{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T11:01:01Z","timestamp":1777806061704,"version":"3.51.4"},"reference-count":46,"publisher":"SAGE Publications","issue":"5","license":[{"start":{"date-parts":[[2018,3,29]],"date-time":"2018-03-29T00:00:00Z","timestamp":1522281600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2018,8,9]]},"abstract":"<jats:p>Cloud computing, while becoming more and more popular as a dominant computing platform, introduces new security challenges. When virtual machines are deployed in a cloud environment, virtual machine placement strategies can significantly affect the overall security risks of the entire cloud. In recent years, the attacks are specifically designed to co-locate with target virtual machines in the cloud. The virtual machine placement without considering the security risks may put the users, or even the entire cloud, in danger. In this paper, we present a comprehensive approach to quantify the security risk of cloud environments from network, host and VM. Accordingly, we propose a Security-aware Multi-Objective Optimization based virtual machine Placement scheme (SMOOP) to seek a Pareto-optimal solution that reduces the overall security risks of a cloud, while considering workload balance, resource utilization on CPU, memory, disk, and network traffic. New placement strategies are designed and our evaluation results demonstrate their effectiveness. The security of clouds could be improved with affordable overheads. The latest VM allocation policies are further studied and integrated into our designs to defeat the co-residence attacks.<\/jats:p>","DOI":"10.3233\/jcs-171104","type":"journal-article","created":{"date-parts":[[2018,3,30]],"date-time":"2018-03-30T10:19:45Z","timestamp":1522405185000},"page":"707-730","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":6,"title":["Risk-aware multi-objective optimized virtual machine placement in the cloud"],"prefix":"10.1177","volume":"26","author":[{"given":"Jin","family":"Han","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Texas at San Antonio, TX, USA. E-mails:\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wangyu","family":"Zang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Texas A&M University at San Antonio, TX, USA. E-mail:\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Li","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, George Mason University, VA, USA. E-mails:\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Songqing","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Computer Science, George Mason University, VA, USA. E-mails:\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Meng","family":"Yu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Texas at San Antonio, TX, USA. E-mails:\u00a0,\u00a0"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2018,3,29]]},"reference":[{"key":"ref001","unstructured":"Z.\u00a0Afoulki, A.\u00a0Bousquet and J.\u00a0Rouzaud-Cornabas, A security-aware scheduler for virtual machines on iaas clouds, Report, 2011."},{"key":"ref002","doi-asserted-by":"crossref","unstructured":"S.\u00a0Al-Haj, E.\u00a0Al-Shaer and H.V.\u00a0Ramasamy, Security-aware resource allocation in clouds, in: 2013 IEEE International Conference on Services Computing, 2013, pp.\u00a0400\u2013407. doi:10.1109\/SCC.2013.36.","DOI":"10.1109\/SCC.2013.36"},{"key":"ref003","doi-asserted-by":"crossref","unstructured":"M.\u00a0Alicherry and T.V.\u00a0Lakshman, Optimizing data access latencies in cloud systems by intelligent virtual machine placement, in: 2013 Proceedings IEEE INFOCOM, 2013, pp.