A Hypothesis Testing Framework for Network Security P. Brighten - - PowerPoint PPT Presentation

▶
a hypothesis testing framework for network security
SMART_READER_LITE
LIVE PREVIEW

A Hypothesis Testing Framework for Network Security P. Brighten - - PowerPoint PPT Presentation

Mar 02, 2023 432 likes •939 views

A Hypothesis Testing Framework for Network Security P. Brighten Godfrey University of Illinois at Urbana-Champaign TSS Seminar, September 15, 2015 Part of the SoS Lablet with David Nicol Kevin Jin Matthew Caesar Bill Sanders Work with

slide-1
SLIDE 1

A Hypothesis Testing Framework for Network Security

  • P. Brighten Godfrey

University of Illinois at Urbana-Champaign TSS Seminar, September 15, 2015

slide-2
SLIDE 2

Part of the SoS Lablet with

David Nicol Bill Sanders Kevin Jin Matthew Caesar

slide-3
SLIDE 3

Work with…

Anduo Wang Wenxuan Zhou Dong Jin Jason Croft Matthew Caesar Xuan Zhou with Haohui Mai Ahmed Khurshid Sam King Rachit Agarwal

slide-4
SLIDE 4

References to papers in this talk

Haohui Mai, Ahmed Khurshid, Rachit Agarwal, Matthew Caesar, P . Brighten Godfrey, and Samuel T. King. Debugging the Data Plane with Anteater. ACM SIGCOMM, August 2011. Ahmed Khurshid, Xuan Zou, Wenxuan Zhou, Matthew Caesar, and P . Brighten Godfrey. VeriFlow: Verifying Network-Wide Invariants in Real Time. 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI), April 2013. Wenxuan Zhou, Dong Jin, Jason Croft, Matthew Caesar, and P . Brighten Godfrey. Enforcing Customizable Consistency Properties in Software-Defined Networks. 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI), April 2015. Anduo Wang, Brighten Godfrey, and Matthew Caesar. Ravel: Orchestrating Software-Defined Networks. Demo in SOSR’15.

slide-5
SLIDE 5

Background: Network Verification

slide-6
SLIDE 6

Networks are complex

89%

  • f operators never sure

that config changes are bug-free

82%

concerned that changes would cause problems with existing functionality

– Survey of network operators: [Kim, Reich, Gupta, Shahbaz, Feamster, Clark, USENIX NSDI 2015]

slide-7
SLIDE 7

Understanding your network

Flow monitoring

Screenshot from Scrutinizer NetFlow & sFlow analyzer, snmp.co.uk/scrutinizer/

Configuration verification

e.g.: RCC for BGP [Feamster & Balakrishnan, NSDI’05]

slide-8
SLIDE 8

device software device software device software device software device software device software

Configuration verification

protocols protocols protocols protocols protocols protocols

Input Predicted

slide-9
SLIDE 9

Data plane verification

data plane state

Input Predicted Verify the network as close as possible to its actual behavior

slide-10
SLIDE 10

Data plane verification

data plane state

Input Predicted Verify the network as close as possible to its actual behavior

  • (Checks current snapshot)
  • Insensitive to control protocols
  • Accurate model
slide-11
SLIDE 11

Architecture

“Service S reachable

  • nly through firewall?”

“Is segment isolated?”

Verifier

Diagnosis

slide-12
SLIDE 12

Building It

slide-13
SLIDE 13

Verification is nontrivial

(x4 ∨ x7 ∨ ¯ x1) ∧ (. . .) ∧ (. . .) ∧ (. . .)

x[4] = 1 x[7] = 1 x[1] = 0

A B Packet: x[0] x[1] x[2] … x[n] NP-complete!

slide-14
SLIDE 14

Anteater’s solution

Express data plane and invariants as SAT

  • ...up to some max # hops

Check with off-the-shelf SAT solver (Boolector)

slide-15
SLIDE 15

Data plane as boolean functions

Define P(u, v) as the expression for packets traveling from u to v

  • A packet can flow over (u,

v) if and only if it satisfies P(u, v)

u v Destination Action 10.1.1.0/24

Fwd to v

P(u, v) = dst_ip ∈10.1.1.0/24

slide-16
SLIDE 16

Reachability as SAT solving

Goal: reachability from u to w ==

C = (P(u, v) ∧ P(v,w)) is satisfiable u v w

  • SAT solver determines the satisfiability of C
  • Problem: exponentially many paths
  • Solution: Dynamic programming (a.k.a. loop unrolling)
  • Intermediate variables: “Can reach x in k hops?”
  • Similar to [Xie, Zhan, Maltz, Zhang, Greenberg,

Hjalmtysson, Rexford, INFOCOM’05]

slide-17
SLIDE 17

Packet transformation

Essential to model MPLS, QoS, NAT, etc.

