NR: Network Security Vulnerability Analysis via Large Scale Simulation

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

This research is developing simulation models that are used to simulate and analyze the affect of large-scale network attacks and assist in the development and understanding of potential defensive mechanisms. The work includes the creation of computer models for a number of network behaviors that are commonly exploited to maliciously degrade or inhibit access to computer networks and systems. These models are used to analyze "what happened", "what might have happened", and "what will happen next time" for common network attacks and failures. By analyzing past behavior, network researchers and network operators are able to better design and implement defenses that mitigate the affect of malicious activities. Recreating the original attach scenario in a simulation environment allows operators to demonstrate what will happen in the future under a similar attack. The methodology used to accomplish these goals is to extend the functionality of the existing ns2 and GTNetS simulation environments to allow for simulation analysis of DDOS attacks. These additions allow researchers to include end--system resource limitations for memory, CPU, and kernel resources into the simulation scenarios, and give a realistic picture of the affect of various attack scenarios on more than just network traffic load. Finally, using these models, interfaces to existing security analysis tools, such as tcpreplay, allow for detailed study of actual systems behavior while under attack scenarios defined and modeled by the simulators. Thus, any live system can be subjected to a variety of attacks in a controlled, but highly realistic environment.