CloudPathFI: Uncovering Cross-Layer Vulnerabilities in Cloud Networks via Path-Aware Fault Injection

Abstract

Cloud networks are critical to modern services, but failures in these networks still happen frequently and are hard to diagnose. To improve reliability, we need to understand which parts of a network are most likely to fail and how different types of faults affect end-to-end communication. Fault injection (FI) is a useful way to study cloud network failures, but current FI tools focus on a single VM/container, APIs, or applications, and cannot test faults along the full network path from source to destination. To address this limitation, we propose CloudPathFI, a fault injection tool that takes actual network paths as input and orchestrates targeted fault injection campaigns along these paths. It supports 15 common fault types based on real cloud incident reports and can test faults across control, data, management, and physical layers. We evaluated CloudPathFI in 924 fault injection experiments, and the results show that CloudPathFI achieves full path coverage, far exceeding baseline tools (6%-60%), while maintaining high reliability (99.78% FI success rate) and low overhead (avg. 4.3% CPU), and uncovering several key findings, such as the fragility of virtual-physical boundaries.