EvIDencE: Testing Intrusion Detection Systems in Virtualized Environments

近年来，虚拟化作为通过服务器整合降低成本和增强物理基础设施灵活性的一种方式，受到了工业界和学术界越来越多的关注。虽然虚拟化提供了许多好处，但它也带来了新的挑战，例如引入虚拟机集群（VMM）以及在同一物理服务器上分配多个虚拟机（VM）所带来的潜在威胁和漏洞。安全性通常被认为是现代虚拟化服务基础设施的用户的主要关注点之一，因为随着虚拟化层的引入，引入了可能被攻击者利用的新目标-虚拟化平台。入侵检测系统（IDS）是一种常见的防御安全威胁的工具，随着虚拟化技术的不断发展，出现了一类专门设计用于虚拟化环境的IDS，但是目前还没有一种方法和技术能够真实可靠地测试虚拟化环境下IDS的性能。为了最大限度地降低安全漏洞的风险，这些方法和技术至关重要。拟议的项目EvIDencE提供了一个详细的研究议程，通过开发一种生成特定于虚拟化的恶意工作负载的方法以及指标和测量方法来解决这个问题，从而能够以严格和有代表性的方式测试现代IDS。为了实现这些目标，需要新的方法来生成包含针对VMM的攻击的恶意工作负载，并利用代表现代虚拟化平台的虚拟化特定漏洞。此外，需要明确考虑现代VMM的动态资源配置行为的新的度量来量化攻击检测准确性，这通常会显著影响测试中的IDS的行为。拟议的项目将通过贡献：i）基于hypercall攻击执行代表性恶意工作负载的框架，ii）一组新的IDS测试指标，以及iii）科学严谨的IDS测试方法，在虚拟化环境中实现IDS的代表性测试。所开发的技术可以被研究人员用来测试新的IDS算法和体系结构相对于特定的IDS属性的研究对象。此外，工业软件架构师和IT安全官员可以使用它们来比较不同IDS的攻击检测准确性，以便部署在给定环境中最佳运行的IDS。最后，这些技术可以用于调整和优化已经部署的IDS的配置，从而降低安全漏洞的风险。

In recent years, virtualization has received increasing interest, both from industry and academia, as a way to reduce costs through server consolidation and to enhance the flexibility of physical infrastructures. While virtualization provides many benefits, it also introduces new challenges, such as the potential threats and vulnerabilities that come with the introduction of Virtual Machine Monitors (VMMs) and the allocation of potentially multiple Virtual Machines (VMs) on the same physical server. Security has often been named as one of the major concerns for users of modern virtualized service infrastructures, given that with the introduction of a virtualization layer, a new target - the virtualization platform - is introduced that may be exploited by attackers. Intrusion detection systems (IDSes) are a common defensive instrument against security threats and the increasing adoption of virtualization has lead to the emergence of a novel class of IDSes specifically designed to operate in virtualized environments.However, no methods and techniques have been proposed so far for testing in a realistic and reliable manner how well a given IDS for a virtualized environment performs. To minimize the risk of security breaches, such methods and techniques are crucially important. The proposed project EvIDencE provides a detailed research agenda to address this issue by developing an approach for generating virtualization-specific malicious workloads, as well as metrics and measurement methodologies, enabling the testing of modern IDSes in a rigorous and representative manner. To achieve these goals, novel methods are needed for generating malicious workloads containing attacks targeted at VMMs and exploiting virtualization-specific vulnerabilities that are representative of modern virtualization platforms. Furthermore, novel metrics for quantifying the attack detection accuracy are needed that explicitly take into account the dynamic resource provisioning behavior of modern VMMs, which can normally significantly influence the behavior of the IDS under test. The proposed project will enable the representative testing of IDSes in virtualized environments by contributing: i) a framework for executing representative malicious workloads based on hypercall attacks, ii) a set of novel IDS testing metrics, and iii) a scientifically rigorous IDS testing methodology. The developed techniques can be used by researchers to test novel IDS algorithms and architectures with respect to specific IDS properties that are subject of research. Further, they can be used by industrial software architects and IT security officers to compare different IDSes in terms of their attack detection accuracy in order to deploy an IDS that operates optimally in a given environment. Finally, the techniques can be used to tune and optimize the configuration of an already deployed IDS, thus reducing the risks of a security breach.