Towards Self Adaptable Security Monitoring in IaaS clouds Anna Giannakou Advisors: Christine Morin, Jean-Louis Pazat, Louis Rilling

Presentation outline  Security monitoring in clouds  Self-adaptable Intrusion Detection System  Preliminary Results  Technical aspects 2

Security monitoring in clouds

Infrastructure as a Service clouds 4

5

6

7

8

9

Network Intrusion Detection Systems 10 Passively inspect traffic (monitor & notify) Out of band placement Rule based configuration

The need for adaptable security monitoring  IaaS cloud environments are very dynamic  Topology-related changes (VM creation, deletion, migration)  Traffic load fluctuation  Service addition/removal  Traditional security monitoring is ineffective  Reconfiguration of monitoring system should be automated  Several actors with different security requirements  Tenants express their requirements through SLA 11

Self-Adaptable Intrusion Detection System

Self-adaptable security monitoring engine-SAIDS (1) 13

Self-adaptable security monitoring engine-SAIDS (2) 14

Self-adaptable security monitoring engine-SAIDS (3) 15

Self-adaptable security monitoring engine-SAIDS (4) 16

Self-adaptable security monitoring engine-SAIDS (5) 17

Preliminary results

19 4

Technical aspects

OpenStack deployment  Version Juno  3 nodes (1 controller - 2 compute )  DevStack multi-node installation   OpenvSwitch on every node – (for kernel 3.2 version )   GRE tunnels for inter-VM communication

Deployment steps 1. Reserve nodes & vlan  (oarsub, …) 2. Deploy environment (Trusty 12.04)  Kadeploy3, … 3. Run custom deployment script  (Automatic update of local.conf &./stack.sh) 4. Reconfigure external connectivity due to openvSwitch setup 1. br-ex as the main interface on controller node 5. Repeat step 3 for compute nodes

Deployment issues  Overall deployment time ~ min  Additional time for:  registering VMs with glance  Injecting OpenFlow rules  Further automation for not deploying OpenStack everytime :  Reconfigure.conf files for all services (nova, glance,…)  Restart services  Limitations: VM image size (environment file gets too big)