1. Research Progress Report
HSU, Chia-Yang
OPLab

2. Agenda
Problem Description
Mathematical Formulation
OPLab
2018/10/13

3. Problem Description
OPLab
2018/10/13

4. Problem Description Environment： Role：
A government or enterprise network with multiple servers to provide services.
Role：
Defender
Complete information of the topology.
There is a defense center for defender to control all the network.
Attacker
Only one hop information.
OPLab
2018/10/13

5. Defender Nodes：general nodes, core nodes.
We can set up many VMs on a VMM-IDPS, each VM can be a general or core node.
General and core nodes can be out of VMM-IDPS, too.
General node
Core node
VMM-IDPS is integrated in VMM.
OPLab
2018/10/13

6. Defender (Cont.) Different view of topology：
Logical links and logical nodes.
Different view of topology：
Physical link
Virtual link
Physical link (invisible)
Physical topology
Defender’s view
Logical topology
Logical link
Core node
General node
VMM-IDPS
OPLab
2018/10/13

7. Defender (Cont.) Planning phase： Set up VMM-IDPS.
How many VMM-IDPS and decide their positions.
How many VMs each VMM-IDPS supports,
What is each VMM-IDPS’s level.
Decide positions of core nodes.
Link settings.
Connect physical links.
Set virtual links of each VM and decide their link capacity.
Decide link capacity of physical links.
Set up cloud security agent to logical nodes.
Add general defense to logical nodes.
Firewall, antivirus…
OPLab
2018/10/13

8. Defender (Cont.) Defending phase： Generate signature.
Triggered when VMs got attacked.
Need time for generation and distribution.
All VMMs and VMs will be immune to the attack method when signature is updated.
False positive or wrong signatures will make all virtual link capacity decrease certain ratio!!
Local VMM-IDPS protection.
Increase defense effect of VMs on the same VMM, including VMM.
Decrease certain ratio of virtual link capacity.
OPLab
2018/10/13

9. Defender (Cont.) Defending phase： Cloud security service.
Triggered when any logical node got attacked.
Only logical nodes equipped with cloud security agent can request cloud security service.
Cloud security agent will forward suspicious traffic to SaaS cloud security provider, with clean traffic coming back.
Different level of security inspecting charges differently.
False positive will result in decreasing certain ratio of link capacity.
OPLab
2018/10/13

10. Defender (Cont.) Defending phase： Dynamic topology reconfiguration：
Triggered when any logical node got attacked.
With core node loading, link capacity, user satisfaction constraints.
Remove or reconnect some links to make core nodes more secure.
OPLab
2018/10/13

11. Defender (Cont.)
OPLab
2018/10/13

12. Defender (Cont.)
OPLab
2018/10/13

13. Defender (Cont.)
OPLab
2018/10/13

14. Attacker Capability：general distribution. Risk Tolerance： Proficiency：
Description on each attacker.
Associated with training cost and the probability of seeing through VM environment.
May affect the false negative rate of VMM-IDPS.
Risk Tolerance：
A description on each attacker.
Together with left budget will affect：
Target selection strategy, i.e. attack VMM?
Change method and next hop criteria?
Preferred success probability of compromising a node.
Proficiency：
Each attacking method has its own proficiency.
Will affect effectiveness of attack costs.
OPLab
2018/10/13

15. Attacker (Cont.) Strategies：
More budget used in preparing phase or attacking phase?
Holding how many tools is better?
What proficiency level of training each tool?
Next hop selection criteria before and after attack.
Next hop target candidates, all neighbors or deeper is better?
Attack VMM or not when discovering a VMM?
Switch to another method? Repeat attack on the same node?
Risk tolerance after discovering existence of VMM-IDPS.
What value should the preferred successfully attack probability be set. Change the value during attack or keep the same?
Associated with budget left and attacker’s risk tolerance.
OPLab
2018/10/13

16. Contest success function (Cont.)
Attacker decides a value of T to make greater than a certain value.
According to risk tolerance an budget left.
transforms attack cost T to attack effectiveness.
Depending on proficiency of each method
the tool quality.
is the defense effectiveness of defense resource t.
OPLab
2018/10/13

17. Scenario Defender’s View Core node General node VMM-IDPS
VM defense center
Defender’s View
Attackers
Core node
General node
VMM-IDPS
OPLab
2018/10/13

18. Scenario (Cont.) Physical Links Core node General node VMM-IDPS
VM defense center
Physical Links
Attackers
Core node
General node
VMM-IDPS
OPLab
2018/10/13

19. Scenario (Cont.) Logical Topology Core node General node VMM-IDPS
VM defense center
Logical Topology
Attackers
Core node
General node
VMM-IDPS
OPLab
2018/10/13

20. Scenario (Cont.) Core node General node
VM defense center
Attackers
Core node
General node
VMM-IDPS
Attackers can see only one hop away.
OPLab
2018/10/13

