High Speed Traffic Analysis for High-Speed Traffic Analysis for Security: Challenges & Approaches Security: Challenges & Approaches C-DAC Asia-Pacific Advanced Network 32 nd Meeting, India Habitat Centre, New Delhi APAN 32nd Meeting, New Delhi, India
P Presentation Outline i O li • Introduction • Observations & Findings Ob ti & Fi di • Active and Passive Measurements • Challenges and approaches • Interesting Works Interesting Works APAN 32nd Meeting, New Delhi, India
I Introduction d i • Evolution – Copper to Fibre Copper to Fibre – Merging of LAN & WAN Technologies – Gigabits at LAN and Multi-Gigabits at Backbone – IPv4 to IPv6 – High-speed TCP g p – e-Governance, e-Science Application and Social computing Social computing APAN 32nd Meeting, New Delhi, India
V l Vulnerabilities bili i • Backbone – Security concerns with respect to routing Sec rit concerns ith respect to ro ting (BGP) – Concerns with respect to Infrastructure C ith t t I f t t • DoS, DDoS, DNS, botnets • User End – Malware, Reconnaissance, Data-Exfiltration, , , , Buffer overflows, DDoS etc., APAN 32nd Meeting, New Delhi, India
I Interesting findings i fi di • DDoS Attacks breaks the 100 Gbps barrier (2010) (2010) • Application-Layer DDoS increasing in sophistication sophistication • DNS has emerged as key attack target • IPv4-IPv6 security concerns • Mostly attack targets are targeted over • Mostly attack targets are targeted over specific customer service and aimed at network services (DNS) network services (DNS) APAN 32nd Meeting, New Delhi, India
Th Threats observed b d • DDoS towards User End • Misconfigurations and failure of devices Mi fi ti d f il f d i • Botnets / Compromised hosts p • HTTP, SMTP and DNS most targeted (DDos) (DDos) • Average time to mitigate DDoS is 20 minutes i t • Zombie Computers (Botnet) p ( ) APAN 32nd Meeting, New Delhi, India
I f Infrastructure Protection P i • Backbone Backbone – ACLs • RFC 1918, 3330, 3704 RFC 1918 3330 3704 – Blackholing – DNS Sinkhole, Scrubbing DNS Sinkhole Scrubbing – Committed access rate (rate limiting) – Stateful Firewall, IPS Stateful Firewall IPS • Most of them fail to handle DDoS • Customer End • Customer End – ACL, Stateful Firewall, IDS/IPS, UTM, Malware prevention prevention APAN 32nd Meeting, New Delhi, India
T Traffic Analysis: Objective ffi A l i Obj ti • Trend analysis • Prevention of intrusions and attacks P ti f i t i d tt k • Anomaly detection y • QoS/SLA Validation • Network Provisioning & Design Net ork Pro isioning & Design APAN 32nd Meeting, New Delhi, India
Obtain Statistics • Host/Interface based (IP address) • Application based (Port based) A li ti b d (P t b d) • Application classification (Application pp ( pp header analysis) • Temporal (time based) • Temporal (time based) • Protocol based (TCP, UDP, ICMP..) APAN 32nd Meeting, New Delhi, India
A Aspects examined i d • Packet Level Packet Level – Bits per second (rate) – Size of packets – Latencies RTT Latencies, RTT – Throughput – Availability – Packet drops & errors Packet drops & errors – Deep packet inspection – Header analysis • Connection Level Connection Level – Connection rate – Direction of traffic (incoming/outgoing) – Stateful inspection – Flow analysis • Application profiling • Vulnerability assessment y • Compliance with standards (RFCs) APAN 32nd Meeting, New Delhi, India
T Traffic Analysis ffi A l i • Active Measurement • Passive Measurement P i M t • Header based Analysis y • Deep Packet Inspection • Handling encrypted packets Handling encr pted packets • Signature based detection • Detecting Anomalies APAN 32nd Meeting, New Delhi, India
Active Measurement • Interferes the network and carries out measurement by injecting specifically measurement by injecting specifically crafted probe packets – Ping traceroute (network tomography) Ping, traceroute (network tomography) – Capprobe, pathchar (delay, capacity estimation) estimation) • Vulnerability measurement – Nessus, nmap Nessus nmap • Network Interface statistics – SNMP (polling) SNMP ( lli ) APAN 32nd Meeting, New Delhi, India
