[Paper Review] Evaluation of vulnerability reproducibility in container-based Cyber Range

Ryotaro Nakata, Akira Otsuka|arXiv (Cornell University)|Oct 30, 2020

Radiation Effects in Electronics8 references4 citations

TL;DR

This paper evaluates container-based cyber ranges for vulnerability reproducibility, demonstrating that containers reduce resource consumption to under 1/10th of traditional VMs while achieving 99.3% similarity in vulnerability reproduction. The study confirms containers are viable for practical cyber range deployment, provided host-level and kernel vulnerabilities are excluded.

ABSTRACT

A cyber range, a practical and highly educational information security exercise system, is difficult to implement in educational institutions because of the high cost of implementing and maintaining it. Therefore, there is a need for a cyber range that can be adopted and maintained at a low cost. Recently, container type virtualization is gaining attention as it can create a high-speed and high-density exercise environment. However, existing researches have not clearly shown the advantages of container virtualization for building exercise environments. And it is not clear whether the sufficient vulnerabilities are reproducible, which is required to conduct incident scenarios in cyber range. In this paper, we compare container virtualization with existing virtualization type and confirm that the amount of memory, CPU, and storage consumption can be reduced to less than 1/10 of the conventional virtualization methods. We also compare and verify the reproducibility of the vulnerabilities used in common exercise scenarios and confirm that 99.3% of the vulnerabilities are reproducible. The container-based cyber range can be used as a new standard to replace existing methods.

Motivation & Objective

• Address the high cost and limited adoption of traditional cyber ranges in information security education.
• Investigate whether container-based virtualization can effectively reproduce common cyberattack scenarios and vulnerabilities.
• Compare resource consumption and vulnerability reproducibility between container and VM-based cyber range environments.
• Establish container-based cyber ranges as a viable, low-cost alternative to traditional VM-based systems.

Proposed method

• Built a cyber range environment using Docker containers and traditional VMs for direct comparison.
• Used vulnerability assessment tools (e.g., ZAP) and exploit modules to test reproducibility of common attack scenarios.
• Measured and compared resource usage (memory, CPU, storage) between container and VM environments.
• Calculated Jaccard similarity (J) to quantitatively assess behavioral and vulnerability reproduction fidelity between containers and VMs.
• Evaluated system behavior under resource exhaustion attacks to identify security and stability differences.
• Excluded host-level and kernel vulnerabilities from evaluation to ensure fair comparison of application-layer attack scenarios.

Experimental results

Research questions

• RQ1 To what extent can container-based virtualization reproduce the same vulnerability behaviors as traditional VM-based cyber ranges?
• RQ2 How does resource consumption (memory, CPU, storage) in container-based cyber ranges compare to VM-based counterparts?
• RQ3 What are the behavioral and operational differences between containers and VMs under attack conditions, particularly regarding system stability?
• RQ4 Which types of vulnerabilities are unsuitable for container-based cyber ranges due to architectural limitations?
• RQ5 Can container-based cyber ranges serve as a reliable, low-cost alternative to existing VM-based systems in educational settings?

Key findings

• Container-based cyber ranges consume less than 1/10th of the memory, CPU, and storage resources compared to traditional VM-based systems.
• The Jaccard similarity score for vulnerability reproduction between containers and VMs reached 0.993, indicating near-identical behavioral fidelity.
• Most discrepancies in reproducibility were due to service startup and configuration differences in containers, not fundamental architectural flaws.
• Containers are unsuitable for hosting attacks that target the host OS or shared kernel resources, as such attacks can destabilize the entire host system.
• With proper resource limits (e.g., memory and storage caps), container-based cyber ranges can mitigate host system impact and remain stable.
• The study confirms that container-based cyber ranges are highly viable for educational use, provided host-level vulnerabilities are excluded from scenarios.