Cloud-based Testbed for Simulation of Cyber Attacks D. Kouil, T. - PowerPoint PPT Presentation

Cloud-based Testbed for Simulation of Cyber Attacks D. Kouřil, T. Rebok, T. Jirsík, J. Čegan, M. Drašar, M. Vizváry, J. Vykopal { lastname }@ics.muni.cz IEEE/IFIP Network Operations and Management Symposium, NOMS 2014 5-9 May 2014, Krakow, Poland

Part I Introduction Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 2 / 19

Motivation Current status Ubiquitous cyber attacks Need to be studied and understood What do we need? Real-world arrangements simulation Sufficient isolation and control User friendly environment (easy to instantiate and use) Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 3 / 19

Requirements statement Network-related requirements Host-related requirements Monitoring infrastructure Control requirements Deployment requirements Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 4 / 19

Part II Cybernetic Proving Ground Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 5 / 19

About Features Simulation of a large network, systems, services and applications. Monitoring of network behaviour, detection and mitigation of anomalies and attacks. Cloud environment for repeatable investigation of cyber threats. Cloud Enables computing of resource-intensive tasks. Remote secure access of users around the world. Enables providing CPG to third parties as a service. Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 6 / 19

General architecture Various Scenarios Sandbox 1 Scenario Management Node Sandbox 2 Scenario Management Entry Node Node Multiple Users Sandbox n Scenario Management Node Cloud environmnet Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 7 / 19

Sandbox architecture LAN 1 Scenario Management Scenario Con fi guration Data Processing Database Scenario Management LAN 2 node LAN n Network tra ffi c Management & Measurement channel Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 8 / 19

Networking ISO Layers L2 layer is provided by CPG L3 completely under user control Flexibility IPv4, IPv6 Non-IP protocols Emulation of various network characteristics (delays, bandwidth limits, dropped packets) Components Management Network Simulated Network Lan Management Node Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 9 / 19

L2 Architecture PC 1 PC 2 PC 3 VM 1 VM 2 VM 3 VM 4 Station 3 Station 1 Station 2 Switch 1 Hypervisor Hypervisor Hypervisor Hypervisor Physical Switch Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 10 / 19

L3 Architecture Open vSwitch netem/tc fi rewall WAN Mgmt probe DHCP Network tra ffi c Measured data Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 11 / 19

Monitoring infrastructure Network monitoring Host monitoring Network flow monitoring Nested virtualization Automatic configuration munin Probe SRC and DST IP addr SRC and DST port Protocol number IPFIX TCP fl ags Lifetime Sum of bytes Collector Data analysis Others Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 12 / 19

Benefits for users Easier investigation of cyber threats and attack Automated gathering and processing of data generated during security scenarios. Creating database of malicious code (malware, worms, botnets). Visualization of significant aspects of the scenarios. Traffic analysis and forensics Acquisition, storage and analysis of network traffic statistics. Analysis of malware – at infected host as well as in network. Validation of processes of incident handling and response. Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 13 / 19

Part III Use-cases Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 14 / 19

Security scenario What is it? General description of environment, components, actions, expected outcomes of particular experiment What does it consist of? Scenario description Technical description Variation description Network topology including node types List of events List of actions Characteristic manifestations Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 15 / 19

Simulation of DDoS Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 16 / 19

Work in progress Attacks to critical infrastructure: Domain Name System Testing tools Research and development Forensic analysis of infected files and applications Observation and monitoring of captured artifacts Scenario repeatability Penetration testing Testing of detection tools Training of penetration testers Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 17 / 19

Future work Training of security teams Commented analysis of scenarios Cyber war game in CPG CPG as a service Remote access to CPG to third parties New scenarios “on demand“ Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 18 / 19

Thank You For Your Attention! Cloud-based Testbed for Simulation of Cyber Attacks D. Kouřil T.Rebok T. Jirsík J.Čegan M. Drašar M. Vizváry J. Vykopal Home page http://www.muni.cz/ics/kypo Kouřil et al. Cloud-based Testbed for Simulation of Cyber Attacks 19 / 19