Automated Evaluation of Network Intrusion Detection Systems in IaaS Clouds

Thibaut Probst (1) , Eric Alata (1) , Mohamed Kaâniche (1) , Vincent Nicomette (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

This paper describes an approach for the automated security evaluation of operational Network Intrusion Detection Systems (NIDS) in Infrastructure as a Service (IaaS) cloud computing environments. Our objective is to provide automated and experimental methods to execute attack campaigns and analyze NIDS reactions, in order to highlight the ability of the NIDS to protect clients' virtual infrastructures and find potential weaknesses in their placement and configuration. To do so, we designed a three-phase approach. It is composed of the cloning of the target client's infrastructure to perform the subsequent audit operations on a clone, followed by the analysis of network access controls to determine the network accessibilities in the cloned infrastructure. Using evaluation traffic we modeled and generated, the last phase of the approach, presented in this paper, focuses on executing attack campaigns following an optimized algorithm. The NIDS alerts are analyzed and evaluation metrics are computed. Our approach is sustained by a prototype and experiments carried out on a VMware-based cloud platform.

Mots clés: security; evaluation; attacks; cloud; NIDS; access control; intrusion detection

Domaines: Cryptographie et sécurité [cs.CR]; Informatique [cs]

Thibaut Probst, Eric Alata, Mohamed Kaâniche, Vincent Nicomette. Automated Evaluation of Network Intrusion Detection Systems in IaaS Clouds. 11th European Dependable Computing Conference (EDCC 2015), Sep 2015, Paris, France. ⟨hal-01212064⟩