  In cloud computing, it is desirable if suspicious activities can be detected
by automatic anomaly detection systems. Although anomaly detection has been
investigated in the past, it remains unsolved in cloud computing. Challenges
are: characterizing the normal behavior of a cloud server, distinguishing
between benign and malicious anomalies (attacks), and preventing alert fatigue
due to false alarms.
  We propose CloudShield, a practical and generalizable real-time anomaly and
attack detection system for cloud computing. Cloudshield uses a general,
pretrained deep learning model with different cloud workloads, to predict the
normal behavior and provide real-time and continuous detection by examining the
model reconstruction error distributions. Once an anomaly is detected, to
reduce alert fatigue, CloudShield automatically distinguishes between benign
programs, known attacks, and zero-day attacks, by examining the prediction
error distributions. We evaluate the proposed CloudShield on representative
cloud benchmarks. Our evaluation shows that CloudShield, using model
pretraining, can apply to a wide scope of cloud workloads. Especially, we
observe that CloudShield can detect the recently proposed speculative execution
attacks, e.g., Spectre and Meltdown attacks, in milliseconds. Furthermore, we
show that CloudShield accurately differentiates and prioritizes known attacks,
and potential zero-day attacks, from benign programs. Thus, it significantly
reduces false alarms by up to 99.0%.
