Application-level Simulation for Network Security

Abstract

We introduce and describe a novel network simulation tool called NeSSi (Network Security Simulator). NeSSi incorporates a variety of features relevant to network security distinguishing it from general-purpose network simulators. Its capabilities such as profilebased automated attack generation, traffic analysis and interface support for the plug-in of detection algorithms allow it to be used for security research and evaluation purposes. NeSSi has been utilized for testing intrusion detection algorithms, conducting network security analysis, and developing distributed security frameworks at the application level. NeSSi is built upon the agent componentware framework JIAC [5], resulting in a distributed and easy-toextend architecture. In this paper, we provide an overview of the NeSSi architecture and briefly demonstrate its usage in three example security research projects. These projects comprise of evaluation of stand-alone detection unit performance, detection device deployment at central nodes in the network and comparison of different detection algorithms.

Investigating the application of moving target defenses to network security

“…The first simulation, which we call the RMSonly Simulation, was developed to evaluate the effectiveness of our MTD approach using an existing network simulator called NeSSi2, an open-source, discrete-event based network security simulator with support for complex application-level scenarios based on a simulated TCP/IP protocol stack [11]. In this simulation, we assumed the attacker had full knowledge of the logical system configuration and only attacked through the systems RMS system.…”

Impact of Distributed Denial-of-Service Attack on Advanced Metering Infrastructure

“…NeSSi 2 is an agent-based simulation environment that provides telecommunication network simulation capabilities with an extensive support to evaluate security solutions such as IDS (Intrusion Detection System) [4]. In contrast to other popular network simulators, such as ns-2 [18], ns-3 [19] or OMNeT++ [20], NeSSi 2 provides a comprehensive detection application programming interface (API) for the integration and evaluation of IDS.…”

“…The aim of the article is to study the impact of large-scale DDoS attack on the information and communication infrastructure of smart grid AMI network through a network simulation tool called NeSSi 2 [4].…”

A Framework for Automated Identification of Attack Scenarios on IT Infrastructures

“…Our open source simulation framework (NeSSi 2 ) 2 [9] operating on JIAC 3 [5] can handle large-scale network topologies, services, and vulnerabilities. The simulation component based on NeSSi 2 helps assess the impact of multi-step attacks and their mitigation strategies over the target IT infrastructure and its services.…”