Uma análise do consumo de recursos computacionais de um IDS baseado em NFV usando contêineres

Abstract

With the increase of users connected to telecommunications and computer networks and the inherent search for cost reduction, there is a need to improve the performance of network functions, such as intrusion detection systems, firewalls and security balancers. Charge. In many cases, a natural path is to invest in new hardware, which usually has high costs. The Network Functions Virtualization (Network Functions Virtualization – NFV) seeks to break a paradigm in telecommunications networks, enabling the development of new business models, in addition to reducing costs with the acquisition of new elements hardware. When running a virtualized network function in a container using Docker technology, it is possible to have a high degree of portability across operating environments, allowing the movement of a virtualized network function that is in development to test in production without the need to make changes to the along the way. Network Functions Virtualization has opened new avenues for cyber attackers, making it necessary to adhere to protection mechanisms such as intrusion detection systems (Intrusion Detection System – IDS). These systems, when based on virtualized network functions, can make mobility and scalability possible according to demand, in addition to reducing investments in capital goods (CAPEX) and allowing the availability of new services without the need to change equipment. In this sense, this work proposes: (1) A review of virtualized network functions and intrusion detection systems; (2) Review of network functions virtualization tools and survey of the advantages and disadvantages of each one; (3) Execution of an open source intrusion detection system using network functions virtualization; (4) Elaboration and assembly of a virtualized environment for the tests. For the purposes of evaluating this dissertation, two analyzes of the virtualized functions were developed: (1) using virtual machines (simulating a complete system); (2) using containers (sharing the host system’s kernel without needing to emulate full hardware).