PROTECT THEIR VMS
7. 4:15INSIGHT
8. 5:02THE CHALLENGE
9. 5:27PRIVATEEYE: SCALABLE PRIVACY PRESERVING COMPROMISE DETECTION FOR THE CLOUD
10. 6:12PRIVATEEYE'S GOAL IS NOT TO REPLACE TRADITIONAL COMPROMISE DETECTION SYSTEMS
11. 6:57COLLECTING NETWORK CONNECTION PATTERNS
12. 7:55SYSTEM ARCHITECTURE
13. 8:57FEATURE ENGINEERING
14. 9:25CREATING IP FEATURES IS CHALLENGING
15. 10:16WE SOLVE THESE CHALLENGES BY CAPTURING THE CHANGES IN THE VM's BEHAVIOR
16. 11:01TEMPORAL FEATURES: PROBABILISTIC CLUSTERING OF FLOWS
17. 11:41AN EXAMPLE OF CONSTRUCTING TEMPORAL FEATURES
18. 12:15CONSTRUCTING SPATIAL FEATURES
19. 12:50THE MACHINE LEARNING ALGORITHM
20. 13:17EVALUATION
21. 14:01WHAT IS THE ACCURACY OF THE MODEL?

" related talks

• 17mNetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center SecurityRanveer Chandra, Ravi Netravali, Kevin Hsieh, Santiago Segarra, Mike Wong, Srikanth Kandula, Sathiya Kumaran Mani, Trevor Eberl, Anatoliy Panasyuk · 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24)
• 49mA Real-World Example of Using Network Behaviour to Detect Cyber-CompromiseDamien Smith · RSAC 2018 Asia Pacific & Japan
• 14mEndangered Privacy: Large-Scale Monitoring of Video Streaming ServicesMartin Björklund, Romaric Duvignau · USENIX Security '25
• 11mCompeting for cloud security talent—win without the fight (PRT043)Andre Rall · AWS re:Invent 2022
• 17mSecuring Public Cloud Networks with Efficient Role-based Micro-SegmentationRanveer Chandra, Kevin Hsieh, Santiago Segarra, Srikanth Kandula, Sathiya Kumaran Mani, Yajie Zhou · NSDI '25
• 26mOptimized Invariant Representation of Network Traffic for Detecting Unseen...Karel Bartos, Michal Sofka, Vojtech Franc · USENIX Security '16
• 27mCollect All the Data; Protect All the ThingsAaron Rosenmund · BSidesSF 2019
• 14mConfidence in cloud security: One step ahead of cyber threatsTony Bailey · AWS re:Inforce 2024