arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1704.04782cs.DCcs.AIcs.CRhep-ex
收藏

基于虚拟化的HEP体系结构的安全监控框架

A Security Monitoring Framework For Virtualization Based HEP Infrastructures

Goethe-University Frankfurt(法兰克福歌德大学);CERN(欧洲核子研究中心)

A. Gomez Ramirez, M. Martinez Pedreira, C. Grigoras, L. Betev, C. Lara, U. Kebschull

摘要:

高能物理(HEP)分布式计算基础设施需要自动化工具来监控、分析潜在的安全事件并做出反应。这些工具应收集和检查资源消耗、日志和系统调用序列等数据,以检测表明存在恶意代理的异常情况。他们还应该能够在没有管理员干预的情况下对攻击执行自动反应。我们描述了一个新的框架,完成这些要求,在欧洲核子研究中心的ALICE实验的概念实现的证明。我们展示了如何实现一个完全虚拟化的环境,通过隔离服务和作业来提高安全性,而不会对性能产生重大影响。我们还描述了一个收集的数据集机器学习为基础的入侵预防和检测系统的网格计算。该数据集由资源消耗度量(如CPU、RAM和网络流量)、来自操作系统服务的日志文件以及从ALICE Grid测试站点中运行的生产作业收集的系统调用数据和大量恶意软件组成。该恶意软件是从安全研究网站收集的。基于此数据集,我们将继续开发能够检测恶意作业的机器学习算法。

英文摘要:

High Energy Physics (HEP) distributed computing infrastructures require automatic tools to monitor, analyze and react to potential security incidents. These tools should collect and inspect data such as resource consumption, logs and sequence of system calls for detecting anomalies that indicate the presence of a malicious agent. They should also be able to perform automated reactions to attacks without administrator intervention. We describe a novel framework that accomplishes these requirements, with a proof of concept implementation for the ALICE experiment at CERN. We show how we achieve a fully virtualized environment that improves the security by isolating services and Jobs without a significant performance impact. We also describe a collected dataset for Machine Learning based Intrusion Prevention and Detection Systems on Grid computing. This dataset is composed of resource consumption measurements (such as CPU, RAM and network traffic), logfiles from operating system services, and system call data collected from production Jobs running in an ALICE Grid test site and a big set of malware. This malware was collected from security research sites. Based on this dataset, we will proceed to develop Machine Learning algorithms able to detect malicious Jobs.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