MTD-Based Self-Adaptive Resilience in Cloud Systems
AN MTD-BASED SELF-ADAPTIVE
RESILIENCE APPROACH FOR CLOUD
SYSTEMS
Miguel Villarreal-Vasquez
1
, Bharat Bhargava
1
, Pelin Angin
2
,
Noor Ahmed
3
, Daniel Goodwin
4
, Jason Kobes
4
, Kory Brin
4
1
Department of Computer Science, Purdue University
2
Department of Computer Engineering, Middle East Technical University
3
Air Force Research Laboratory
4
Northrop Grumman Corporation
Acknowledgments
: This work was funded by the Northrop Grumman Cybersecurity Research Consortium. The
prototype was implemented in collaboration with Northrop Grumman and internally presented to them in April 2017.
The authors would also like to thank Dr. Leszek Lilien and Dr. Weichao Wang for their valuable comments.
Attack Surface
1
MOTIVATION
Attack Surface
2
•
Replication approaches in cloud
computing increase the attack surface
•
We need resilient/self-healing systems
that can accurately detect anomalies and
dynamically adapt themselves to keep
performing mission-critical functions
even under attacks and failures.
MOTIVATION
3
RESEARCH QUESTION
•
Is it possible to construct a generic attack-resilient
framework for distributed cloud systems with a
combination of dynamic network configuration and
continuous replacement of virtual machines?
MOVING TARGET DEFENSE (MTD)
4
- Data
- Code
- Infrastructure
- Communications
- People
- Moving Target Defense
(MTD)
- Proactive Restore/C2
- Least Privilege
Enforcement
- Trust Zone Segmentation
- Identity Attribution
- Encryption
- Root Trust
A
t
t
a
c
k
V
e
c
t
o
r
s
R
e
s
i
l
i
e
n
t
A
p
p
r
o
a
c
h
e
s
MOVING TARGET DEFENSE (MTD)
5
•
T
h
e
p
r
o
p
o
s
e
d
M
o
v
i
n
g
T
a
r
g
e
t
D
e
f
e
n
s
e
(
M
T
D
)
s
o
l
u
t
i
o
n
i
n
t
r
o
d
u
c
e
s
r
e
s
i
l
i
e
n
c
y
a
n
d
a
d
a
p
t
a
b
i
l
i
t
y
t
o
t
h
e
s
y
s
t
e
m
t
h
r
o
u
g
h
l
i
v
e
m
o
n
i
t
o
r
i
n
g
,
w
h
i
c
h
t
r
a
n
s
f
o
r
m
s
s
y
s
t
e
m
s
t
o
b
e
a
b
l
e
t
o
a
d
a
p
t
a
n
d
s
e
l
f
-
h
e
a
l
w
h
e
n
o
n
g
o
i
n
g
a
t
t
a
c
k
s
a
r
e
d
e
t
e
c
t
e
d
•
Adversaries have an asymmetric advantage
:
They have the time to study a system, identify its
vulnerabilities, and choose the time and place of attack
to gain the maximum benefit
•
The idea of moving-target defense (MTD):
Imposing the same asymmetric disadvantage on
attackers by making systems dynamic and therefore
harder to explore and predict
MOVING TARGET DEFENSE (MTD)
T
h
r
e
a
t
A
v
o
i
d
a
n
c
e
T
e
c
h
n
i
q
u
e
s
!
6
Fault-Tolerance Systems
- Solution
: Replication/
Redundancy:
-
Examples
: Quorum, Chain
-
Limitation
: Gives fault
resiliency but increases
attack surface at application
level (common code base)
Fault-Tolerance Systems
-
Solution
: MTD
-
Examples
: ASLR [9],
NVersion [10] & IP-
Hopping [11]
- Limitation
: Do not protect
the entire host
DIVERSIFICATION/RANDOMIZATION
STATE OF THE ART AND LIMITATIONS
7
REPLICATION/REDUNDANCY
•
The traditional defensive security strategy for
distributed systems is to prevent attackers from gaining
control of the system using well established techniques:
Replication/Redundancy, Encryption, etc.
