Cloud computing digital forensics framework for automated anomalies detection

Cloud Computing is one of the most important paradigms used in today´s digital environment because they offer to the user benefits such as virtual machine renting, digital information backup, ease of access to stored data and many other. Together with the increased usage of these technologies, at the datacenter level we need to know in detail the information flux between the computing nodes. More exactly, on which server the data is processed, how it is manipulated and stored at the physical or virtual level. To have a full picture of what it is going on we need to have a centralized system that can collect data regarding about the datacenters status and correlate them with known anomalies and other usage patterns and in case of a security breach to act accordingly. In this paper we present a new way to monitor running virtual machines existing at a datacenter level. We will talk about the architecture, and how we use the information collected to train our automated anomalies machine learning modules. We also present some implementation details and results taken from the experimental setup.