340 likes | 811 Vues
Distributed Intrusion Detection System using Mobile Agents in Cloud Computing Environment. 1. Agenda. Overview Introduction Challenges & Motivations Literature Survey Problem Statement Architecture & Workflow Standard & Technologies Roadmap References.
E N D
Distributed Intrusion Detection System using Mobile Agents in Cloud Computing Environment 1
Agenda • Overview • Introduction • Challenges & Motivations • Literature Survey • Problem Statement • Architecture & Workflow • Standard & Technologies • Roadmap • References
What is Intrusion Detection System Traffic is monitored Intruder System Admin who takes appropriate action software or hardware IDS Reported to SysAdmin Traffic is analyzed Intrusion is detected
Introduction • The open and distributed architecture of Cloud Computing paradigm is vulnerable to intruders who may threaten the security of Cloud Service Providers (CSPs) and Cloud Service Consumers (CSCs).
Where to deploy IDS in Cloud • In Cloud environment, IDS may be deployed at any of the three layers: • Infrastructure as a Service (IaaS) • Platform as a Service (PaaS) • Software as a Service (SaaS) The deployment of IDS at IaaS layer is the most flexible model.
Cloud?? “Comes from the early days of the Internet where we drew the network as a cloud… we didn’t care where the messages went… the cloud hid it from us” – Kevin Marks, Google
Challenges to Cloud based IDS Scalability False Positive Rate Mobility Single Point of Failure Network load Distributed and Large Scale Attacks
Distributed Intrusion Detection in Clouds using Mobile Agents Reference: A. V. Dastjerdi, K. A. Bakar, S. G. H. Tabatabaei, “Distributed Intrusion Detection in Clouds using Mobile Agents”, Third International Conference on Advanced Engineering Computing and Applications in Sciences, 2009, pp. 175-180. Problem: The increased number of security issues in public cloud Motivation: • Flexibility • Mobility • Scalability
Solution • Pros: • Can detect both known and unknown attacks • Cons: • Limited number of VMs to be visited Reference: A. V. Dastjerdi, K. A. Bakar, S. G. H. Tabatabaei, “Distributed Intrusion Detection in Clouds using Mobile Agents”, Third International Conference on Advanced Engineering Computing and Applications in Sciences, 2009, pp. 175-180.
Signature-based Multi-Layer Distributed Intrusion Detection System using Mobile Agents Reference: M. Uddin, A. A. Rehman, N. Uddin, et al., “Signature-based Multi-Layer Distributed Intrusion Detection System using Mobile Agents”, International Journal of Network Security, Vol. 15, No. 1, Jan. 2013, pp. 79-87. Problem: • Large size of network traffic • Creation of Signatures • Cooperation among Small Signature Database (SSD) and Complementary Signature Database (CSD)
Solution Pros: • Ability to handle large volume of network traffic • Fast processing due to match with a small set of signatures • Cons: • Training time for IDS Reference: M. Uddin, A. A. Rehman, N. Uddin, et al., “Signature-based Multi-Layer Distributed Intrusion Detection System using Mobile Agents”, International Journal of Network Security, Vol. 15, No. 1, Jan. 2013, pp. 79-87.
A Distributed Intrusion Detection System based on Mobile Agents Reference: M. Xiu-liang, W. Chun-dong, W. Huai-bin, “A Distributed Intrusion Detection System Based on Mobile Agents”, IEEE 2009. Problem: • Intrusions from inside and outside the network Motivation: • Protection of network from distributed intrusions
Solution Pros: • Distributed Intrusions • Can detect new attacks Cons: • Single Point of Failure Reference: M. Xiu-liang, W. Chun-dong, W. Huai-bin, “A Distributed Intrusion Detection System Based on Mobile Agents”, IEEE 2009.
Industrial Survey http://www.linux.org/threads/suricata-the-snort-replacer-part-1-intro-install.4346/
Community Response http://mail-archives.apache.org/mod_mbox/cloudstack-users/201311.mbox/browser
Problem Statement • The large-scale and distributed intrusions causing mainly due to the open and distributed architecture of Cloud threaten both Cloud Service Providers (CSPs) and Cloud Service Consumers (CSCs).