Limitation
:
Given sufficient time and resources,
existing defensive methods can be defeated
8
STATE OF THE ART AND LIMITATIONS
•
The state of the art of MTD solutions focus on
randomization and diversification in particular layers of
the system
Limitation
:
Do not protect the entire host
9
STATE OF THE ART AND LIMITATIONS
•
“Stay one-step ahead” of sophisticated attack
•
Protect the entire stack through dynamic interval-based spatial
randomization
•
Avoid threats in-time intervals rather than defending the
entire runtime of systems through Mobility and Direction
•
System will start secure, stay secure and return secure
•
Increase agility, anti-fragility and adaptability of the system
•
Unified generic MTD framework that enables reasoning about
behavior of deployed systems on cloud platforms
10
PROPOSED APPROACH
•
Aims to
reduce
the need to continuously
fight
against attacks
by decreasing the gain-loss balance
perception of attackers.
•
Narrows the exposure window of a node to
attacks
, which increases the cost of attacks on a
system and lowers the likelihood of success and the
perceived benefit of compromising it.
11
OBJECTIVES OF THE MTD SOLUTION
12
OBJECTIVES OF THE MTD SOLUTION
•
The
reduction in the vulnerability window
of
nodes is mainly achieved
through
three steps
:
•
Partitioning the runtime execution of nodes in time
intervals
•
Allowing nodes to run only with a predefined lifespan (as
low as a minute) on heterogeneous platforms (i.e. different
OSs)
•
Proactively monitoring their runtime below the OS
13
Time Intervals (< 1 sec)
1
2
3
n
Application
OS
Network
Application
OS
Network
Application
OS
Network
Replica 1 Replica 2 Replica 3
Randomization Space
•
S
t
a
t
e
o
f
t
h
e
A
r
t
S
y
s
t
e
m
V
i
e
w
:
Sate Verification
BENEFITS OF THE PROPOSED SOLUTION
At a given time only
some
layers of the
stack (Application,
OS or Network) are
checked/ protected
14
Application
OS
Network
Application
OS
Network
Application
OS
Network
Replica 1 Replica 2 Replica 3
Randomization Space
•
P
r
o
p
o
s
e
d
S
o
l
u
t
i
o
n
S
y
s
t
e
m
V
i
e
w
:
Sate Verification
Time Intervals (< 1 sec)
1
2
3
n
BENEFITS OF THE PROPOSED SOLUTION
At a given time
all
layers of the stack
(Application, OS or
Network) are
checked/protected.
15
APPROACH OVERVIEW
16
MTD ARCHITECUTRE
C
o
m
p
o
n
e
n
t
s
:
(1) Virtual Reincarnation (ViRA) (3) SDN Network Dynamics
(2) Proactive Monitoring (4) Systems States and Application Runtime
17
MTD ARCHITECUTRE
•
The MTD framework consists of the following four
components:
•
Virtual Machine Reincarnation (ViRA)
•
Proactive Monitoring
•
SDN Network Dynamics
•
Systems States and Application Runtime
•
The framework will protect the whole stack; not
only particular layers
•
Nodes run a distributed application on a given platform for a
controlled period of time
•
The running time is chosen in a way that successful ongoing
attacks become ineffective
•
The new fresh machine will integrate to the system and continue
running the application after its data is updated
SDN Network
18
APPROACH DETAILS
SDN Network
19
•
Nodes run a distributed application on a given platform for a
controlled period of time
•
The running time is chosen in a way that successful ongoing
attacks become ineffective
•
The new fresh machine will integrate to the system and continue
running the application after its data is updated
APPROACH DETAILS
•
Randomization and diversification technique where nodes
(virtual machines) running a distributed application vanish
and reappear on a different virtual state with different
guest OS, Host OS, hypervisor, and hardware .
Improve
Resiliency
Improve
Anti-Fragility
Virtualized
Environment
20
VIRTUAL REINCARNATION
How do we create replicas?
•
Primary VM runs as no failures are detected.
