SLIDE 1
Bro Workshop 2011
Bro Workshop 2011 NCSA, Urbana-Champaign, IL
Bro Workshop 2011
Outline
2
Near- to Medium-term Roadmap Current Research Projects Workshop Wrap-Up
Broadmap Bro Workshop 2011 NCSA, Urbana-Champaign, IL Bro Workshop - - PowerPoint PPT Presentation
Broadmap Bro Workshop 2011 NCSA, Urbana-Champaign, IL Bro Workshop - - PowerPoint PPT Presentation
The Bro Network Security Monitor Broadmap Bro Workshop 2011 NCSA, Urbana-Champaign, IL Bro Workshop 2011 Outline Near- to Medium-term Roadmap Current Research Projects Workshop Wrap-Up 2 Bro Workshop 2011 Version 2.0 Final 3 Bro
SLIDE 2
SLIDE 3
Bro Workshop 2011
Version 2.0 Final
3
SLIDE 4
Bro Workshop 2011
Version 2.0 Final
3
Timeline: Early December.
Default scripts rewritten from scratch. New logging system. New build and packaging system. New auto-documentation system (Broxygen). Lots of bugs fixed. Obsolete code removed. New development infrastructure. New regression testing framework. New web server. New mailing lists. New logo.
SLIDE 5
Bro Workshop 2011
Upcoming
4
SLIDE 6
Bro Workshop 2011
Upcoming
Bro 2.1
New user’s guide. Overhauled IPv6 support. Logging extensions.
Binary logging/Postgresql/CouchDB/SQLite(?) / Threads.
Integration with REN-ISACs CIF. Reaction framework. New/improved analyzers.
Syslog/GridFTP/NFS/SMB/BitTorrent.
Extended test-suite.
4
Aiming for 3-4 months release cycle.
SLIDE 7
Bro Workshop 2011
In Planning
5
SLIDE 8
Bro Workshop 2011
In Planning
Comprehensive Bro Archive Network (CBAN)
Easy installation of 3rd party scripts.
5
SLIDE 9
Bro Workshop 2011
In Planning
Comprehensive Bro Archive Network (CBAN)
Easy installation of 3rd party scripts.
File Analyzer
Protocol-independent file hashing, extraction, decompression, analysis, and reassembly.
5
SLIDE 10
Bro Workshop 2011
In Planning
Comprehensive Bro Archive Network (CBAN)
Easy installation of 3rd party scripts.
File Analyzer
Protocol-independent file hashing, extraction, decompression, analysis, and reassembly.
Input Framework.
Real-time interface to external intelligence.
5
SLIDE 11
Bro Workshop 2011
In Planning
6
SLIDE 12
Bro Workshop 2011
In Planning
Deep Cluster
Pushing Bro deep into your network.
6
SLIDE 13
Bro Workshop 2011
In Planning
Deep Cluster
Pushing Bro deep into your network.
Unified packet acquisition and control.
Plugin-based interface to platform capabilities.
6
SLIDE 14
Bro Workshop 2011
In Planning
Deep Cluster
Pushing Bro deep into your network.
Unified packet acquisition and control.
Plugin-based interface to platform capabilities.
New/extended protocol analyzers.
Ongoing focus. Working on BinPAC++.
6
SLIDE 15
Bro Workshop 2011
In Planning
Deep Cluster
Pushing Bro deep into your network.
Unified packet acquisition and control.
Plugin-based interface to platform capabilities.
New/extended protocol analyzers.
Ongoing focus. Working on BinPAC++.
Internal reorganization and cleanup.
Move to a more modular structure.
6
SLIDE 16
Bro Workshop 2011
Current Research Projects
7
SLIDE 17
Bro Workshop 2011
Next Stop: 100 Gb/s
8
Source: ESNet
Now these sites need a monitoring solution ... Working with cPacket on a 100GE load- balancer!
Source: ESNet
DOE/ESNet 100G Advanced Networking Initiative
SLIDE 18
Bro Workshop 2011
100 Gb/s Load-balancer
SLIDE 19
Bro Workshop 2011
100 Gb/s Load-balancer
SLIDE 20
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
SLIDE 21
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
SLIDE 22
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
100Gbps
cFlow 100G
SLIDE 23
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
100Gbps
cFlow 100G
10Gb/s
SLIDE 24
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
100Gbps
cFlow 100G
10Gb/s
Bro Cluster
SLIDE 25
Bro Workshop 2011
SBIR Phase 2 to build prototype.
