1. Alina Oprea Associate Professor, CCIS Northeastern University
MOSAIC: A Platform for Monitoring and Security Analytics in Public Clouds
Alina Oprea
Associate Professor, CCIS
Northeastern University
IEEE SecDev, November 3rd, 2016

2. Trustworthy infrastructure
Public clouds
Public cloud
Management
Compute
Storage
Billing
Authentication
Compute mgmt
Storage mgmt
SDN VM
Physical
Hypervisor
Users
Networking
Trustworthy infrastructure
Sharing of resources

3. Top threats according to Cloud Security Alliance (CSA)
What are the threats?
Cloud provider
Users
Co-location with malicious tenants
Side-channel attacks (cache, network, storage)
Breach of confidential information
VMs infected with malware
Application exploit
Denial of service
Server breaches
Malicious tenants
Credential compromise
Cloud abuse
Top threats according to Cloud Security Alliance (CSA)

4. Analytics-based defenses
Goals
Correlate data sources from multiple cloud layers
Analytics techniques to detect wide range of threats
Protection of cloud infrastructure
Enable cloud users to protect their resources
Protect users privacy

5. Data collection Monitoring infrastructure Network traffic collection
Performance metrics from physical layer (CPU, I/O, memory, disk, power) – Sensu
VM utilization - Ceilometer
Cloud management logs (Nova, Keystone, Horizon)
Network traffic collection
Currently staging area experiments
Plan to deploy in Engage1 environment
Configure Brocade fabric to collect sFlow

6. Account profiling for authentication
Detect credential compromise
Developers leak their AWS passwords in GitHub
Build user profiles based on historical data
Login information (IP address, time)
VM usage (CPU, memory, disk)
Anomaly detection
Detect unusual activities

7. Network traffic analysis
sFlow collector
sFlow collector
MongoDB
Use cases
Detect suspicious communication with external IP addresses
Detect data exfiltration attempts
Prevent cloud abuse
Malware infection, application exploits , illegal use of cloud

8. Quantify workload privacy
App
App
App
App VM VM VM
Hypervisor
Performance metrics
What can be inferred about workloads?
Physical
Networking
NetFlow/sFlow
Strict privacy requirements in public clouds
Users should specify their preferences
Metrics
Quantify privacy experimentally
Information theoretical metrics
How to monitor user workloads while preserving user privacy?
What data should be collected?
What level of aggregation?

9. Analytics for cloud security
Provide recommendations to other cloud providers
Securing public clouds is shared responsibility between cloud provider and tenants
Design data collection and analytics APIs to enable the cloud provider and tenants to use analytics for security
Protect workload privacy respecting users’ preferences

10. Northeastern University Cybersecurity & Privacy Institute
 Xinming Ou
 Xinming Ou
Northeastern University Cybersecurity & Privacy Institute
Alina Oprea