•
Alternate VM takes place when a failure occurs
•
Acceptance tests are adjusted independently to guarantee
system operation
•
Alternate learn from Primary and become more robust to
failures/attacks experimented by primary
21
CREATION OF REPLICAS
PRIMARY
ALTERNATE
Acceptance Test
Acceptance Test
OK
OK
FAIL
FAIL
Challenges:
•
Reduce downtime when Primary is replaced by Alternate and
vice versa
•
Keep the state of the machine (either Primary or Alternate)
after the replacement to achieve uninterrupted operation
•
Keeping the state (stateful reincarnation) allows the system to
be application-agnostic
22
CREATION OF REPLICAS
PRIMARY
ALTERNATE
Acceptance Test
Acceptance Test
OK
OK
FAIL
FAIL
Stateful Reincarnation Ideas:
23
CREATION OF REPLICAS
D
T
D’
T’
D’’
T’’’
Quorum
D*: Synchronized Data
T*: Different version of Text
VM4 replaces VM1
T’’
VM1
VM2
VM3
VM4
D’’’
Stateful Reincarnation Ideas:
24
CREATION OF REPLICAS
•
Create different versions of binaries
•
The original code is kept and set with
read-only permission so that it can be
used as part of the reference to the
new locations of the blocks in the re-
randomized version.
•
We avoid identifying and updating code
position pointers in each
randomization process by keeping a
table of trampolines as shown in (b).
Each block is located at a fixed offset
(i.e.,
off_c
) with respect to the
trampoline table.
•
The pointers (in the original code
space) are dynamically redirected to its
respective address in the code variant
when it is de-referenced
(a) (b)
Z. Wang, C. Wu, J. Li, Y. Lai, X. Zhang, W. Hsu and Y. Cheng. ReRANZ: A Ligh-
Weight Virtual Machine to Mitigate Memory Disclosure Attacks. To appear
in VEE2017.
“Active machines are replaced by new ones with a totally new image”
25
https://www.dropbox.com/s/fqjh75su0p908ic/NGCRC-2017-Bhargava-DEMO2.mp4?dl=0
VIRTUAL REINCARNATION
•
Operates at the hypervisor level
•
Helps for performing node reincarnation effectively rather
than blindly
•
Based on Virtual Machine Introspection
(VMI)
•
Proactively gathers live memory data (at host OS) in intervals
and reacts if anomalous behavior is detected
•
Use libvmi library for introspection with negligible
performance overhead
•
When application is hijacked, address offsets show new entries for
injected code
•
When application is terminated and a new malicious one created, it
could end up with a different process ID or memory address offset
26
PROACTIVE MONITORING
•
Network devices are reconfigured via OpenFlow on-the-fly
•
New added flows redirect traffic intended for the old machine
to the new machine
SDN Network
27
SDN NETWORK DYNAMICS
•
Network devices are reconfigured via OpenFlow on-the-fly
•
New added flows redirect traffic intended for the old machine
to the new machine
SDN Network
28
SDN NETWORK DYNAMICS
29
SDN NETWORK DYNAMICS
•
New machines can be integrated to the system with their own
IP addresses
•
No waiting for the IP address of the old machine
•
Downtime is reduced
•
A Byzantine fault tolerant (BFT-SMaRt)
distributed application was run on a set
of Ubuntu (either 12.04 or 14.04
randomly selected).
•
VMs run in a private cloud, and are
connected with an SDN network using
Open vSwitch
•
The reincarnation is stateless, i.e. the
new node (e.g. VM1’) does not inherit
the state of the replaced node (e.g.
VM1).
•
The set of new VMs are periodically
refreshed to start clean and the network
is reconfigured using OpenFlow when a
VM is reincarnated to provide continued
access to the application.
30
MEASUREMENTS
1.
VM restart time
: Time it takes the machine to respond to be full
operational since it is started.
2.
Virtual creation time
: Time to create the new image of the VM.
3.
Open vSwitch flow injection time
: Time it takes to inject new
flows to Open vSwitch
31
MEASUREMENTS
Note
: that the important factor for system downtime here is the Open
vSwitch flow injection time, as VM creation and restart take place before
the reincarnation process
•
Aim to estimate the time it takes the new machine to be full
operational.
