network intrusion detection
IEEE TRANSACTIONSN ON DEPENDABLE AND SECURE COMPUTING VOL:10 NO:4 YEAR 2013
1
NICE: Network Intrusion Detection and Countermeasure
Selection in Virtual Network Systems
Chun-Jen Chung, Student Member, IEEE, Pankaj Khatkar, Student Member, IEEE, Tianyi Xing,
Jeongkeun Lee, Member, IEEE, and Dijiang Huang Senior Member, IEEE
Abstract—Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years.
Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale
Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multi-step exploitation, low frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multi-phase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages OpenFlow network programming APIs to build a monitor and control plane over distributed programmable virtual switches in order to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution. Index Terms—Network Security, Cloud Computing, Intrusion Detection, Attack Graph, Zombie Detection.
!
1
I NTRODUCTION
R
ECENT studies have shown that users migrating to the cloud consider
1
NICE: Network Intrusion Detection and Countermeasure
Selection in Virtual Network Systems
Chun-Jen Chung, Student Member, IEEE, Pankaj Khatkar, Student Member, IEEE, Tianyi Xing,
Jeongkeun Lee, Member, IEEE, and Dijiang Huang Senior Member, IEEE
Abstract—Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years.
Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale
Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multi-step exploitation, low frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multi-phase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages OpenFlow network programming APIs to build a monitor and control plane over distributed programmable virtual switches in order to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution. Index Terms—Network Security, Cloud Computing, Intrusion Detection, Attack Graph, Zombie Detection.
!
1
I NTRODUCTION
R
ECENT studies have shown that users migrating to the cloud consider