Intrusion detection in openstack using snort and custom implementation

Abstract

The growing adoption of cloud storage by businesses has amplified security concerns within cloud applications. As reliance on cloud computing surges, robust security measures become ever more critical. OpenStack, a widely used open-source cloud platform, offers Infrastructure as a Service (IaaS), attracting a large user base. To safeguard its virtualized environment, OpenStack necessitates effective intrusion detection systems (IDS). Furthermore, recent years have witnessed a surge in interest surrounding the implementation and testing of Virtual Network Functions (VNFs) built upon the OpenStack platform. VNFs are a cornerstone of Network Functions Virtualization (NFV), a technology that aims to revolutionize network infrastructure and service delivery by transitioning network functions from hardware to software, fostering greater efficiency. The project is focused on deploying Virtual Network Functions (VNFs) on OpenStack, a popular open-source cloud platform. To achieve this, the project undertakes a deep dive into the functionalities of various OpenStack components, including Nova (compute service), Neutron (networking), and Cinder (block storage). This comprehensive understanding of each component's role is crucial for successful VNF deployment within the OpenStack environment. Along with deployment of NFV this project talks about securing OpenStack cloud applications, using intrusion detection software. First, it examines how an Intrusion Detection System (IDS) can be implemented within an NFV framework, discussing the required architecture and potential challenges. The project then focuses on integrating Snort, a popular open-source NIDS, as a VNF within OpenStack. It highlights Snort's advantages, such as its extensive rule set and scalability, and details the deployment approach for this integration. Furthermore, the project explores a custom, user-specific NIDS designed for low-resource systems where Snort might be too demanding. This custom NIDS underwent development, testing, and performance evaluation through graphical visualizations to compare its effectiveness against Snort.