•
VM creation and restart take place before the reincarnation
process
•
The important factor for system downtime here is the Open
vSwitch flow injection time
32
MEASUREMENTS
•
Enhanced live monitoring techniques
•
Instrumentation to measure overhead more
accurately
•
Test other stateless applications on the MTD
framework
•
E.g.: Upright (Public and Subscribe System)
33
FUTURE WORK
•
Stateful Virtual Reincarnation Support:
Can we preserve the state of the virtual machine during the
reincarnation process to make the solution application-
agnostic?
Test the framework with Secure SOA Services (stateful
reincarnation)
34
FUTURE WORK
35
PRESENTATION AND PUBLICATIONS
1.
NGC Cyber Resilient Systems IRAD (
http://www.northropgrumman.com
)
2.
Enterprise Resiliency IRAD (
http://www.northropgrumman.com
)
3.
A
h
m
e
d
,
N
.
,
a
n
d
B
h
a
r
g
a
v
a
,
B
.
T
o
w
a
r
d
s
T
a
r
g
e
t
e
d
I
n
t
r
u
s
i
o
n
D
e
t
e
c
t
i
o
n
D
e
p
l
o
y
m
e
n
t
s
i
n
C
l
o
u
d
C
o
m
p
u
t
i
n
g
.
I
n
t
h
e
I
n
t
.
J
o
u
r
n
a
l
o
f
N
e
x
t
-
G
e
n
e
r
a
t
i
o
n
C
o
m
p
u
t
i
n
g
V
o
l
.
6
,
N
o
2
,
I
J
N
G
C
-
J
U
L
Y
2
0
1
5
.
4.
N. Ahmed. Design, Implementation, and Experiments for Moving Target Defense. PhD Thesis, Purdue University, 2016.
5.
N. Ahmed and B. Bhargava. From Byzantine Fault-Tolerance to Fault-Avoidance: An Architectural Transformation to Attack
and Failure Resilience. To Appear in IEEE Transactions on Cloud Computing, TCC 2016.
6.
N. Ahmed and B. Bhargava. Disruption-Resilient Publish/Subscribe: A Moving Target Defense Approach. The 6th
International Conference on Cloud Computing and Services Science, CLOSER 2016.
7.
N. Ahmed and B. Bhargava. Mayflies: A Moving Target Defense Framework for Distributed Systems. 3rd ACM workshop on
MTD in conjunction with ACM Conference on Computer and Communications Security (CCS), Vienna, 2016.
8.
R
.
R
a
n
c
h
a
l
,
D
.
U
l
y
b
y
s
h
e
v
,
P
.
A
n
g
i
n
,
a
n
d
B
.
B
h
a
r
g
a
v
a
.
P
o
l
i
c
y
-
b
a
s
e
d
D
i
s
t
r
i
b
u
t
e
d
D
a
t
a
D
i
s
s
e
m
i
n
a
t
i
o
n
.
C
E
R
I
A
S
S
e
c
u
r
i
t
y
S
y
m
p
o
s
i
u
m
,
A
p
r
i
l
2
0
1
5
(
B
e
s
t
p
o
s
t
e
r
a
w
a
r
d
)
9.
V. Pappas, M. Polychronakis and A. Keromytis. Smashing the gadgets: Hindering return-oriented programming using in-place
code randomization.” In IEEE Security and Privacy (SP), 2012.
10.
L. Chen and A. Avizienis. N-version programming: A fault-tolerance approach to reliability of software operation. Digest of
Papers FTCS-8: Eighth Annual International Conference on Fault Tolerant Computing. 1978.
11.
