Smart Moving Target Defense for Linux Container Resiliency

2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC) Pub Date : 2016-11-01 DOI:10.1109/CIC.2016.028

M. Azab, B. Mokhtar, A. S. Abed, M. Eltoweissy

{"title":"Smart Moving Target Defense for Linux Container Resiliency","authors":"M. Azab, B. Mokhtar, A. S. Abed, M. Eltoweissy","doi":"10.1109/CIC.2016.028","DOIUrl":null,"url":null,"abstract":"Nature is a major source of inspiration for many of the inventions that we rely on to maintain our daily lifestyle. In this paper, we present ESCAPE, an evolved version of our nature-inspired game-like informed moving-target-defense mechanism for cloud containers resiliency. ESCAPE rely on a novel container mobilization framework controlled by a smart attack maneuvering module. That module drives the running containers based on real-time models of the interaction between attackers and their targets as a \"predator searching for a prey\" search game. ESCAPE employs run-time live-migration of Linux-containers {prey} to avoid attacks (predator) and failures. The entire process is guided by a novel host-based behavior-monitoring system that seamlessly monitors containers for indications of intrusions and attacks. To evaluate the effect of ESCAPE's container live-migration evading attacks, we extensively simulated the attack avoidance process based on a mathematical model mimicking the prey-vs-predator search game. With ESCAPE's live-migrations, results show high container survival probabilities with minimal added overhead.","PeriodicalId":438546,"journal":{"name":"2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC)","volume":"74 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"12","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/CIC.2016.028","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 12

Abstract

Nature is a major source of inspiration for many of the inventions that we rely on to maintain our daily lifestyle. In this paper, we present ESCAPE, an evolved version of our nature-inspired game-like informed moving-target-defense mechanism for cloud containers resiliency. ESCAPE rely on a novel container mobilization framework controlled by a smart attack maneuvering module. That module drives the running containers based on real-time models of the interaction between attackers and their targets as a "predator searching for a prey" search game. ESCAPE employs run-time live-migration of Linux-containers {prey} to avoid attacks (predator) and failures. The entire process is guided by a novel host-based behavior-monitoring system that seamlessly monitors containers for indications of intrusions and attacks. To evaluate the effect of ESCAPE's container live-migration evading attacks, we extensively simulated the attack avoidance process based on a mathematical model mimicking the prey-vs-predator search game. With ESCAPE's live-migrations, results show high container survival probabilities with minimal added overhead.

查看原文本刊更多论文

Linux容器弹性的智能移动目标防御

大自然是我们赖以维持日常生活方式的许多发明的主要灵感来源。在本文中，我们提出了ESCAPE，这是我们基于自然启发的游戏式知情移动目标防御机制的进化版本，用于云容器弹性。ESCAPE依赖于一种由智能攻击机动模块控制的新型集装箱动员框架。该模块根据攻击者和目标之间的实时交互模型驱动运行的容器，就像一个“捕食者寻找猎物”的搜索游戏。ESCAPE使用linux容器{猎物}的运行时实时迁移来避免攻击(捕食者)和失败。整个过程由一个新颖的基于主机的行为监控系统指导，该系统可以无缝地监控容器的入侵和攻击迹象。为了评估ESCAPE的容器实时迁移躲避攻击的效果，我们基于模拟猎物对捕食者搜索博弈的数学模型，对攻击躲避过程进行了广泛的模拟。使用ESCAPE的实时迁移，结果显示容器生存概率高，增加的开销最小。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC)

自引率

0.00%

发文量