\u00a0647\u2013655, ISSN 0743-166X. doi:10.1109\/INFCOM.2013.6566850.","DOI":"10.1109\/INFCOM.2013.6566850"},{"key":"ref004","unstructured":"Amazon, Amazon Web Services. http:\/\/aws.amazon.com."},{"key":"ref005","doi-asserted-by":"crossref","unstructured":"A.\u00a0Aviram, S.\u00a0Hu, B.\u00a0Ford and R.\u00a0Gummadi, Determinating timing channels in compute clouds, in: Proceedings of the 2010 ACM Workshop on Cloud Computing Security Workshop, CCSW \u201910, ACM, New York, NY, USA, 2010, pp.\u00a0103\u2013108. ISBN 978-1-4503-0089-6. doi:10.1145\/1866835.1866854. http:\/\/doi.acm.org\/10.1145\/1866835.1866854.","DOI":"10.1145\/1866835.1866854"},{"key":"ref006","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Azar, S.\u00a0Kamara, I.\u00a0Menache, M.\u00a0Raykova and B.\u00a0Shepard, Co-location-resistant clouds, in: Proceedings of the 6th Edition of the ACM Workshop on Cloud Computing Security, CCSW \u201914, ACM, New York, NY, USA, 2014, pp.\u00a09\u201320. ISBN 978-1-4503-3239-2. doi:10.1145\/2664168.2664179. http:\/\/doi.acm.org\/10.1145\/2664168.2664179.","DOI":"10.1145\/2664168.2664179"},{"key":"ref007","doi-asserted-by":"publisher","DOI":"10.1145\/1165389.945462"},{"key":"ref008","unstructured":"S.A.\u00a0Baset, L.\u00a0Wang and C.\u00a0Tang, Towards an understanding of oversubscription in cloud, in: Proceedings of the 2nd USENIX Conference on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services, Hot-ICE\u00a0\u201912, USENIX Association, Berkeley, CA, USA, 2012, p.\u00a07. http:\/\/dl.acm.org\/citation.cfm?id=2228283.2228293."},{"key":"ref009","doi-asserted-by":"crossref","unstructured":"E.\u00a0Bin, O.\u00a0Biran, O.\u00a0Boni, E.\u00a0Hadad, E.K.\u00a0Kolodner, Y.\u00a0Moatti and D.H.\u00a0Lorenz, Guaranteeing high availability goals for virtual machine placement, in: 2011 31st International Conference on Distributed Computing Systems, 2011, pp.\u00a0700\u2013709, ISSN 1063-6927. doi:10.1109\/ICDCS.2011.72.","DOI":"10.1109\/ICDCS.2011.72"},{"key":"ref010","unstructured":"S.\u00a0Bistarelli, S.N.\u00a0Foley and B.\u00a0O\u2019Sullivan, Detecting and eliminating the cascade vulnerability problem from multilevel security networks using soft constraints, in: Proceedings of the 16th Conference on Innovative Applications of Artifical Intelligence, IAAI \u201904, AAAI Press, 2004, pp.\u00a0808\u2013813. ISBN 0-262-51183-5. http:\/\/dl.acm.org\/citation.cfm?id=1597321.1597329."},{"key":"ref011","doi-asserted-by":"publisher","DOI":"10.1002\/spe.995"},{"key":"ref012","doi-asserted-by":"crossref","unstructured":"E.\u00a0Caron, A.D.\u00a0Le, A.\u00a0Lefray and C.\u00a0Toinard, Definition of security metrics for the cloud computing and security-aware virtual machine placement algorithms, in: 2013 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, 2013, pp.\u00a0125\u2013131. doi:10.1109\/CyberC.2013.28.","DOI":"10.1109\/CyberC.2013.28"},{"key":"ref013","unstructured":"CloudSim, http:\/\/www.cloudbus.org\/cloudsim\/."},{"key":"ref014","unstructured":"CVE-2007-4993, Xen guest root can escape to domain 0 through pygrub. http:\/\/cve.mitre.org\/cgibin\/cvename.cgi?name=CVE-2007-4993."},{"key":"ref015","unstructured":"CVE-2007-5497, Vulnerability in xenserver could result in privilege escalation and arbitrary code execution. http:\/\/suuport.citrix.com\/article\/CTX118766."},{"key":"ref016","doi-asserted-by":"publisher","DOI":"10.1109\/4235.996017"},{"key":"ref017","unstructured":"G.\u00a0D\u00f3sa and J.\u00a0Sgall, First fit bin packing: A tight analysis, in: 30th International Symposium on Theoretical Aspects of Computer Science (STACS 2013), N.