Diseño e implementación de un sistema de seguridad de detección de intrusos (IDS) para la plataforma Openstack utilizando código abierto.

Abstract

In this work, an intrusion detection security system (IDS) was designed aimed at analyzing the traffic of the external network of an OpenStack platform and two ways or implementation scenarios were analyzed; the first, consists of the implementation in a virtual machine instance on the OpenStack platform, while the second way was implemented directly in the control node. Three types of attacks were carried out to test the installations: denial of service, SQL Injection, and buffer Overflow, with denial of service being the attack with the greatest influence on the analysis. The intrusion detection system used was Snort, based on the analysis carried out between the different systems, in the same way the characteristics of the private cloud platforms were analyzed, with the result that OpenStack is the ideal platform for the present work. As a result, it was obtained that the design of the intrusion detection system in the control node scenario turned out to be more efficient, reaching an efficiency percentage of 99.96% with 50 thousand packets per second, compared to the virtualized scenario. That, with the same number of packages, I reached 21.39%. It was concluded that the difference in the implementation consisted in the location and the way in which the network traffic is analyzed. Being the most efficient and recommended control node scenario for external traffic analysis.