Alina Oprea Associate Professor, CCIS Northeastern University MOSAIC: A Platform for Monitoring and Security Analytics in Public Clouds Alina Oprea Associate Professor, CCIS Northeastern University IEEE SecDev, November 3rd, 2016

Trustworthy infrastructure Public clouds Public cloud Management Compute Storage Billing Authentication Compute mgmt Storage mgmt SDN VM Physical Hypervisor Users Networking Trustworthy infrastructure Sharing of resources

Top threats according to Cloud Security Alliance (CSA) What are the threats? Cloud provider Users Co-location with malicious tenants Side-channel attacks (cache, network, storage) Breach of confidential information VMs infected with malware Application exploit Denial of service Server breaches Malicious tenants Credential compromise Cloud abuse Top threats according to Cloud Security Alliance (CSA)

Analytics-based defenses Goals Correlate data sources from multiple cloud layers Analytics techniques to detect wide range of threats Protection of cloud infrastructure Enable cloud users to protect their resources Protect users privacy

Data collection Monitoring infrastructure Network traffic collection Performance metrics from physical layer (CPU, I/O, memory, disk, power) – Sensu VM utilization - Ceilometer Cloud management logs (Nova, Keystone, Horizon) Network traffic collection Currently staging area experiments Plan to deploy in Engage1 environment Configure Brocade fabric to collect sFlow

Account profiling for authentication Detect credential compromise Developers leak their AWS passwords in GitHub Build user profiles based on historical data Login information (IP address, time) VM usage (CPU, memory, disk) Anomaly detection Detect unusual activities

Network traffic analysis sFlow collector sFlow collector MongoDB Use cases Detect suspicious communication with external IP addresses Detect data exfiltration attempts Prevent cloud abuse Malware infection, application exploits , illegal use of cloud

Quantify workload privacy App App App App VM VM VM Hypervisor Performance metrics What can be inferred about workloads? Physical Networking NetFlow/sFlow Strict privacy requirements in public clouds Users should specify their preferences Metrics Quantify privacy experimentally Information theoretical metrics How to monitor user workloads while preserving user privacy? What data should be collected? What level of aggregation?

Analytics for cloud security Provide recommendations to other cloud providers Securing public clouds is shared responsibility between cloud provider and tenants Design data collection and analytics APIs to enable the cloud provider and tenants to use analytics for security Protect workload privacy respecting users’ preferences

Northeastern University Cybersecurity & Privacy Institute  Xinming Ou  Xinming Ou Northeastern University Cybersecurity & Privacy Institute Alina Oprea a.oprea@neu.edu