Cloud isolation vulnerabilities and defenses compared and scored

From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges

Cryptography and Security

Summary

Cloud computing lets many users share the same hardware, which can create security risks because their data could be exposed or attacked. The authors look at many studies about how virtual machines and containers—which keep users separated—can be broken into or abused. They analyze different types of attacks and then compare defenses using a new scoring system called ADPO that measures accuracy, ease of use, performance, and operational cost. They also show how severe various attacks can be and discuss the trade-offs between security and system speed. Finally, they point out challenges researchers still need to fix, like better detection tools and realistic test data.

What this means in practice

  • For cloud security engineers: Evaluate and choose cloud isolation defenses by comparing their accuracy and operational costs using the ADPO framework described in the paper.
  • For cybersecurity product developers: Use the identified security gaps and trade-offs to design intrusion detection tools with lower overhead based on mapped open challenges.

A survey. It maps existing work.

Authors

Swapnil Vishwas Baviskar, Sanoj R, Hiran V Nath

Abstract

In cloud computing, different users share the same physical hardware, which creates serious security risks. To protect data, cloud systems rely on virtual machines and containers to keep users isolated. This paper reviews over 120 security publications from 2008 to 2025, focusing on how these isolation boundaries can be breached. We examine threats like virtual machine escape, virtual machine hopping, CPU cache side-channels, container breakouts, vulnerable container images, and distributed denial of service (DDoS) attacks. We evaluate these security threats and their defenses using three key research questions. To compare different defense systems, we introduce a quantitative scoring framework called ADPO, which rates defenses from 0 to 3 based on their Accuracy, Deployment ease, Performance impact, and Operational overhead. We also map the impact of these attacks onto a 1-to-5 severity scale for Confidentiality, Integrity, and Availability. Finally, we highlight the trade-offs between security and system performance, and we outline open challenges like building low-overhead intrusion detection and creating realistic test datasets.
View PDFOpen arXiv