# GoibhniUWE: A Lightweight and Modular Container-Based Cyber Range
## 1 Introduction  
As cyber threats continue to evolve, having adaptive and scalable experimentation platforms that are both reliable and realistic is crucial for successful research and education on the nature of these threats. Given the nature of experiments when it comes to offensive and defensive cyber security assessment, it is not feasible to conduct such work on real-world production systems. At the other end of the spectrum, there may well be characteristics that we wish to study or examine that cannot be fully satisfied with a small scale set up such as a single Virtual Machine (VM) running a set of vulnerable applications. This has given rise to the idea of a 'cyber range', and much like the concept of a shooting range to practice and home a skill, the cyber range sets out to provide a similar platform for refining cyber security skills in controlled scenarios before doing so in a live environment.  
In recent years, much focus has been concentrated around the creation of VMs for providing suitable cyber security exercises. This has been popularised further by the introduction of cloud services such as TryHackMe and HackTheBox for deploying VMs. Cloud providers such as Azure and AWS also allow for the creation of multiple machines to be networked together; however, this comes at a cost and is not trivial to configure. A notable project was developed by [PERSON], Senior Security Analyst of Netflix, who developed the open-source project, DetectionLab [1]. This provides a set of VMs that arepre-configured with connectivity and vulnerable appliances, as well as having built-in defensive tools, such as Security Information and Event Management (SIEM) monitoring, using tools like Splunk and the Threat Hunting plug-ins for this. Whilst this works well to deploy four VMs, this can be a time-consuming and resource-intensive deployment, requiring at least 16 GB of RAM and 55 GB of free hard disk space to run locally. This platform is no longer supported, highlighting the issues around ongoing support and maintenance for such systems. A similar example is the Splunk Attack Range [2], which is set up to utilise multiple server instances (VMs) and provides red team tooling such as Atomic Red [3] and logging support through Splunk. While this provides support for local deployment, it is resource-intensive and seems to be targeted at cloud-based deployments, with multiple open issues for local deployment, some of which are over 12 months old as of writing [4].  
In our work, we propose GoibhniUWE (pronouncedgo-bin-you-ee), a platform that extends the concept of a cyber range to offer a much more modular and scalable approach using containerisation. Our system facilitates a modular methodology where multiple vulnerable services can be run as part of a single deployment that may span across multiple networks, allowing users to create larger, more complex attack scenarios using real-world vulnerabilities. We utilise an existing open-source (OS) resource Vulhub [5], which allows users to practice against services that are vulnerable to a range of vulnerabilities from misconfiguration to high-impact CVEs such as log4j [6]. Furthermore, the introduction of containerisation enables researchers and practitioners to study additional infrastructure concepts such as container segregation and escape. These challenges are increasingly significant in the latest computing paradigms and move the focus away from the security of individual workstations or VMs. Importantly, we provide logging at multiple levels, enabling end users to observe common indicators of different attacks in real time; facilitating ongoing, layered learning throughout; and allowing for the simple provision of datasets made up from multiple logging sources.