Automated Evaluation of Network Intrusion Detection Systems in IaaS Clouds

Abstract

This paper describes an approach for the automated security evaluation of operational Network Intrusion Detection Systems (NIDS) in Infrastructure as a Service (IaaS) cloud computing environments. Our objective is to provide automated and experimental methods to execute attack campaigns and analyze NIDS reactions, in order to highlight the ability of the NIDS to protect clients' virtual infrastructures and find potential weaknesses in their placement and configuration. To do so, we designed a three-phase approach. It is composed of the cloning of the target client's infrastructure to perform the subsequent audit operations on a clone, followed by the analysis of network access controls to determine the network accessibilities in the cloned infrastructure. Using evaluation traffic we modeled and generated, the last phase of the approach, presented in this paper, focuses on executing attack campaigns following an optimized algorithm. The NIDS alerts are analyzed and evaluation metrics are computed. Our approach is sustained by a prototype and experiments carried out on a VMware-based cloud platform.

Verification for security monitoring SLAs in IaaS clouds: The example of a network IDS

“…To measure the effectiveness of an NIDS in a cloud environment, Probst et al [14] describe a method in two phases: an analysis of network access control followed by the IDS evaluation in a cloned infrastructure based on the set of services running in the virtual infrastructure. Before this work, Massicotte et al [15] used a virtual infrastructure to generate traffic traces and used the trace to evaluate IDSs hosted in physical servers.…”

“…Any mechanism that can simulate the network behavior of an application could be used in our methodology. In [14] an automaton is used to model network exchanges of an application with a legitimate and a malicious user. More realistic simulations produce more accurate results.…”

Including Security Monitoring in Cloud Service Level Agreements

“…To verify an IDS, Probst et al [5] describe a method in two phases: an analysis of network access control followed by the IDS evaluation based on the set of services running in the virtual infrastructure. Before this work, Massicotte et al [4] used a virtual infrastructure to generate traffic traces and used the traces to evaluate IDSs in traditional servers (non-cloud environment).…”

SLA definition for network intrusion detection systems in IaaS clouds

“…The life-cycle of an SLA can be separated in three phases called SLA definition and negotiation, SLA enforcement and SLA verification [20]. Methods were proposed for the SLA verification phase in the case of an NIDS [2,18,22]. In this paper, we show how we can achieve the SLA definition and negotiation phase, thanks to new constructs in a cloud SLA language and an efficient knowledge-base building method for NIDS performance.…”