100 Gb/s Load-balancer
100Gbps
cFlow 100G
10Gb/s
Bro Cluster
API
Control
SLIDE 26
Bro Workshop 2011
Concurrent Analysis
10
SLIDE 27
Bro Workshop 2011
Concurrent Analysis
Bro is still single-threaded.
Cluster leverages advanced packet-level capabilities to exploit multi-core systems.
10
SLIDE 28
Bro Workshop 2011
Concurrent Analysis
Bro is still single-threaded.
Cluster leverages advanced packet-level capabilities to exploit multi-core systems.
Eventually, we want multi-threading.
Scaling with number of cores. Transparent to the operator.
10
SLIDE 29
Bro Workshop 2011
Concurrent Analysis
Bro is still single-threaded.
Cluster leverages advanced packet-level capabilities to exploit multi-core systems.
Eventually, we want multi-threading.
Scaling with number of cores. Transparent to the operator.
For some IDS, that’s not so hard.
For others, it is ...
10
SLIDE 30
Bro Workshop 2011
Network
Event Engine
Protocol Decoding
Policy Script Interpreter
Analysis Logic
Logs Events Packets Notification 11
Architecture
SLIDE 31
Bro Workshop 2011
Single Thread
Network
Event Engine
Protocol Decoding
Policy Script Interpreter
Analysis Logic
Logs Events Packets Notification 11
Architecture
SLIDE 32
Bro Workshop 2011
Event Engine
Architecture
12
Network
Packets Events Notification
Script Threads
Scripting Language
Event Engine Threads
Packet Analysis Detection Logic
Dispatcher
Packet Dispatcher (NIC)
SLIDE 33
Bro Workshop 2011
Event Engine
Architecture
12
Network
Packets Events Notification
Script Threads
Scripting Language
Event Engine Threads
“Cluster in a Box” Packet Analysis Detection Logic
Dispatcher
Packet Dispatcher (NIC)
SLIDE 34
Bro Workshop 2011
Event Engine
Architecture
12
Network
Packets Events Notification
Script Threads
Scripting Language
Event Engine Threads
“Cluster in a Box” Packet Analysis Detection Logic
Dispatcher
Packet Dispatcher (NIC) How to parallelize a scripting language?
SLIDE 35
Bro Workshop 2011
HILTI Abstract Machine
13
A High-Level Intermediary Language for Traffic Inspection
SLIDE 36
Bro Workshop 2011
HILTI Abstract Machine
13
First-class networking types built-in Containers with state management support Platform for building high-level, reusable functionality on Domain-specific concurrency model Well-defined, contained execution environment
Domain-specific Data Types Robust/Secure Execution Concurrent Analysis High-level Standard Components State Management
Timers can drive execution
Real-time Performance
Support for incremental processing Extensive
- ptimization
potential Scalability through parallelization Static type-system, and robust error handling Compilation to native code
A High-Level Intermediary Language for Traffic Inspection
SLIDE 37
Bro Workshop 2011
HILTI Abstract Machine
13
First-class networking types built-in Containers with state management support Platform for building high-level, reusable functionality on Domain-specific concurrency model Well-defined, contained execution environment
Domain-specific Data Types Robust/Secure Execution Concurrent Analysis High-level Standard Components State Management
Timers can drive execution
Real-time Performance
Support for incremental processing Extensive
- ptimization
potential Scalability through parallelization Static type-system, and robust error handling Compilation to native code
A High-Level Intermediary Language for Traffic Inspection
SLIDE 38
Bro Workshop 2011
Workshop Wrap Up
14
Thanks for coming to the Bro Workshop 2011!
SLIDE 39
Bro Workshop 2011
Workshop Wrap Up
14
Thanks for coming to the Bro Workshop 2011! Thanks to NSF for subsidizing workshop attendance.