M. Carvalho and R. Ford. Moving-target defenses for computer networks. IEEE Security & Privacy 12.2 (2014).
Cloud systems face increasing attack surfaces, requiring resilient and self-healing mechanisms. This study explores a Moving Target Defense (MTD) approach for cloud systems, aiming to construct an attack-resilient framework through dynamic network configuration and continuous replacement of virtual machines. MTD introduces adaptability and resiliency by live monitoring to enable systems to self-heal in response to ongoing attacks, countering adversaries' asymmetric advantage. The proposed solution enhances system security by making it dynamic and harder for attackers to explore and predict.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
AN MTD-BASED SELF-ADAPTIVE RESILIENCE APPROACH FOR CLOUD SYSTEMS Miguel Villarreal-Vasquez1, Bharat Bhargava1, Pelin Angin2, Noor Ahmed3, Daniel Goodwin4, Jason Kobes4, Kory Brin4 1 Department of Computer Science, Purdue University 2 Department of Computer Engineering, Middle East Technical University 3 Air Force Research Laboratory 4 Northrop Grumman Corporation Acknowledgments: This work was funded by the Northrop Grumman Cybersecurity Research Consortium. The prototype was implemented in collaboration with Northrop Grumman and internally presented to them in April 2017. The authors would also like to thank Dr. Leszek Lilien and Dr. Weichao Wang for their valuable comments.
MOTIVATION Attack Surface 1
MOTIVATION Attack Surface Replication computing increase the attack surface We need resilient/self-healing systems that can accurately detect anomalies and dynamically adapt themselves to keep performing mission-critical even under attacks and failures. approaches in cloud functions 2
RESEARCH QUESTION Is it possible to construct a generic attack-resilient framework for distributed cloud systems with a combination of dynamic network configuration and continuous replacement of virtual machines? 3
MOVING TARGET DEFENSE (MTD) Attack Vectors Resilient Approaches - Moving Target Defense (MTD) - Proactive Restore/C2 - Least Privilege Enforcement - Trust Zone Segmentation - Identity Attribution - Encryption - Root Trust - Data - Code - Infrastructure - Communications - People 4
MOVING TARGET DEFENSE (MTD) The proposed Moving Target Defense (MTD) solution introduces resiliency and adaptability to the system through live monitoring, which transforms systems to be able to adapt and self- heal when ongoing attacks are detected 5
MOVING TARGET DEFENSE (MTD) Adversaries have an asymmetric advantage: They have the time to study a system, identify its vulnerabilities, and choose the time and place of attack to gain the maximum benefit The idea of moving-target defense (MTD): Imposing the same asymmetric disadvantage on attackers by making systems dynamic and therefore harder to explore and predict Threat Avoidance Techniques! 6
STATE OF THE ART AND LIMITATIONS DIVERSIFICATION/RANDOMIZATION REPLICATION/REDUNDANCY Fault-Tolerance Systems - Solution: MTD - Examples: ASLR [9], NVersion [10] & IP- Hopping [11] - Limitation: Do not protect the entire host Fault-Tolerance Systems - Solution: Replication/ Redundancy: - Examples: Quorum, Chain - Limitation: Gives fault resiliency but increases attack surface at application level (common code base) 7
STATE OF THE ART AND LIMITATIONS The traditional defensive security strategy for distributed systems is to prevent attackers from gaining control of the system using well established techniques: Replication/Redundancy, Encryption, etc. Limitation:Given sufficient time and resources, existing defensive methods can be defeated 8
STATE OF THE ART AND LIMITATIONS The state of the art of MTD solutions focus on randomization and diversification in particular layers of the system Limitation:Do not protect the entire host 9
PROPOSED APPROACH Stay one-step ahead of sophisticated attack Protect the entire stack through dynamic interval-based spatial randomization Avoid threats in-time intervals rather than defending the entire runtime of systems through Mobility and Direction System will start secure, stay secure and return secure Increase agility, anti-fragility and adaptability of the system Unified generic MTD framework that enables reasoning about behavior of deployed systems on cloud platforms 10
OBJECTIVES OF THE MTD SOLUTION Aims to reduce the need to continuously fight against attacks by decreasing the gain-loss balance perception of attackers. Narrows the exposure window of a node to attacks, which increases the cost of attacks on a system and lowers the likelihood of success and the perceived benefit of compromising it. 11