21. Scenario (Cont.) Intrusion detected! Generate signature. Core node
VM defense center
Intrusion detected!
Generate signature.
Attackers
Core node
General node
VMM-IDPS
Select a target to attack.
OPLab
2018/10/13

22. Scenario (Cont.) Local defense on.
It can make other VMs and the VMM itself more secure.
VM defense center
Attackers
Core node
General node
VMM-IDPS
OPLab
2018/10/13

23. Scenario (Cont.) Reset links to make core nodes more secure. Core node
VM defense center
Attackers
Core node
General node
VMM-IDPS
Compromise the target successfully.
OPLab
2018/10/13

24. Scenario (Cont.) Signature generation needs a long time. Core node
VM defense center
Signature generation needs a long time.
Attackers
Core node
General node
VMM-IDPS
No new links found.
OPLab
2018/10/13

25. Scenario (Cont.) Same attack method. No need for another signature.
VM defense center
Attackers
Core node
General node
VMM-IDPS
Select another target.
Attacker needs more effort to attack due to local defense.
OPLab
2018/10/13

26. Scenario (Cont.) Reset links to make core nodes more secure. Core node
VM defense center
Reset links to make core nodes more secure.
Attackers
Core node
General node
VMM-IDPS
Compromise the target successfully.
Found the existence of VMM.
OPLab
2018/10/13

27. Scenario (Cont.) Core node
VM defense center
Attackers
Core node
General node
VMM-IDPS
Decide to attack VMM. Need more effort than normal nodes. Also local defense should be considered.
OPLab
2018/10/13

28. Scenario (Cont.) Reset links to make core nodes more secure. Core node
VM defense center
Reset links to make core nodes more secure.
Attackers
Core node
General node
VMM-IDPS
Compromise VMM and find it’s a IDPS.
See all virtual and physical links.
OPLab
2018/10/13

29. Scenario (Cont.) Signature updated!! Core node
VM defense center
Signature updated!!
Attackers
Core node
General node
VMM-IDPS
Decide to use the same attack method to attack another node.
OPLab
2018/10/13

30. VMs are now immune to the attack method, so it’s safe to relink.
Scenario (Cont.)
VM defense center
Attackers
Core node
General node
VMM-IDPS
Compromise the target.
OPLab
2018/10/13

31. Scenario (Cont.) Core node General node Keep on attacking. VMM-IDPS
VM defense center
Attackers
Core node
General node
VMM-IDPS
Keep on attacking.
OPLab
2018/10/13

32. Scenario (Cont.) Core node General node VMM-IDPS VM defense center
Attackers
Core node
General node
VMM-IDPS
OPLab
2018/10/13

33. Mathematical Formulation
OPLab
2018/10/13

34. Assumptions Defender has complete information about the network.
topology, defense resource allocation, node attribute.
There is a defense center for defender to control all the network.
Set nodes, links, decide defense strategies.
Attackers have incomplete information about the network.
Only one hop information.
OPLab
2018/10/13

35. Given parameters Notation Description N
The index set of all physical nodes O
The index set of all physical nodes equipped with VMM-IDPS V
The index set of all virtual machine nodes G
The index set of all logical nodes C
The index set of all logical nodes equipped with cloud security agent Xi
The virtual link index set of virtual machine node i, where i∈V K
The physical link index set M
The index set of all VMM-IDPS levels
NTU
2018/10/13

36. Given parameters Notation Description E
All possible defense configuration, including defense resources allocation and defending strategies B
The defender’s total budget S
The index set of all kinds of services Z
All possible attacker’s categories, including attacker’s attributes, corresponding strategies and transition rules
An attack configuration, comprising attacker’s detailed information, possible strategies and transition rules, where i∈S, 1≤ j ≤ Fi
The total attacking times on ith service for all attackers, where i∈S
1 if the attacker can achieve his goal successfully, and 0 otherwise, where i∈S, 1≤ j ≤
NTU
2018/10/13

37. Given parameters Notation Description h(mi)
The numbers of VMs supported by mith VMM-IDPS level, where i∈N and mi∈M
v(mi , li )
The cost of virtualization on node i with VMM-IDPS of level mi and li virtual machines(run time cost), where i∈N and 0 ≤ li ≤ h(mi)
g(qi)
The cost of constructing physical link i with capacity qi, where i∈K e
The cost of setting a cloud security agent to one node
NTU
2018/10/13

38. Decision variables Notation Description
The configuration regarding resources allocating and defending, where i∈S ui
1 if node i is virtualized and equipped with VMM-IDPS, 0 otherwise, where i∈N mi
The level of VMM-IDPS equipped on node i, where i∈N and mi∈M li
The number of virtual machines implemented on virtualized node i, where i∈N
NTU
2018/10/13

