TY - GEN
T1 - Connectivity graph reconstruction for networking cloud infrastructures
AU - Mensah, Pernelle
AU - Dubus, Samuel
AU - Kanoun, Wael
AU - Morin, Christine
AU - Piolle, Guillaume
AU - Totel, Eric
N1 - Publisher Copyright:
© 2017 IEEE.
PY - 2017/12/8
Y1 - 2017/12/8
N2 - Cloud providers have an incomplete view of their hosted virtual infrastructures managed by a Cloud Management System (CMS) and a Software Defined Network (SDN) controller. For various security reasons (e.g. isolation verification, modeling attack paths in the network), it is necessary to know which virtual machines can interact via network protocols. This requires building a connectivity graph between the virtual machines, that we can extract with the knowledge of the overall topology and the deployed network security policy. Existing methodologies for building such models for physical networks produce incomplete results. Moreover, they are not suitable for cloud infrastructures due to either their intrusiveness or lack of connectivity discovery. We propose a method to compute the connectivity graph, relying on information provided by both the CMS and the SDN controller. Connectivity can first be extracted from knowledge databases, then dynamically updated on the occurrence of cloud-related events. This approach shows an exact, complete and up-to-date connectivity graphs computation on a representative infrastructure, in reasonable time.
AB - Cloud providers have an incomplete view of their hosted virtual infrastructures managed by a Cloud Management System (CMS) and a Software Defined Network (SDN) controller. For various security reasons (e.g. isolation verification, modeling attack paths in the network), it is necessary to know which virtual machines can interact via network protocols. This requires building a connectivity graph between the virtual machines, that we can extract with the knowledge of the overall topology and the deployed network security policy. Existing methodologies for building such models for physical networks produce incomplete results. Moreover, they are not suitable for cloud infrastructures due to either their intrusiveness or lack of connectivity discovery. We propose a method to compute the connectivity graph, relying on information provided by both the CMS and the SDN controller. Connectivity can first be extracted from knowledge databases, then dynamically updated on the occurrence of cloud-related events. This approach shows an exact, complete and up-to-date connectivity graphs computation on a representative infrastructure, in reasonable time.
U2 - 10.1109/NCA.2017.8171337
DO - 10.1109/NCA.2017.8171337
M3 - Conference contribution
AN - SCOPUS:85046465364
T3 - 2017 IEEE 16th International Symposium on Network Computing and Applications, NCA 2017
SP - 1
EP - 9
BT - 2017 IEEE 16th International Symposium on Network Computing and Applications, NCA 2017
A2 - Avresky, Dimiter R.
A2 - Gkoulalas-Divanis, Aris
A2 - Avresky, Dimiter R.
A2 - Correia, Miguel P.
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 16th IEEE International Symposium on Network Computing and Applications, NCA 2017
Y2 - 30 October 2017 through 1 November 2017
ER -