  • Model the history of packets: vector over time
  • Packet transformation ⇒ boolean constraints
  • ver adjacent packet versions

v w u

label = 5?

dst_ip ∈ 0.1.1.0/24

(pi.dst ip ∈ 0.1.1.0/24) ∧ (pi+1.label = 5)

pi+1 = f(pi)

More generally:

slide-18
SLIDE 18

Experience with an

  • perational network
slide-19
SLIDE 19

Experiences with real network

Evaluated Anteater with operational network

  • 〜｟178 routers supporting >70,000 machines
  • Predominantly OSPF, also uses BGP and static routing
  • 1,627 FIB entries per router (mean)
  • State collected using operator’s SNMP scripts

Revealed 23 bugs with 3 invariants in 2 hours

Loop Packet loss Consistency Being fixed 9 Stale config. 13 1 Total alerts 9 17 2

slide-20
SLIDE 20

Backbone

Forwarding loops

IDP was overloaded,

  • perator introduced

bypass Bypass routed campus traffic to IDP through static routes Introduced 9 loops

…

building IDP bypass

slide-21
SLIDE 21

Bugs found by other invariants

u

X

u u’ Admin. interface 12.34.56.0/24

Packet loss

  • Blocking compromised

machines at IP level

  • Stale configuration

From Sep, 2008

Consistency

  • One router exposed web

admin interface in FIB

  • Different policy on private IP

address range

slide-22
SLIDE 22

Can we verify networks in real time?

slide-23
SLIDE 23

Not so simple

Challenge #1: Obtaining real time view of network Challenge #2: Verification speed

slide-24
SLIDE 24

Architecture

“Service S reachable

  • nly through firewall?”

Verifier

Diagnosis

slide-25
SLIDE 25

VeriFlow architecture

Thin, standard interface to data plane (e.g. OpenFlow) Logically centralized controller software abstractions app app

slide-26
SLIDE 26

VeriFlow architecture

Thin, standard interface to data plane (e.g. OpenFlow) software abstractions app app VeriFlow Logically centralized controller

slide-27
SLIDE 27

Verifying invariants quickly

Veriflow

Generate Equivalence Classes Updates

Fwd’ing rules Equiv classes

0.0.0.0/1 64.0.0.0/3

Find only equivalence classes affected by the update via a multidimensional trie data structure

slide-28
SLIDE 28

Verifying invariants quickly

Veriflow

Generate Forwarding Graphs Generate Equivalence Classes Updates

All the info to answer queries!

slide-29
SLIDE 29

Veriflow

Verifying invariants quickly

Diagnosis report

  • Type of invariant

violation

  • Affected set of packets

Generate Forwarding Graphs Generate Equivalence Classes Run Queries Updates

Good rules Bad rules

slide-30
SLIDE 30

Evaluation

Simulated network

  • Real-world BGP routing tables (RIBs) from RouteViews

totaling 5 million RIB entries

  • Injected into 172-router network (AS 1755 topology)

Measure time to process each forwarding change

  • 90,000 updates from Route

Views

  • Check for loops and black holes
slide-31
SLIDE 31

Microbenchmark latency

97.8% of updates verified within 1 ms

slide-32
SLIDE 32

Towards a Science of Security: Network Hypothesis Testing

slide-33
SLIDE 33

SoS: Network Hypothesis Testing

1

Modeling dynamic networks

2

Networks as databases

3

Provably correct virtual networks

slide-34
SLIDE 34

Modeling dynamic networks

slide-35
SLIDE 35

Timing uncertainty

Controller

Remove rule 1 (delayed) Install rule 2

Rule 1 Rule 2 Switch A Switch B

Possible network states:

One solution: “consistent updates” [Reitblatt, Foster, Rexford, Schlesinger, Walker, “Abstractions for Network Update”, SIGCOMM 2012]

slide-36
SLIDE 36

Uncertainty-aware verification

slide-37
SLIDE 37

Update synthesis via verification

CCG Stream of Updates Update queue Verifier Network Model Verification Engine Confirmations Yes Controller A should reach B Safe? No

A B C D E F G H

2 1 3 4

1 mod A->C to A->F 2 add F->G 3 add G->H 4 add H->B

Enforcing dynamic correctness with heuristically maximized parallelism

slide-38
SLIDE 38

OK, but…

Can the system “deadlock”?