OBJECTIVES OF THE MTD SOLUTION The reduction in the vulnerability window of nodes is mainly achieved throughthree steps: Partitioning the runtime execution of nodes in time intervals Allowing nodes to run only with a predefined lifespan (as low as a minute) on heterogeneous platforms (i.e. different OSs) Proactively monitoring their runtime below the OS 12
BENEFITS OF THE PROPOSED SOLUTION State of the Art System View: Replica 1 Replica 2 Replica 3 Application OS Randomization Space At a given time only some layers of the stack (Application, OS or Network) are checked/ protected Network Application OS Network Application OS Network 1 2 3 n Sate Verification Time Intervals (< 1 sec) 13
BENEFITS OF THE PROPOSED SOLUTION Proposed Solution System View: Replica 1 Replica 2 Replica 3 Application OS Randomization Space At a given time all layers of the stack (Application, OS or Network) are checked/protected. Network Application OS Network Application OS Network 1 2 3 n Sate Verification Time Intervals (< 1 sec) 14
MTD ARCHITECUTRE Components: (1) Virtual Reincarnation (ViRA) (3) SDN Network Dynamics (2) Proactive Monitoring (4) Systems States and Application Runtime 16
MTD ARCHITECUTRE The MTD framework consists of the following four components: Virtual Machine Reincarnation (ViRA) Proactive Monitoring SDN Network Dynamics Systems States and Application Runtime The framework will protect the whole stack; not only particular layers 17
APPROACH DETAILS Nodes run a distributed application on a given platform for a controlled period of time The running time is chosen in a way that successful ongoing attacks become ineffective The new fresh machine will integrate to the system and continue running the application after its data is updated SDN Network 18
APPROACH DETAILS Nodes run a distributed application on a given platform for a controlled period of time The running time is chosen in a way that successful ongoing attacks become ineffective The new fresh machine will integrate to the system and continue running the application after its data is updated SDN Network 19
VIRTUAL REINCARNATION Randomization and diversification technique where nodes (virtual machines) running a distributed application vanish and reappear on a different virtual state with different guest OS, Host OS, hypervisor, and hardware . Virtualized Environment Improve Resiliency Improve Anti-Fragility 20
CREATION OF REPLICAS How do we create replicas? Primary VM runs as no failures are detected. Alternate VM takes place when a failure occurs Acceptance tests are adjusted independently to guarantee system operation Alternate learn from Primary and become more robust to failures/attacks experimented by primary PRIMARY ALTERNATE OK OK FAIL FAIL Acceptance Test Acceptance Test 21
CREATION OF REPLICAS Challenges: Reduce downtime when Primary is replaced by Alternate and vice versa Keep the state of the machine (either Primary or Alternate) after the replacement to achieve uninterrupted operation Keeping the state (stateful reincarnation) allows the system to be application-agnostic PRIMARY ALTERNATE OK OK FAIL FAIL Acceptance Test Acceptance Test 22
CREATION OF REPLICAS Stateful Reincarnation Ideas: VM2 VM3 VM1 Quorum D D D T T T VM4 D D*: Synchronized Data T*: Different version of Text VM4 replaces VM1 T 23
CREATION OF REPLICAS Stateful Reincarnation Ideas: Create different versions of binaries The original code is kept and set with read-only permission so that it can be used as part of the reference to the new locations of the blocks in the re- randomized version. We avoid identifying and updating code position pointers randomization process by keeping a table of trampolines as shown in (b). Each block is located at a fixed offset (i.e., off_c) with respect to the trampoline table. The pointers (in the original code space) are dynamically redirected to its respective address in the code variant when it is de-referenced in each (a) (b) Z. Wang, C. Wu, J. Li, Y. Lai, X. Zhang, W. Hsu and Y. Cheng. ReRANZ: A Ligh- Weight Virtual Machine to Mitigate Memory Disclosure Attacks. To appear in VEE2017. 24
VIRTUAL REINCARNATION Active machines are replaced by new ones with a totally new image https://www.dropbox.com/s/fqjh75su0p908ic/NGCRC-2017-Bhargava-DEMO2.mp4?dl=0 https://www.dropbox.com/s/fqjh75su0p908ic/NGCRC-2017-Bhargava-DEMO2.mp4?dl=0 25
