1. Towards Self Adaptable Security Monitoring in IaaS clouds Anna Giannakou Advisors: Christine Morin, Jean-Louis Pazat, Louis Rilling

2. Presentation outline  Security monitoring in clouds  Self-adaptable Intrusion Detection System  Preliminary Results  Technical aspects 2

3. Security monitoring in clouds

4. Infrastructure as a Service clouds 4

5. 5

6. 6

7. 7

8. 8

9. 9

10. Network Intrusion Detection Systems 10 Passively inspect traffic (monitor & notify) Out of band placement Rule based configuration http://sanketrjain.com/intrusion-detection-and-prevention-system/

11. The need for adaptable security monitoring  IaaS cloud environments are very dynamic  Topology-related changes (VM creation, deletion, migration)  Traffic load fluctuation  Service addition/removal  Traditional security monitoring is ineffective  Reconfiguration of monitoring system should be automated  Several actors with different security requirements  Tenants express their requirements through SLA 11

12. Self-Adaptable Intrusion Detection System

13. Self-adaptable security monitoring engine-SAIDS (1) 13

14. Self-adaptable security monitoring engine-SAIDS (2) 14

15. Self-adaptable security monitoring engine-SAIDS (3) 15

16. Self-adaptable security monitoring engine-SAIDS (4) 16

17. Self-adaptable security monitoring engine-SAIDS (5) 17

18. Preliminary results

19. 19 4

20. Technical aspects

21. OpenStack deployment  Version 2014.2 -Juno  3 nodes (1 controller - 2 compute )  DevStack multi-node installation  https://git.openstack.org/openstack-dev/devstack  OpenvSwitch on every node – (for kernel 3.2 version 2.0.0 )  https://github.com/openvswitch/ovs/tarball/master  GRE tunnels for inter-VM communication

22. Deployment steps 1. Reserve nodes & vlan  (oarsub, …) 2. Deploy environment (Trusty 12.04)  Kadeploy3, … 3. Run custom deployment script  (Automatic update of local.conf &./stack.sh) 4. Reconfigure external connectivity due to openvSwitch setup 1. br-ex as the main interface on controller node 5. Repeat step 3 for compute nodes

23. Deployment issues  Overall deployment time ~ 25-30 min  Additional time for:  registering VMs with glance  Injecting OpenFlow rules  Further automation for not deploying OpenStack everytime :  Reconfigure.conf files for all services (nova, glance,…)  Restart services  Limitations: VM image size (environment file gets too big)