  • Proved classes of networks that never deadlock
  • Experimentally rare in practice!
  • Last resort: heavyweight “fallback” like consistent updates

[Reitblatt et al, SIGCOMM 2012]

Is it fast?

  • Immediate Update

GCC Consistent Updates

  • }

CCG

Figure 11: Network-trace-driven emulations: (1) immediate application of updates; (2) CCG (with CU as fallback); and (3) CU.

0.5 1 1.5 2 90 91 92 93 94 95 Throughput (Gbps) Second CCG Consistent updates 0.5 1 1.5 2 90 95 100 105 110 115 120 125 130 Throughput (Gbps) Second CCG Consistent updates

  • }

CCG

0.5 1 1.5 2 90 91 92 93 94 95 Throughput (Gbps) Second CCG Consistent updates 0.5 1 1.5 2 90 95 100 105 110 115 120 125 130 Throughput (Gbps) Second CCG Consistent updates

  • }

CCG

0.5 1 1.5 2 90 91 92 93 94 95 Throughput (Gbps) Second CCG Consistent updates 0.5 1 1.5 2 90 95 100 105 110 115 120 125 130 Throughput (Gbps) Second CCG Consistent updates

slide-39
SLIDE 39

Software-defined Networks as Databases

slide-40
SLIDE 40

Software-Defined Networks

Thin, standard interface to data plane (e.g. OpenFlow) Logically centralized controller software abstractions app app

slide-41
SLIDE 41

Ravel: database view of net control

Network base tables query, update notification events Openflow control app view app view app view standard SQL database app view

slide-42
SLIDE 42

Ravel example

balance load

base view

configuration traffic matrix tenant virtual network

access control

shortest path

load balancer

add_flow del_flow verify 3 2 1 compute path

view

slide-43
SLIDE 43

Key benefits

balance load configuration traffic matrix tenant virtual network

access control

shortest path

load balancer

add_flow del_flow verify 3 2 1 compute path

Abstraction via SQL Orchestration via data- sharing “Bonus” DB services

  • verification, synthesis

via view maintenance, update

  • transaction processing
slide-44
SLIDE 44

Impact of Network Verification

slide-45
SLIDE 45

Configuration verification

Configuration verification

  • [Al-Shaer2004, Bartal1999, Benson2009, Feamster2005,

Yuan2006]

Firewall verification

  • Margrave [Nelson, Barratt, Dougherty, Fisler,

Krishnamurthi, LISA’10]

slide-46
SLIDE 46

Data plane verification

  • Static reachability in IP networks [Xie’05]
  • FlowChecker [Al-Shaer, Al-Haj, SafeConfig ’10]
  • ConfigChecker [Al-Shaer, Al-Saleh, SafeConfig ’11]
  • Anteater [Mai, Khurshid, Agarwal,

Caesar, G., King, SIGCOMM’11]

  • VeriFlow [Khurshid, Zou, Zhou,

Caesar, G., HotSDN’12, NSDI’13]

  • CCG [Zhou, Jin, Croft, Caesar, G.,

NSDI’15]

  • Header Space Analysis

[Kazemian, Varghese, and McKeown, NSDI ’12]

  • NetPlumber [Kazemian, Chang,

Zeng, Varghese, McKeown, Whyte, NSDI ’13]

  • Batfish [Fogel, Fung, Pedrosa,

Walraed-Sullivan, Govindan, Mahajan, Millstein, NSDI’15]

slide-47
SLIDE 47

DPV in the real world

Microsoft

This paper is included in the Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’15). May 4–6, 2015 • Oakland, CA, USA I S B N 9 7 8
  • 1
  • 9
3 1 9 7 1
  • 2
1 8 Open Access to the Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’15) is sponsored by USENIX

Checking Beliefs in Dynamic Networks

Nuno P. Lopes, Nikolaj Bjørner, and Patrice Godefroid, Microsoft Research; Karthick Jayaraman, Microsoft Azure; George Varghese, Microsoft Research h t t p s : / / w w w . u s e n i x .
  • r
g / c
  • n
f e r e n c e / n s d i 1 5 / t e c h n i c a l
  • s
e s s i
  • n
s / p r e s e n t a t i
  • n
/ l
  • p
e s
slide-48
SLIDE 48

Future research: Richer models

Software pipelines Verifiable SDN Controllers Stateful Networks Higher layer concepts (roles, people, applications)

slide-49
SLIDE 49

Thanks!