39. Decision variables Notation Description pijk
1 if the jth virtual link of virtual machine node i passes physical link k, 0 otherwise, where i∈V, j∈Xi, k∈K qi
The capacity of physical link i, where i∈K
rij
The capacity of the jth virtual link of virtual machine node i, where i∈V, j∈Xi ci
1 if logical node i is equipped with cloud security agent, 0 otherwise, where i∈G ni
The general defense resources allocated on node i, where i∈G
NTU
2018/10/13

40. Objective function
(IP 1)
NTU
2018/10/13

41. Constraints Supported virtual machine numbers constraint
Virtual link capacity constraint
(IP 1.1)
(IP 1.2)
(IP 1.3)
(IP 1.4)
NTU
2018/10/13

42. Constraints Defender’s budget constraints (IP 1.5) OPLab@IM, NTU
2018/10/13

43. Constraints Defender’s budget constraints (IP 1.6) (IP 1.7) (IP 1.8)
NTU
2018/10/13

44. Constraints QoS constraint Budget constraint QoS is a function of ：
Link utilization, core node loading, hops to core node.
Served users ratio.
At the end of attack, the following constraint must be satisfied.
The defender has to guarantee at least one core node is not compromised at any time.
Budget constraint
Budget should be considered when all defense strategies used.
(IP 1.10)
(IP 1.11)
(IP 1.12)
NTU
2018/10/13

45. Constraints Dynamic topology reconfiguration constraint
Topology reconfiguration will result in traffic shift, link capacity and core node loading and hops to core node must be considered.
Local defense constraint
Only nodes with VMM-IDPS have local defense function.
The capacity of all the VMs’ virtual links on the VMM-IDPS will decrease certain ratio.
Signature request constraint
Only nodes with VMM-IDPS have signature request function.
False positive and wrong signatures will result in all virtual link capacity decrease certain ratio.
Cloud security constraint
Only nodes with cloud security agent have cloud security function.
Traffic forwarding to cloud security provider for inspecting will decrease link capacity when false positive occurs (links connect to the node).
(IP 1.13)
(IP 1.14)
(IP 1.15)
(IP 1.16)
(IP 1.17)
(IP 1.18)
(IP 1.19)
NTU
2018/10/13

46. Constraints
(IP 1.20)
(IP 1.21)
(IP 1.22)
NTU
2018/10/13

47. Thanks for your listening!
Q & A
OPLab
2018/10/13

48. References
[1] SANS Institute InfoSec Reading Room, "Intrusion Detection Systems: Definition, Need and Challenges," 2001.
[2] John K. Waters, "Virtualization Definition and Solutions," 2008, at  Solutions.
[3] T. Garfinkel and M. Rosenblum, "A Virtual Machine Introspection Based Architecture for Intrusion Detection," in NDSS, ed, 2003.
[4] Y. Bai and H. Kobayashi, "Intrusion Detection Systems: technology and development," in Advanced Information Networking and Applications, AINA th International Conference on, 2003, pp
[5] html
OPLab
2018/10/13

49. References (Cont.)
[6] Skaperdas, S., Contest success functions. Economic Theory 7, 283–290.
[7] G. Levitin, and K. Hausken, “False targets efficiency in defense strategy,” European Journal of Operational Research, Vol. 194, Issue 1, Pages , 1 April 2009.
[8] M. Laureano, et al., "Intrusion Detection in Virtual Machine Environments," presented at the Proceedings of the 30th EUROMICRO Conference, 2004.
[9] T. Garfinkel and M. Rosenblum, "When virtual is harder than real: security challenges in virtual machine based computing environments," presented at the Proceedings of the 10th conference on Hot Topics in Operating Systems - Volume 10, Santa Fe, NM, 2005.
[10] T. Garfinkel, et al., "Terra: a virtual machine-based platform for trusted computing," presented at the Proceedings of the nineteenth ACM symposium on Operating systems principles, Bolton Landing, NY, USA,
OPLab
2018/10/13

50. References (Cont.)
[11] Scarfone, Karen; Mell, Peter (February 2007). "Guide to Intrusion Detection and Prevention Systems (IDPS)". Computer Security Resource Center (National Institute of Standards and Technology) (800-94).
[12] Robert C. Newman (19 February 2009). Computer Security: Protecting Digital Resources. Jones & Bartlett Learning. pp. 273.
[13] Michael E. Whitman; Herbert J. Mattord (2009). Principles of Information Security. Cengage Learning EMEA. pp. 289.
OPLab
2018/10/13

51. References (Cont.)
[14] M. Locasto, et al., "FLIPS: Hybrid Adaptive Intrusion Prevention," in Recent Advances in Intrusion Detection. vol. 3858, A. Valdes and D. Zamboni, Eds., ed: Springer Berlin / Heidelberg, 2006, pp
OPLab
2018/10/13