EvIDencE: Testing Intrusion Detection Systems in Virtualized Environments

近年来，作为通过服务器整合降低成本和增强物理基础设施灵活性的一种方式，虚拟化受到了工业界和学术界越来越多的关注。虽然虚拟化提供了许多好处，但它也带来了新的挑战，例如引入虚拟机监视器(VMM)和在同一物理服务器上分配潜在的多个虚拟机(VM)带来的潜在威胁和漏洞。安全性通常被认为是现代虚拟服务基础设施用户最关心的问题之一，因为随着虚拟化层的引入，一个新的目标--虚拟平台--可能会被攻击者利用。入侵检测系统(入侵检测系统)是一种常见的安全威胁防御工具，随着虚拟环境的日益普及，出现了一类专门为在虚拟环境中运行的入侵检测系统而设计的新型入侵检测系统，然而到目前为止，还没有提出一种方法和技术来真实可靠地测试给定的虚拟环境下入侵检测系统的性能。为了最大限度地减少安全漏洞的风险，这些方法和技术至关重要。拟议的项目证据提供了详细的研究议程，通过开发生成特定于虚拟化的恶意工作负载的方法以及指标和测量方法来解决这一问题，从而能够以严格和具有代表性的方式测试现代入侵检测系统。为了实现这些目标，需要新的方法来生成包含针对VMM的攻击的恶意工作负载，并利用代表现代虚拟化平台的特定于虚拟化的漏洞。此外，需要新的量化攻击检测准确性的度量标准，明确考虑现代VMM的动态资源配置行为，这通常会显著影响被测入侵检测系统的行为。拟议的项目将通过以下方式实现对虚拟环境中的入侵检测系统的代表性测试：i)基于超级呼叫攻击执行典型恶意工作负载的框架，ii)一套新颖的入侵检测系统测试指标，以及iii)科学严谨的入侵检测系统测试方法。研究人员可以使用开发的技术来测试针对特定研究对象的特定入侵检测系统属性的新型入侵检测算法和体系结构。此外，工业软件架构师和IT安全官员可以使用它们来比较不同的入侵检测系统的攻击检测准确性，以便部署在给定环境中以最佳方式运行的入侵检测系统。最后，这些技术可用于调整和优化已部署的入侵检测系统的配置，从而降低安全漏洞的风险。

In recent years, virtualization has received increasing interest, both from industry and academia, as a way to reduce costs through server consolidation and to enhance the flexibility of physical infrastructures. While virtualization provides many benefits, it also introduces new challenges, such as the potential threats and vulnerabilities that come with the introduction of Virtual Machine Monitors (VMMs) and the allocation of potentially multiple Virtual Machines (VMs) on the same physical server. Security has often been named as one of the major concerns for users of modern virtualized service infrastructures, given that with the introduction of a virtualization layer, a new target - the virtualization platform - is introduced that may be exploited by attackers. Intrusion detection systems (IDSes) are a common defensive instrument against security threats and the increasing adoption of virtualization has lead to the emergence of a novel class of IDSes specifically designed to operate in virtualized environments.However, no methods and techniques have been proposed so far for testing in a realistic and reliable manner how well a given IDS for a virtualized environment performs. To minimize the risk of security breaches, such methods and techniques are crucially important. The proposed project EvIDencE provides a detailed research agenda to address this issue by developing an approach for generating virtualization-specific malicious workloads, as well as metrics and measurement methodologies, enabling the testing of modern IDSes in a rigorous and representative manner. To achieve these goals, novel methods are needed for generating malicious workloads containing attacks targeted at VMMs and exploiting virtualization-specific vulnerabilities that are representative of modern virtualization platforms. Furthermore, novel metrics for quantifying the attack detection accuracy are needed that explicitly take into account the dynamic resource provisioning behavior of modern VMMs, which can normally significantly influence the behavior of the IDS under test. The proposed project will enable the representative testing of IDSes in virtualized environments by contributing: i) a framework for executing representative malicious workloads based on hypercall attacks, ii) a set of novel IDS testing metrics, and iii) a scientifically rigorous IDS testing methodology. The developed techniques can be used by researchers to test novel IDS algorithms and architectures with respect to specific IDS properties that are subject of research. Further, they can be used by industrial software architects and IT security officers to compare different IDSes in terms of their attack detection accuracy in order to deploy an IDS that operates optimally in a given environment. Finally, the techniques can be used to tune and optimize the configuration of an already deployed IDS, thus reducing the risks of a security breach.