Comparison to existing state of security experimentation Cyber Defense Technology Experimental Research Network (DETER) http://www.isi.edu/deter The DETER testbed provides general-purpose, remotely accessible and partitionable experimental infrastructure to support the development and demonstration of next-generation information security technologies. It is designed to support repeatable experiments in computer security, especially those experiments that involve malicious code. DETER Testbed Architecture Built using Utah’s EMULAB, the DETER testbed has been configured and extended to provide stronger assurances for isolation and containment.. The DETER testbed supports a community of academic, government, and industrial researchers who collaborate and build upon one anothers prior work to run reproducible experiments on system and network attack response and countermeasures. Nodes count: 139 at USC and 62 at Berkeley (9/7/2005) Comparison to existing state of security experimentation Previous approaches Dedicated resources for each researcher. Lack of scientific rigor, poor controls. Difficult to reproduce conditions using open networks. Hard to compare results from different experiments. Danger to the internet from uncontained experiments. DETER approach Shared resources available to community of researchers. Isolation from public internet and from other experiments provides stronger controls. Provides better reproducibility of experiments. Serves as a repository for experiment inputs, traces, topology, software configuration, and network environment. Securely isolated environment for dangerous code. DETER Goals Resources: provide broad library of background & attack traffic traces, traffic & topology generators, experimental profiles, & instrumentation facilities. Reproducibility: repeatable conditions for experiment. Programmability: able to try new algorithms. Scalability: growth in nodes & interconnection of sites. Isolation: To prevent interference to experiments by other experiments or events external to testbed. Containment: To prevent exfiltration from testbed. Confidentiality & Integrity: To protect traces and other inputs, & to protect experimental results. The DETER Testbed This work was supported by funding from the National Science Foundation and the Department of Homeland Security under contract numbers ANI-0335298 (DETER) and CNS-0454381 (DECCOR). Opinions, findings, conclusions and recommendations expressed in this paper are those of the authors and do not necessarily reflect the views of the National Science Foundation (NSF).