| Title | Sandnet: Towards High Quality of Deception in Container-Based Microservice Architectures |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Osman, Amr, Bruckner, Pascal, Salah, Hani, Fitzek, Frank H. P., Strufe, Thorsten, Fischer, Mathias |
| Conference Name | ICC 2019 - 2019 IEEE International Conference on Communications (ICC) |
| Keywords | Attack Strategies, Cloning, composability, computer network security, computer viruses, confinement, container-based microservice architectures, Containers, Cyber-physical systems, Degradation, evaluation scenario, live confinement, Measurement, network deception mechanisms, open production network, privacy, Production, Production systems, pubcrawl, QoD, quarantined services, Resiliency, sandbox network, Sandboxing, sandnet, security, security incidents, suspicious microservices, Switches, system monitoring, threat intelligence, vulnerable production network |
| Abstract | Responding to network security incidents requires interference with ongoing attacks to restore the security of services running on production systems. This approach prevents damage, but drastically impedes the collection of threat intelligence and the analysis of vulnerabilities, exploits, and attack strategies. We propose the live confinement of suspicious microservices into a sandbox network that allows to monitor and analyze ongoing attacks under quarantine and that retains an image of the vulnerable and open production network. A successful sandboxing requires that it happens completely transparent to and cannot be detected by an attacker. Therefore, we introduce a novel metric to measure the Quality of Deception (QoD) and use it to evaluate three proposed network deception mechanisms. Our evaluation results indicate that in our evaluation scenario in best case, an optimal QoD is achieved. In worst case, only a small downtime of approx. 3s per microservice (MS) occurs and thus a momentary drop in QoD to 70.26% before it converges back to optimum as the quarantined services are restored. |
| DOI | 10.1109/ICC.2019.8761171 |
| Citation Key | osman_sandnet_2019 |
Sandnet: Towards High Quality of Deception in Container-Based Microservice Architectures