Improving Tenants' Trust in SaaS Applications Using Dynamic Security Monitors

摘要: It is almost impossible to prove that a given software system achieves an absolute security level. This becomes more complicated when addressing multi-tenant cloud-based SaaS applications. Developing practical properties and metrics monitor, verify, assess the behavior of such systems feasible alternative problem. However, existing efforts focus either on verifying or but not both. Moreover, they are hard adopt, in terms usability, require design-time preparation support monitoring which for In this paper, we introduce, best our knowledge, first unified platform enables application tenants specify, at run-time, without hence increases tenants' trust their cloud-assets security. The automatically converts specifications into probes integrates them with target run-time. Probes-generated measurements fed analysis component verifies specified calculates metrics' values using aggregation functions. then reported cloud engineers. We evaluated expressiveness soundness, performance overhead.