SLIDE 40
Bro Workshop 2011
Building a Community
15
http://www.bro-ids.org
SLIDE 41
Bro Workshop 2011
Building a Community
Our goal is to build a larger “Bro Community”.
Users: Exchange of experiences and functionality. Developers: External contributions will be crucial.
15
http://www.bro-ids.org
SLIDE 42
Bro Workshop 2011
Building a Community
Our goal is to build a larger “Bro Community”.
Users: Exchange of experiences and functionality. Developers: External contributions will be crucial.
New community resources.
Mailing lists / Blog / Twitter / IRC. Contributed scripts repository.
15
http://www.bro-ids.org
SLIDE 43
Bro Workshop 2011
Building a Community
Our goal is to build a larger “Bro Community”.
Users: Exchange of experiences and functionality. Developers: External contributions will be crucial.
New community resources.
Mailing lists / Blog / Twitter / IRC. Contributed scripts repository.
Open development model.
All code in public git repositories. Extensive use of issue tracker.
15
http://www.bro-ids.org
SLIDE 44
Bro Workshop 2011
Helping the Bro Project
16
SLIDE 45
Bro Workshop 2011
Helping the Bro Project
Tell us!
16
SLIDE 46
Bro Workshop 2011
Helping the Bro Project
Tell us! Tell others!
16
SLIDE 47
Bro Workshop 2011
Helping the Bro Project
Tell us! Tell others! Help others!
16
SLIDE 48
Bro Workshop 2011
Helping the Bro Project
Tell us! Tell others! Help others! Contribute!
16
SLIDE 49
Bro Workshop 2011
Shameless Plug
17
SLIDE 50
Bro Workshop 2011
Shameless Plug
All of the Bro 2.0 work was only possible with the support from National Science Foundation.
17
SLIDE 51
Bro Workshop 2011
Shameless Plug
All of the Bro 2.0 work was only possible with the support from National Science Foundation. We can continue with that for a bit, but only for so long. And we have many more ideas anyway.
17
SLIDE 52
Bro Workshop 2011
Shameless Plug
All of the Bro 2.0 work was only possible with the support from National Science Foundation. We can continue with that for a bit, but only for so long. And we have many more ideas anyway. We are looking for more funding to keep the team together, and potentially expand it further.
17
SLIDE 53
Bro Workshop 2011
Shameless Plug
All of the Bro 2.0 work was only possible with the support from National Science Foundation. We can continue with that for a bit, but only for so long. And we have many more ideas anyway. We are looking for more funding to keep the team together, and potentially expand it further. Any ideas? Let us know.
17
SLIDE 54
Bro Workshop 2011
18
Thanks for Coming!
SLIDE 55 Twitter
Bro Workshop 2011
18
Thanks for Coming!
Homepage
www.bro-ids.org
@BRO_IDS
Contact
info@bro-ids.org User mailing list
Development
git.bro-ids.org Developer’s mailing list Commit notification list Vern Paxson Gregor Maier Jim Barlow Jonathan Siwek Gilbert Clark Adam Slagell Seth Hall Robin Sommer Christian Kreibich Daniel Thayer Hui Lin Matthias Vallentin
SLIDE 56 Twitter
Bro Workshop 2011
18
Thanks for Coming!
Please fill out our survey.
Homepage
www.bro-ids.org
@BRO_IDS
Contact
info@bro-ids.org User mailing list
Development
git.bro-ids.org Developer’s mailing list Commit notification list Vern Paxson Gregor Maier Jim Barlow Jonathan Siwek Gilbert Clark Adam Slagell Seth Hall Robin Sommer Christian Kreibich Daniel Thayer Hui Lin Matthias Vallentin
SLIDE 57 Twitter
Bro Workshop 2011
18
Thanks for Coming!
Please fill out our survey.
Homepage
www.bro-ids.org
@BRO_IDS
Contact
info@bro-ids.org User mailing list
Development
git.bro-ids.org Developer’s mailing list Commit notification list
B r
- T
u t
- r
i a l a t A C S A C 2 1 1
One day version of this workshop.
Vern Paxson Gregor Maier Jim Barlow Jonathan Siwek Gilbert Clark Adam Slagell Seth Hall Robin Sommer Christian Kreibich Daniel Thayer Hui Lin Matthias Vallentin