Arhuaco: Deep Learning and Isolation Based Security for Distributed High-Throughput Computing
This addresses security for distributed high-throughput computing systems like the LHC Grid, offering an incremental improvement through combined isolation and machine learning techniques.
The paper tackles cybersecurity in grid computing by introducing Arhuaco, an integrated approach using Linux containers for isolation and deep learning for real-time intrusion detection, showing it outperforms other methods in the ALICE Collaboration Grid.
Grid computing systems require innovative methods and tools to identify cybersecurity incidents and perform autonomous actions i.e. without administrator intervention. They also require methods to isolate and trace job payload activity in order to protect users and find evidence of malicious behavior. We introduce an integrated approach of security monitoring via Security by Isolation with Linux Containers and Deep Learning methods for the analysis of real time data in Grid jobs running inside virtualized High-Throughput Computing infrastructure in order to detect and prevent intrusions. A dataset for malware detection in Grid computing is described. We show in addition the utilization of generative methods with Recurrent Neural Networks to improve the collected dataset. We present Arhuaco, a prototype implementation of the proposed methods. We empirically study the performance of our technique. The results show that Arhuaco outperforms other methods used in Intrusion Detection Systems for Grid Computing. The study is carried out in the ALICE Collaboration Grid, part of the Worldwide LHC Computing Grid.