\u00a0Portier and T.\u00a0Wilke, eds, Leibniz International Proceedings in Informatics (LIPIcs), Vol.\u00a020, Schloss Dagstuhl\u2013Leibniz-Zentrum fuer Informatik, Dagstuhl, Germany, 2013, pp.\u00a0538\u2013549, ISSN 1868-8969. ISBN 978-3-939897-50-7. doi:10.4230\/LIPIcs.STACS.2013.538. http:\/\/drops.dagstuhl.de\/opus\/volltexte\/2013\/3963."},{"key":"ref018","doi-asserted-by":"crossref","unstructured":"G.\u00a0D\u00f3sa and J.\u00a0Sgall, Optimal analysis of best fit bin packing, in: Automata, Languages, and Programming: 41st International Colloquium, ICALP 2014, Copenhagen, Denmark, July 8\u201311, 2014, Proceedings, Part I, J.\u00a0Esparza, P.\u00a0Fraigniaud, T.\u00a0Husfeldt and E.\u00a0Koutsoupias, eds, Springer, Berlin, Heidelberg, 2014, pp.\u00a0429\u2013441. doi:10.1007\/978-3-662-43948-7_36. https:\/\/doi.org\/10.1007\/978-3-662-43948-7_36.","DOI":"10.1007\/978-3-662-43948-7_36"},{"key":"ref019","unstructured":"A.\u00a0Hacker, Xbox 360 Hypervisor Privilege Escalation Vulnerability. http:\/\/www.securityfocus.com\/archive\/1\/461489."},{"key":"ref020","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Han, J.\u00a0Chan, T.\u00a0Alpcan and C.\u00a0Leckie, Virtual machine allocation policies against co-resident attacks in cloud computing, in: 2014 IEEE International Conference on Communications (ICC), 2014, pp.\u00a0786\u2013792, ISSN 1550-3607. doi:10.1109\/ICC.2014.6883415.","DOI":"10.1109\/ICC.2014.6883415"},{"issue":"1","key":"ref021","first-page":"95","volume":"14","author":"Han Y.","year":"2017","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"ref022","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-1993-2402"},{"key":"ref023","doi-asserted-by":"crossref","unstructured":"R.\u00a0Jansen and P.R.\u00a0Brenner, Energy efficient virtual machine allocation in the cloud, in: 2011 International Green Computing Conference and Workshops, 2011, pp.\u00a01\u20138. doi:10.1109\/IGCC.2011.6008550.","DOI":"10.1109\/IGCC.2011.6008550"},{"key":"ref024","doi-asserted-by":"crossref","unstructured":"R.\u00a0Jhawar, V.\u00a0Piuri and P.\u00a0Samarati, Supporting security requirements for resource management in cloud computing, in: 2012 IEEE 15th International Conference on Computational Science and Engineering, 2012, pp.\u00a0170\u2013177. doi:10.1109\/ICCSE.2012.32.","DOI":"10.1109\/ICCSE.2012.32"},{"key":"ref025","unstructured":"R.E.\u00a0Korf, A new algorithm for optimal bin packing, in: Eighteenth National Conference on Artificial Intelligence, American Association for Artificial Intelligence, Menlo Park, CA, USA, 2002, pp.\u00a0731\u2013736. ISBN 0-262-51129-0. http:\/\/dl.acm.org\/citation.cfm?id=777092.777205."},{"key":"ref026","unstructured":"KVM, Kernel Based Virtual Machine. http:\/\/www.linux-kvm.org."},{"key":"ref027","doi-asserted-by":"crossref","unstructured":"M.\u00a0Li, Y.\u00a0Zhang, K.\u00a0Bai, W.\u00a0Zang, M.\u00a0Yu and X.\u00a0He, Improving Cloud Survivability through Dependency based Virtual Machine Placement, 2012, pp.\u00a0321\u2013326.","DOI":"10.5220\/0004076003210326"},{"key":"ref028","doi-asserted-by":"publisher","DOI":"10.1145\/2797211"},{"key":"ref029","doi-asserted-by":"crossref","unstructured":"H.\u00a0Maziku and S.\u00a0Shetty, Network aware VM migration in cloud data centers, in: 2014 Third GENI Research and Educational Experiment Workshop, 2014, pp.\u00a025\u201328. doi:10.1109\/GREE.2014.18.","DOI":"10.1109\/GREE.2014.18"},{"key":"ref030","doi-asserted-by":"crossref","unstructured":"D.H.\u00a0Phan, J.