GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range

Cyberattacks are rapidly evolving both in terms of techniques and frequency, from low-level attacks through to sophisticated Advanced Persistent Threat (APT). There is a need to consider how testbed environments such as cyber ranges can be readily deployed to improve examination of attack characteristics and the assessment of defences. Whilst cyber ranges are not new, they can often be computational expensive, require significant setup and configuration, or may not provide full support for areas such as logging or ongoing learning. In this paper, we propose GoibhniUWE, a container-based cyber range that provides a flexible platform for investigating the full lifecycle of a cyber attack. Adopting a modular approach, users can seamlessly switch out existing, containerised vulnerable services, deploying multiple different services at once allowing for the creation of complex and realistic deployments. The range is fully instrumented with logging capabilities from a variety of sources including Intrusion Detection Systems (IDS), service logging, and network traffic captures. To demonstrate the effectiveness of our approach, we deploy the GoibhniUWE range under multiple conditions to simulate various vulnerable environments, reporting on and comparing key metrics such as CPU and memory usage. We simulate complex attacks which span multiple services and networks, with logging at multiple levels, modelling an Advance Persistent Threat (APT) and their associated Tactics, Techniques, and Procedures (TTPs). We find that even under continuous, active and targeted deployment GoibhniUWE averaged a CPU usage of less than 2 processors and memory usage of less than 4.5 GB.