Artifacts for Nephology: Characterizing the Security of Base Images across Cloud Providers

This repository contains the artifacts for the Nephology project. There are three main folders: analysis, data, and framework.

analysis

This folder contains the analysis data for the base images collected from all providers.

• analysis.ipynb contains the scripts used to calculate and evaluate cloud images based on the collected data using CWSS. Feel free to adjust the scoring methodology. We also include Kendall’s Tau analysis to evaluate weighting sensitivity.
• graph.ipynb generates the box plots for security metrics and the final comparison scatter plots used in the evaluation.
• image_distribution.ipynb generates bar charts showing the distribution of Linux operating systems across four major distributions: Ubuntu, CentOS, Fedora, and Debian.

data

This folder contains all collected log files from the cloud providers.

• The uploads folder contains collected logs, including LinPEAS results, hardening results, internal and external Nmap scans, and SSH-related logs.
• The parser folder contains parsed files where raw logs are converted into structured data.

framework

This is the main folder containing the scripts used to deploy, execute, and collect data. The primary tools used are Ansible for orchestration and Terraform for launching and terminating virtual machines.

We chose not to provide scripts that manipulate VMs directly through provider APIs due to their fragility and provider-specific setup requirements. Instead, users may launch VMs manually through the provider UI and then execute the scripts from the w/o_terraform folder.

• ansible contains the main scripts that are uploaded to and executed on the VM.
• server contains a simple Flask web application used to host a modified version of LinPEAS and provide an upload endpoint for collected VM logs. If you do not want to set up the web server, you may alternatively use ngrok for HTTP tunneling.
• terraform contains the Terraform scripts used to launch VMs and execute scripts through the cloud-init stage. The injected script is located in shared_local/userData.tf.
• w/o_terraform contains scripts used to collect data directly from the VM. If you need to modify the collection logic, please refer to ansible/user-init.sh.j2.

Citation

@inproceedings{chaiwut2026nephology,
  title = {{Nephology: Characterizing the Security of Base Images across Cloud Providers}},
  author = {Narong Chaiwut and Nick Nikiforakis},
  booktitle = {Proceedings of the International Conference on Information and Communications Security (ICICS)},
  year = {2026},
}