\u00a0Suzuki, R.\u00a0Carroll, S.\u00a0Balasubramaniam, W.\u00a0Donnelly and D.\u00a0Botvich, Evolutionary multiobjective optimization for green clouds, in: Proceedings of the 14th Annual Conference Companion on Genetic and Evolutionary Computation, GECCO \u201912, ACM, New York, NY, USA, 2012, pp.\u00a019\u201326. ISBN 978-1-4503-1178-6.","DOI":"10.1145\/2330784.2330788"},{"key":"ref031","doi-asserted-by":"crossref","unstructured":"T.\u00a0Ristenpart, E.\u00a0Tromer, H.\u00a0Shacham and S.\u00a0Savage, Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds, in: Proceedings of the 16th ACM Conference on Computer and Communications Security, CCS \u201909, ACM, New York, NY, USA, 2009, pp.\u00a0199\u2013212. ISBN 978-1-60558-894-0. doi:10.1145\/1653662.1653687. http:\/\/doi.acm.org\/10.1145\/1653662.1653687.","DOI":"10.1145\/1653662.1653687"},{"key":"ref032","unstructured":"J.\u00a0Rutkowska and R.\u00a0Wojtczuk, Xen Owning Trilogy,\n                      Talk at Black Hat\n                      (2008)."},{"key":"ref033","doi-asserted-by":"crossref","unstructured":"C.\u00a0Servin, M.\u00a0Ceberio, E.\u00a0Freudenthal and S.\u00a0Bistarelli, An optimization approach using soft constraints for the cascade vulnerability problem, in: NAFIPS 2007\u00a0\u2013 2007 Annual Meeting of the North American Fuzzy Information Processing Society, 2007, pp.\u00a0372\u2013377. doi:10.1109\/NAFIPS.2007.383867.","DOI":"10.1109\/NAFIPS.2007.383867"},{"key":"ref034","doi-asserted-by":"crossref","unstructured":"S.\u00a0Shetty, X.\u00a0Yuchi and M.\u00a0Song, Security-aware virtual machine placement in cloud data center, in: Moving Target Defense for Distributed Systems, Springer, 2016, pp.\u00a013\u201324. doi:10.1007\/978-3-319-31032-9_2.","DOI":"10.1007\/978-3-319-31032-9_2"},{"key":"ref035","doi-asserted-by":"crossref","unstructured":"J.\u00a0Shi, X.\u00a0Song, H.\u00a0Chen and B.\u00a0Zang, Limiting cache-based side-channel in multi-tenant cloud using dynamic page coloring, in: 2011 IEEE\/IFIP 41st International Conference on Dependable Systems and Networks Workshops (DSN-W), 2011, pp.\u00a0194\u2013199, ISSN 2325-6648. doi:10.1109\/DSNW.2011.5958812.","DOI":"10.1109\/DSNW.2011.5958812"},{"key":"ref036","doi-asserted-by":"crossref","unstructured":"S.\u00a0Shigeta, H.\u00a0Yamashima, T.\u00a0Doi, T.\u00a0Kawai and K.\u00a0Fukui, Design and implementation of a multi-objective optimization mechanism for virtual machine placement in cloud computing data center, in: International Conference on Cloud Computing, Springer, 2012, pp.\u00a021\u201331.","DOI":"10.1007\/978-3-319-03874-2_3"},{"key":"ref037","unstructured":"V.\u00a0Varadarajan, Y.\u00a0Zhang, T.\u00a0Ristenpart and M.M.\u00a0Swift, A placement vulnerability study in multi-tenant public clouds, in: USENIX Security, 2015, pp.\u00a0913\u2013928."},{"key":"ref038","doi-asserted-by":"crossref","unstructured":"J.\u00a0Wu, L.\u00a0Ding, Y.\u00a0Lin, N.\u00a0Min-Allah and Y.\u00a0Wang, XenPump: A new method to mitigate timing channel in cloud computing, in: 2012 IEEE Fifth International Conference on Cloud Computing, 2012, pp.\u00a0678\u2013685, ISSN 2159-6182. doi:10.1109\/CLOUD.2012.28.","DOI":"10.1109\/CLOUD.2012.28"},{"key":"ref039","doi-asserted-by":"crossref","unstructured":"J.\u00a0Xu and J.A.B.\u00a0Fortes, Multi-objective virtual machine placement in virtualized data center environments, in: Green Computing and Communications (GreenCom), 2010 IEEE\/ACM Int\u2019l Conference on Int\u2019l Conference on Cyber, Physical and Social Computing (CPSCom), 2010, pp.