Servicenavigation

Project Details

Back

Projekt Print View

EvIDencE: Testing Intrusion Detection Systems in Virtualized Environments

Subject Area Security and Dependability, Operating-, Communication- and Distributed Systems
Term from 2016 to 2020
Project identifier Deutsche Forschungsgemeinschaft (DFG) - Project number 289129390
 
Final Report Year 2020

Final Report Abstract

The project started with a focus on testing intrusion detection systems (IDSes) in virtualized environments. However, we realized an extensive need for further research on the underlying issues of testing and benchmarking hypervisors and their hypercall interfaces as well as generating realistic workloads. Further on, we conducted research in the area of Software-Defined Networking (SDN) and Network Function Virtualization (NFV) in combination with IDSes and other security functions including IDSes for databases. We developed a feature-rich hypercall testing framework that can perform hypercall testing campaigns consisting of an arbitrary number of hypercalls. For human-readability, we developed the HyperCall Campaign Description Language (HCCDL) that simplifies campaign creation. It supports many features (e.g., random values, repetitions, delays, fuzzing). When running a hypercall testing campaign, an execution report is generated. Both, the campaign files and the results are stored in a human-readable format. This format is compiled by the framework into a hypervisorspecific campaign file readable by an injection driver. This driver module executes the hypercalls and collects potential return values. The collected metrics and return values are stored in log files. After the campaign is executed, the compiler once again converts these files into a human-readable format. We evaluated our framework and found that we were able to accurately reproduce the timing of the hypercall campaigns. When evaluating selected hypercalls, we were surprised that some hypercalls behaved counterintuitively. When the load increased they were processed faster than with lower load. Meanwhile, other hypercalls behaved as expected and took longer to complete with increasing load (similar to requests in cloud applications). A third category of hypercalls was not influenced at all by the load level. Our framework can be applied by the robustness testing, performance testing, performance isolation, and software aging communities. We plan to extend the framework to support further applications in these areas. We also plan to publish the framework as an official SPEC-endorsed tool. As mentioned earlier, we also did some additional work that is highly related to our main project. In the area of SDN and NFV in combination with IDSes and other security functions, we developed a vision of dynamic reordering for security functions inside a network as well as optimizations for existing security functions. We developed approaches for dynamically bypassing network IDSes. Results showed that performance close to a network without an IDS is achievable without losing security. The performance gain depending on the application scenario and workload was up to a factor of fourteen. We also introduced a DDoS Protection System against SYN Flood attacks that allows for better scalability. Last, we evaluated the performance impact of the ordering of security functions. For all our projects, we had major support from academic partners and industry partners.

Publications

 
 

Additional Information

© 2024 DFG Disclaimer / Copyright / Privacy Policy

Textvergrößerung und Kontrastanpassung