How to Test an IDS? GENESIDS: An Automated System for Generating - - PowerPoint PPT Presentation

▶

how to test an ids

How to Test an IDS? GENESIDS: An Automated System for Generating - - PowerPoint PPT Presentation

Mar 28, 2024 285 likes •676 views

How to Test an IDS? GENESIDS: An Automated System for Generating Attack Traffjc WTMC 2018 Felix Erlacher , Falko Dressler Network Intrusion Detection Systems (NIDS) Analyze network traffjc for malicous activity Felix Erlacher: How to Test an

slide-1

SLIDE 1

How to Test an IDS?

GENESIDS: An Automated System for Generating Attack Traffjc WTMC 2018 Felix Erlacher, Falko Dressler

slide-2

SLIDE 2

Network Intrusion Detection Systems (NIDS)

Analyze network traffjc for malicous activity

▶ Anomaly based NIDS

▶ Have a model of ’normal’ traffjc ▶ Detect and alert deviations from ’normal’ traffjc

▶ Signature based NIDS

▶ Have rule-set of known attacks and incidents ▶ Detect rule patterns in analyzed network traffjc

→ Example: Snort

Felix Erlacher: How to Test an IDS? GENESIDS 2

slide-3

SLIDE 3

How to test a NIDS?

▶ Real traffjc?

▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks

Manually creating attack traffjc?

time intensive cumbersome

SUMMARY: traces do not contain enough unique attacks

Felix Erlacher: How to Test an IDS? GENESIDS 3

slide-4

SLIDE 4

How to test a NIDS?

▶ Real traffjc?

▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks

▶ Manually creating attack traffjc?

▶ time intensive ▶ cumbersome

SUMMARY: traces do not contain enough unique attacks

Felix Erlacher: How to Test an IDS? GENESIDS 3

slide-5

SLIDE 5

How to test a NIDS?

▶ Real traffjc?

▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks

▶ Manually creating attack traffjc?

▶ time intensive ▶ cumbersome

SUMMARY: traces do not contain enough unique attacks

Felix Erlacher: How to Test an IDS? GENESIDS 3

slide-6

SLIDE 6

How to test a NIDS! GENESIDS:

Generating Events for Signature-based Intrusion Detection Systems

▶ INPUT: Set of attack descriptions

▶ Snort syntax ▶ HTTP attacks

▶ OUTPUT: Stateful network traffjc containing attack patterns

▶ One fmow per attack ▶ Annotated with an attack ID Felix Erlacher: How to Test an IDS? GENESIDS 4

slide-7

SLIDE 7

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-8

SLIDE 8

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-9

SLIDE 9

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-10

SLIDE 10

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-11

SLIDE 11

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-12

SLIDE 12

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-13

SLIDE 13

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-14

SLIDE 14

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-15

SLIDE 15

Rule example:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com

Felix Erlacher: How to Test an IDS? GENESIDS 5

slide-16

SLIDE 16

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-17

SLIDE 17

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-18

SLIDE 18

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-19

SLIDE 19

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-20

SLIDE 20

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-21

SLIDE 21

Example traffjc in Wireshark:

alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST";http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;)

Felix Erlacher: How to Test an IDS? GENESIDS 6

slide-22

SLIDE 22

GENESIDS Evaluation: Goals & Rules

▶ Ability to generate a variety of difgerent attacks ▶ Generated attacks trigger expected event

All supported Snort rules from: Snort.org subscriber rule-set Snort.org community rule-set Emerging Threats rule-set TOTAL 8101 difgerent rules

Felix Erlacher: How to Test an IDS? GENESIDS 7

slide-23

SLIDE 23

GENESIDS Evaluation: Goals & Rules

▶ Ability to generate a variety of difgerent attacks ▶ Generated attacks trigger expected event

All supported Snort rules from:

▶ Snort.org subscriber rule-set ▶ Snort.org community rule-set ▶ Emerging Threats rule-set