\u00a0179\u2013188. doi:10.1109\/GreenCom-CPSCom.2010.137.","DOI":"10.1109\/GreenCom-CPSCom.2010.137"},{"key":"ref040","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Xu, W.\u00a0Cui and M.\u00a0Peinado, Controlled-channel attacks: Deterministic side channels for untrusted operating systems, in: 2015 IEEE Symposium on Security and Privacy, 2015, pp.\u00a0640\u2013656, ISSN 1081-6011. doi:10.1109\/SP.2015.45.","DOI":"10.1109\/SP.2015.45"},{"key":"ref041","unstructured":"Z.\u00a0Xu, H.\u00a0Wang and Z.\u00a0Wu, A measurement study on co-residence threat inside the cloud, in: 24th USENIX Security Symposium (USENIX Security 15), USENIX Association, Washington, D.C., 2015, pp.\u00a0929\u2013944. ISBN 978-1-931971-232. https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/xu."},{"key":"ref042","doi-asserted-by":"crossref","unstructured":"S.\u00a0Yu, X.\u00a0Gui, F.\u00a0Tian, P.\u00a0Yang and J.\u00a0Zhao, A security-awareness virtual machine placement scheme in the cloud, in: 2013 IEEE 10th International Conference on High Performance Computing and Communications 2013 IEEE International Conference on Embedded and Ubiquitous Computing, 2013, pp.\u00a01078\u20131083. doi:10.1109\/HPCC.and.EUC.2013.152.","DOI":"10.1109\/HPCC.and.EUC.2013.152"},{"key":"ref043","doi-asserted-by":"crossref","unstructured":"X.\u00a0Yuchi and S.\u00a0Shetty, Enabling security-aware virtual machine placement in IaaS clouds, in: MILCOM 2015\u00a0\u2013 2015 IEEE Military Communications Conference, 2015, pp.\u00a01554\u20131559. doi:10.1109\/MILCOM.2015.7357666.","DOI":"10.1109\/MILCOM.2015.7357666"},{"key":"ref044","doi-asserted-by":"crossref","unstructured":"W.\u00a0Zhang, X.\u00a0Jia, C.\u00a0Wang, S.\u00a0Zhang, Q.\u00a0Huang, M.\u00a0Wang and P.\u00a0Liu, A comprehensive study of co-residence threat in multi-tenant public PaaS clouds, in: Information and Communications Security, Springer, 2016, pp.\u00a0361\u2013375. doi:10.1007\/978-3-319-50011-9_28.","DOI":"10.1007\/978-3-319-50011-9_28"},{"key":"ref045","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Zhang, A.\u00a0Juels, M.K.\u00a0Reiter and T.\u00a0Ristenpart, Cross-tenant side-channel attacks in PaaS clouds, in: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS \u201914, ACM, New York, NY, USA, 2014, pp.\u00a0990\u20131003. ISBN 978-1-4503-2957-6.","DOI":"10.1145\/2660267.2660356"},{"key":"ref046","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Zhang, M.\u00a0Li, K.\u00a0Bai, M.\u00a0Yu and W.\u00a0Zang, Incentive compatible moving target defense against VM-colocation attacks in clouds, in: Information Security and Privacy Research: 27th IFIP TC 11 Information Security and Privacy Conference, Section\u00a02012, Heraklion, Crete, Greece, June 4\u20136, 2012, Proceedings, D.\u00a0Gritzalis, S.\u00a0Furnell and M.\u00a0Theoharidou, eds, Springer, Berlin, Heidelberg, 2012, pp.\u00a0388\u2013399. doi:10.1007\/978-3-642-30436-1_32.","DOI":"10.1007\/978-3-642-30436-1_32"}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-171104","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-171104","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-171104","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:45:14Z","timestamp":1777495514000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JCS-171104"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,3,29]]},"references-count":46,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2018,8,9]]}},"alternative-id":["10.3233\/JCS-171104"],"URL":"https:\/\/doi.org\/10.3233\/jcs-171104","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,3,29]]}}}