PROACTIVE MONITORING Operates at the hypervisor level Helps for performing node reincarnation effectively rather than blindly Based on Virtual Machine Introspection (VMI) Proactively gathers live memory data (at host OS) in intervals and reacts if anomalous behavior is detected Use libvmi library for introspection with negligible performance overhead When application is hijacked, address offsets show new entries for injected code When application is terminated and a new malicious one created, it could end up with a different process ID or memory address offset 26
SDN NETWORK DYNAMICS Network devices are reconfigured via OpenFlow on-the-fly New added flows redirect traffic intended for the old machine to the new machine SDN Network 27
SDN NETWORK DYNAMICS Network devices are reconfigured via OpenFlow on-the-fly New added flows redirect traffic intended for the old machine to the new machine OpenFlow Tables: table=0,priority=0,actions= : table=1,priority=0,actions= : table=2,ip,nw_dst=10.0.0.10,... SDN Network 28
SDN NETWORK DYNAMICS New machines can be integrated to the system with their own IP addresses No waiting for the IP address of the old machine Downtime is reduced 29
MEASUREMENTS A Byzantine fault tolerant (BFT-SMaRt) distributed application was run on a set of Ubuntu (either 12.04 or 14.04 randomly selected). VMs run in a private cloud, and are connected with an SDN network using Open vSwitch The reincarnation is stateless, i.e. the new node (e.g. VM1 ) does not inherit the state of the replaced node (e.g. VM1). The set of new VMs are periodically refreshed to start clean and the network is reconfigured using OpenFlow when a VM is reincarnated to provide continued access to the application. 30
MEASUREMENTS 1. VM restart time: Time it takes the machine to respond to be full operational since it is started. 2. Virtual creation time: Time to create the new image of the VM. 3. Open vSwitch flow injection time: Time it takes to inject new flows to Open vSwitch Note: that the important factor for system downtime here is the Open vSwitch flow injection time, as VM creation and restart take place before the reincarnation process 31
MEASUREMENTS Aim to estimate the time it takes the new machine to be full operational. VM creation and restart take place before the reincarnation process The important factor for system downtime here is the Open vSwitch flow injection time 32
FUTURE WORK Enhanced live monitoring techniques Instrumentation to measure overhead more accurately Test other stateless applications on the MTD framework E.g.: Upright (Public and Subscribe System) 33
FUTURE WORK Stateful Virtual Reincarnation Support: Can we preserve the state of the virtual machine during the reincarnation process to make the solution application- agnostic? Test the framework with Secure SOA Services (stateful reincarnation) 34
PRESENTATION AND PUBLICATIONS 1. NGC Cyber Resilient Systems IRAD (http://www.northropgrumman.com) 2. Enterprise Resiliency IRAD (http://www.northropgrumman.com) 3. Ahmed, N., and Bhargava, B. Towards Targeted Intrusion Detection Deployments in Cloud Computing. In the Int. Journal of Next- Generation Computing Vol. 6, No 2, IJNGC - JULY 2015. 4. N. Ahmed. Design, Implementation, and Experiments for Moving Target Defense. PhD Thesis, Purdue University, 2016. 5. N. Ahmed and B. Bhargava. From Byzantine Fault-Tolerance to Fault-Avoidance: An Architectural Transformation to Attack and Failure Resilience. To Appear in IEEE Transactions on Cloud Computing, TCC 2016. 6. N. Ahmed and B. Bhargava. Disruption-Resilient Publish/Subscribe: A Moving Target Defense Approach. The 6th International Conference on Cloud Computing and Services Science, CLOSER 2016. 7. N. Ahmed and B. Bhargava. Mayflies: A Moving Target Defense Framework for Distributed Systems. 3rd ACM workshop on MTD in conjunction with ACM Conference on Computer and Communications Security (CCS), Vienna, 2016. 8. R. Ranchal, D. Ulybyshev, P. Angin, and B. Bhargava. Policy-based Distributed Data Dissemination. CERIAS Security Symposium, April 2015 (Best poster award) 9. V. Pappas, M. Polychronakis and A. Keromytis. Smashing the gadgets: Hindering return-oriented programming using in-place code randomization. In IEEE Security and Privacy (SP), 2012. 10. L. Chen and A. Avizienis. N-version programming: A fault-tolerance approach to reliability of software operation. Digest of Papers FTCS-8: Eighth Annual International Conference on Fault Tolerant Computing. 1978. 11. M. Carvalho and R. Ford. Moving-target defenses for computer networks. IEEE Security & Privacy 12.2 (2014). 35