Proposed Solution • A Distributed Intrusion Detection System using Mobile Agents in Cloud Computing Environment • Correlation of intrusion alerts from multiple locations in order to identify distributed intrusions.
Proposed System Architecture and Workflow Signature Database Alert Correlation Management Station Management Server MA MA Alert Console MA
Related Standards and Technologies Mobile Agents
References [1]. C. C. Lo, C. C. Huang, J. Ku, “A Cooperative Intrusion Detection System Framework for Cloud Computing Networks”, 39th International Conference on Parallel Processing Workshops 2010, pp. 280-284. [2]. C. N. Modi, D. R. Patel, A. Patel, R. Muttukrishnan, “Bayesian Classifier and Snort based Network Intrusion Detection System in Cloud Computing”, Third International Conference on Computing, Communication and Networking Technologies, 26th-28th July 2012. [3]. C. Mazzariello, R. Bifulco and R. Canonico, “Integrating a Network IDS into an Open Source Cloud Computing Environment”, 2010 Sixth International Conference on Information Assurance and Security, pp. 265-270. [4]. A. Bakshi, Yogesh B, “Securing cloud from DDOS Attacks using Intrusion Detection System in Virtual Machine”, 2010 Second International Conference on Communication Software and Networks, pp. 260-264. [5]. Ms. P. K. Shelke, Ms. S. Sontakke, Dr. A. D. Gawande, “Intrusion Detection System for Cloud Computing”, International Journal of Scientific & Technology Research Volume 1, Issue 4, May 2012, pp. 67-71.
References [6]. A. Patel, Q. Qassim, Z. Shukor, J. Nogueira, J. Júnior and C. Wills, “Autonomic Agent-Based Self-Managed Intrusion Detection and Prevention System”, Proceedings of the South African Information Security Multi-Conference (SAISMC 2010), pp. 223-234. [7]. J. H. Lee, M. W. Park, J. H. Eom, T. M. Chung, “Multi-level Intrusion Detection System and Log Management in Cloud Computing”, ICACT, 2011, pp. 552-555. [8]. A. V. Dastjerdi, K. A. Bakar, S. G. H. Tabatabaei, “Distributed Intrusion Detection in Clouds using Mobile Agents”, Third International Conference on Advanced Engineering Computing and Applications in Sciences, 2009, pp. 175-180. [9]. K. Vieira, A. Schulter, Carlos B. Westphall, and C. M. Westphall, “Intrusion Detection for Grid and Cloud Computing”, IEEE Computer Society, (July/August 2010), pp. 38-43. [10]. S. N. Dhage, B. B. Meshram, R. Rawat, S. Padawe, M. Paingaokar, A. Misra , “Intrusion Detection System in Cloud Computing Environment”, International Conference and Workshop on Emerging Trends in Technology (ICWET 2011), pp. 235-239.
References [11]. S. Bharadwaja, W. Sun, M. Niamat, F. Shen, “Collabra: A Xen Hypervisor based Collaborative Intrusion Detection System”, Eighth International Conference on Information Technology: New Generations, 2011, pp. 695-700. [12]. M. Uddin, A. A. Rehman, N. Uddin, et al., “Signature-based Multi-Layer Distributed Intrusion Detection System using Mobile Agents”, International Journal of Network Security, Vol. 15, No. 1, Jan. 2013, pp. 79-87. [13]. M. Xiu-liang, W. Chun-dong, W. Huai-bin, “A Distributed Intrusion Detection System Based on Mobile Agents”, IEEE 2009. [14]. Suricata: The Snort Replacer (Part 1: Intro & Install), Jul 24, 2013, http://www.linux.org/threads/suricata-the-snort-replacer-part-1-intro-install.4346/ [15]. cloudstack-users mailing list archives: November 2013, http://mail-archives.apache.org/mod_mbox/cloudstack-users/201311.mbox/browser