Article
Version 1
Preserved in Portico This version is not peer-reviewed
GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range
Version 1
: Received: 20 June 2024 / Approved: 21 June 2024 / Online: 21 June 2024 (08:52:38 CEST)
A peer-reviewed article of this Preprint also exists.
Mills, A.; White, J.; Legg, P. GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range. J. Cybersecur. Priv. 2024, 4, 615-628. Mills, A.; White, J.; Legg, P. GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range. J. Cybersecur. Priv. 2024, 4, 615-628.
Abstract
Cyberattacks are rapidly evolving both in terms of techniques and frequency, from low-level attacks through to sophisticated Advanced Persistent Threat (APT). There is a need to consider how testbed environments such as cyber ranges can be readily deployed to improve examination of attack characteristics and the assessment of defences. Whilst cyber ranges are not new, they can often be computational expensive, require significant setup and configuration, or may not provide full support for areas such as logging or ongoing learning. In this paper, we propose GoibhniUWE, a container-based cyber range that provides a flexible platform for investigating the full lifecycle of a cyber attack. Adopting a modular approach, users can seamlessly switch out existing, containerised vulnerable services, deploying multiple different services at once allowing for the creation of complex and realistic deployments. The range is fully instrumented with logging capabilities from a variety of sources including Intrusion Detection Systems (IDS), service logging, and network traffic captures. To demonstrate the effectiveness of our approach, we deploy the GoibhniUWE range under multiple conditions to simulate various vulnerable environments, reporting on and comparing key metrics such as CPU and memory usage. We simulate complex attacks which span multiple services and networks, with logging at multiple levels, modelling an Advance Persistent Threat (APT) and their associated Tactics, Techniques, and Procedures (TTPs). We find that even under continuous, active and targeted deployment GoibhniUWE averaged a CPU usage of less than 2 processors and memory usage of less than 4.5 GB.
Keywords
containerisation; cyber range; vulnerability analysis; traffic analysis
Subject
Computer Science and Mathematics, Security Systems
Copyright: This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
Comments (0)
We encourage comments and feedback from a broad range of readers. See criteria for comments and our Diversity statement.
Leave a public commentSend a private comment to the author(s)
* All users must log in before leaving a comment