P Passive Measurement i M • Pure observations and analysis of traffic • Packet Analysis • Packet Analysis – Sniffers, tcpdump, Wireshark • Flow level monitoring • Flow level monitoring – Netflow, IDS (like Snort/Bro) • Traffic Classification T ffi Cl ifi ti – CoralReef • TCP TCP – Tstat (TCPtrace) – multigigabit-per-second traffic analysis tool analysis tool APAN 32nd Meeting, New Delhi, India
P Passive Capture and Analysis i C d A l i APAN 32nd Meeting, New Delhi, India
P Packet Capture k C • Standard Ethernet linecards – libpcap p p – libnetfilter_queue (libipq) – libnids • Dedicated Hardware – Like Endace DAG • Formats – Pcap, erf, etherpeek, snoop, flow records – RRD RRD • Challenges – Scalability, efficient memory management S l bilit ffi i t t APAN 32nd Meeting, New Delhi, India
Hi h S High-Speed Packet Capture d P k C • Network support in OS is generic and hence N t k t i OS i i d h time taken for packet to move from network adapter to user space is high adapter to user space is high – Latency and per-packet processing load • Performance • Performance – System costs to bring packets from network to user space/application p pp – Application processing cost (classification, checksum etc..) • Solutions S l i – Memory mapped packet buffers (PF_RING) and DNA – NetFPGA N tFPGA APAN 32nd Meeting, New Delhi, India
H Header Analysis d A l i • Threshold based: – Find no of packets generated by internal hosts to a – Find no. of packets generated by internal hosts to a destination port in a time interval – TCP SYN, UDP Packets based analysis TCP SYN, UDP Packets based analysis – Scanning of Sequential destination addresses (after randomn IP address generation) – Traffic towards unallocated IP addresses (IANA/bogon lists) – Number of distinct destination IP • Application header analysis APAN 32nd Meeting, New Delhi, India
Deep Packet Inspection Deep Packet Inspection Challenges • Content Matching Complexities • Content Matching Complexities – Control Vs Data Packets (more content oriented packets) i t d k t ) – Large % HTTP Traffic with large packet sizes – Number of signatures to be analyzed (> 10,000) – Variable size of signatures, regular expression match and stateful understanding – Packet fragments and Stream reassembly • Compressed & Encrypted traffic • Compressed & Encrypted traffic APAN 32nd Meeting, New Delhi, India
Fl Flow Analyzer A l APAN 32nd Meeting, New Delhi, India
O Our Approach A h • Use both active and passive measurement to devise U b th ti d i t t d i effective network management system – Adrisya a Flow based passive measurement analyzer and Adrisya a Flow based passive measurement analyzer and anomaly detection solution – EDGE system was developed and deployed for monitoring Backbone routers and LAN resources Backbone routers and LAN resources – GYN (Guard Your Network) Intrusion Prevention Appliance (Multi-core based packet splitting) – NetFPGA based Content Matching NetFPGA based Content Matching – Security Assessment System (SAS) on top of Globus for grid environment • Devised Threat-Aware IDS Model using active and passive techniques to profile traffic and changing vulnerabilities (host level) in a network and utilize the ( ) same for detecting relevant intrusions APAN 32nd Meeting, New Delhi, India
Analyzers Signature Detection Detection Packet & Rule Engine Context Based Decoded Detection Dynamic Loader Packet Packets Packets Packet Collector Decoder Decoder (IP Queue) Connection Management State Based Application Decoder Detection Flows Dynamic Loader Flow Flow Detection Events Traffic Flow Analyzer Collector Events IPS Management Scan Traffic Detection Profiler IDMEF communication Data User I/f Flood Detection Management Comprehensive Threat Analysis APAN 32nd Meeting, New Delhi, India
Interesting Works APAN 32nd Meeting, New Delhi, India
Worms: Issues and Worms: Issues and Approaches • Target Scanning – Random, hit-list, permutation, passive scanning, etc (Staniford p p g ( et. al) – Anomalies (Connections to many unique IPs, receiving too many RST packets..) RST packets..) • Worm distribution – Self-carried, embedded/secondary channel – Anomalies (Single-packet UDP, similar and identical content sent in network, secondary channel can be detected easily/prevented by firewall) easily/prevented by firewall) • Detecting Worm activation – More of host analysis issue APAN 32nd Meeting, New Delhi, India
Recommend
More recommend