TOTAL 8101 difgerent rules

Felix Erlacher: How to Test an IDS? GENESIDS 7

slide-24

SLIDE 24

GENESIDS Evaluation steps

Signatures

GENESIDS TCP Connection

Signatures

HTTP Server tcpdump Step 1

Rules

00101100101 01001010010 00001110111 11100110100 10111010010 01010111111

Network Trace Felix Erlacher: How to Test an IDS? GENESIDS 8

slide-25

SLIDE 25

GENESIDS Evaluation steps

Rules Signatures

Snort

00101100101 01001010010 00001110111 11100110100 10111010010 01010111111

Network Trace Alerts

Step 2 GENESIDS TCP Connection HTTP Server tcpdump Step 1

Rules

00101100101 01001010010 00001110111 11100110100 10111010010 01010111111

Network Trace Felix Erlacher: How to Test an IDS? GENESIDS 8

slide-26

SLIDE 26

Evaluation results: Generated attacks

20 40 60 80 100 2000 4000 6000 8000 10000 Experiment Run Attacks Attacks Sent

▶ GENESIDS: 8101 attacks generated (out of 8101 rules)

Felix Erlacher: How to Test an IDS? GENESIDS 9

slide-27

SLIDE 27

Evaluation results: True positives

20 40 60 80 100 2000 4000 6000 8000 10000 Experiment Run Attacks Attacks Sent Snort True Pos. Alerts

▶ Snort: 7877 (avg) true positive alerts triggered (out of 8101)

Felix Erlacher: How to Test an IDS? GENESIDS 10

slide-28

SLIDE 28

Evaluation results: False positives

20 40 60 80 100 100 200 500 1000 2000 5000 10000 Experiment Run Attacks Attacks Sent Snort True Pos. Alerts Snort False Pos. Alerts

▶ Snort: 2847 (avg) false positive alerts triggered (62%

triggered by 3 rules)

Felix Erlacher: How to Test an IDS? GENESIDS 11

slide-29

SLIDE 29

Evaluation results: False negatives

20 40 60 80 100 100 200 500 1000 2000 5000 10000 Experiment Run Attacks Attacks Sent Snort True Pos. Alerts Snort False Pos. Alerts Snort False Negatives

▶ Snort: 223 (avg) false negatives (generated attacks that did

not trigger the corresponding alert)

▶ Total of 363 rules generated attack not triggering at least

nce (out of 100)

Felix Erlacher: How to Test an IDS? GENESIDS 12

slide-30

SLIDE 30

Conclusion

GENESIDS: Generating attack traffjc for NIDS testing

▶ Accepting Snort syntax → thousands of up-to-date attack

defjnitions

▶ 97% of generated attacks triggered corresponding alert ▶ Less than 3% failed to trigger corresponding alert

Felix Erlacher: How to Test an IDS? GENESIDS 13

slide-31

SLIDE 31

Software, confjguration fjles, attack network traces: www.ccs-labs.org/~erlacher/resources/

Reminder: GENESIDS Demo → Wednesday 14:10

Thank you for your attention

Felix Erlacher: How to Test an IDS? GENESIDS 14

slide-32

SLIDE 32

Software, confjguration fjles, attack network traces: www.ccs-labs.org/~erlacher/resources/

Reminder: GENESIDS Demo → Wednesday 14:10

Thank you for your attention

Felix Erlacher: How to Test an IDS? GENESIDS 14

slide-33

SLIDE 33

Mixed traffjc with GENESIDS and TRex

Felix Erlacher: How to Test an IDS? GENESIDS 15

slide-34

SLIDE 34

False negatives: Closer look

363 difgerent rules not triggering corresponding event over 100 runs

1. Rules never triggering alert (179)

▶ Some require non-compliant HTTP (e.g. multiple \r\n\r\n) ▶ Restricting strings with ^ and $ ▶ …

2. Rules failing to trigger at least once (in 100 runs) (184)

▶ all of the rules contain a PCRE with random generation (.)

random generation produced unsupported character

▶ … Felix Erlacher: How to Test an IDS? GENESIDS 16

slide-35

SLIDE 35

TLS interception proxy

End-to-end cryptograpic service: Interception Proxy:

01001 001100

libpcap format

Felix Erlacher: How to Test an IDS? GENESIDS 17

slide-36

SLIDE 36

Typical monitoring scenario

01001 001100

Internet

Felix Erlacher: How to Test an IDS? GENESIDS 18

slide-37

SLIDE 37

GENESIDS

Signatures

GENESIDS TCP Connection

HTTP Request HTTP Response Signatures

HTTP Server

Rules

Loop through rules:

1. parse rule
2. generate patterns for HTTP request
3. init TCP connection
4. send HTTP request
5. wait for response
6. end TCP connection

repeat

Felix Erlacher: How to Test an IDS? GENESIDS 19