  In cloud computing, network Denial of Service (DoS) attacks are well studied
and defenses have been implemented, but severe DoS attacks on a victim's
working memory by a single hostile VM are not well understood. Memory DoS
attacks are Denial of Service (or Degradation of Service) attacks caused by
contention for hardware memory resources on a cloud server. Despite the strong
memory isolation techniques for virtual machines (VMs) enforced by the software
virtualization layer in cloud servers, the underlying hardware memory layers
are still shared by the VMs and can be exploited by a clever attacker in a
hostile VM co-located on the same server as the victim VM, denying the victim
the working memory he needs. We first show quantitatively the severity of
contention on different memory resources. We then show that a malicious cloud
customer can mount low-cost attacks to cause severe performance degradation for
a Hadoop distributed application, and 38X delay in response time for an
E-commerce website in the Amazon EC2 cloud.
  Then, we design an effective, new defense against these memory DoS attacks,
using a statistical metric to detect their existence and execution throttling
to mitigate the attack damage. We achieve this by a novel re-purposing of
existing hardware performance counters and duty cycle modulation for security,
rather than for improving performance or power consumption. We implement a full
prototype on the OpenStack cloud system. Our evaluations show that this defense
system can effectively defeat memory DoS attacks with negligible performance
overhead.
