1 Network Intrusion Detection and Mitigation Yan Chen

1 Network Intrusion Detection and Mitigation Yan Chen Northwestern Lab for Internet and Security Technology (LIST) Department of Computer Science Northwestern University http: //list. cs. northwestern. edu

Our Theme • Internet is becoming a new infrastructure for service delivery – World wide web, – Vo. IP – Email – Interactive TV? • Major challenges for Internet-scale services – Scalability: 600 M users, 35 M Web sites, 2. 1 Tb/s – Security: viruses, worms, Trojan horses, etc. – Mobility: ubiquitous devices in phones, shoes, etc. – Agility: dynamic systems/network, congestions/failures – Ossification: extremely hard to deploy new technology in the core 2

Battling Hackers is a Growth Industry! 3 --Wall Street Journal (11/10/2004) • The past decade has seen an explosion in the concern for the security of information • Internet attacks are increasing in frequency, severity and sophistication • Denial of service (Do. S) attacks – Cost $1. 2 billion in 2000 – Thousands of attacks per week in 2001 – Yahoo, Amazon, e. Bay, Microsoft, White House, etc. , attacked

Battling Hackers is a Growth Industry (cont’d) 4 • Virus and worms faster and powerful – Melissa, Nimda, Code Red II, Slammer … – Cause over $28 billion in economic losses in 2003, growing to over $75 billion in economic losses by 2007. – Code Red (2001): 13 hours infected >360 K machines $2. 4 billion loss – Slammer (2003): 10 minutes infected > 75 K machines - $1 billion loss • Spywares are ubiquitous – 80% of Internet computers have spywares installed

5 The Spread of Sapphire/Slammer Worms

How can it affect cell phones? • Cabir worm can infect a cell phone – Infect phones running Symbian OS – Started in Philippines at the end of 2004, surfaced in Asia, Latin America, Europe, and recently in US – Posing as a security management utility – Once infected, propagate itself to other phones via Bluetooth wireless connections – Symbian officials said security was a high priority of the latest software, Symbian OS Version 9. • With ubiquitous Internet connections, more severe viruses/worms for mobile devices will happen soon … 6

The Current Internet: Connectivity Cable and Processing Modem Premisesbased Access Networks Core Networks WLAN Transit Net WLAN Operatorbased Cell Regional LAN Transit Net Premisesbased Analog Public Peering Voice LAN Private Peering NAP Data 7 Transit Net H. 323 RAS H. 323 PSTN DSLAM Data Voice Wireline Regional

Current Intrusion Detection Systems (IDS) • Mostly host-based and not scalable to high-speed networks – Slammer worm infected 75, 000 machines in <10 mins – Host-based schemes inefficient and user dependent » Have to install IDS on all user machines ! • Mostly signature-based – Cannot recognize unknown anomalies/intrusions – New viruses/worms, polymorphism • Statistical detection – Hard to adapt to traffic pattern changes – Unscalable for flow-level detection » IDS vulnerable to Do. S attacks – Overall traffic based: inaccurate, high false positives 8

Current Intrusion Detection Systems (II) • Cannot differentiate malicious events with unintentional anomalies – Anomalies can be caused by network element faults – E. g. , router misconfiguration, signal interference of wireless network, etc. • Isolated or centralized systems – Insufficient info for causes, patterns and prevalence of global-scale attacks 9

Global Router-based Anomaly/Intrusion Detection (GRAID) Systems • Online traffic recording and analysis for highspeed networks – Leverage sketches for data streaming computation • Online adaptive flow-level anomaly/intrusion detection and mitigation – Leverage statistical learning theory (SLT) adaptively learn the traffic pattern changes – E. g. , busy vs. idle wireless networks, with different level of interferences, etc. – Unsupervised learning without knowing ground truth 10

GRAID Systems (II) • Integrated approach for false positive reduction – Signature-based detection – Network element fault diagnostics – Traffic signature matching of emerging applications • Hardware speedup for real-time detection – Collaborated with Gokhan Memik (ECE of NU) – Try various hardware platforms: FPGAs, network processors • Scalable anomaly/intrusion alarm fusion with distributed hash tables (DHT) – Automatically distribute alerts with similar symptoms to the same fusion center for analysis 11

12 GRAID Detection Sensor Inter net LAN Switch scan port GRAID sensor Switch Router Splitter Switch Inter net Splitter scan port Router Switch LAN GRAID sensor (b) Original configuration LAN Switch LAN (a) GRAID sensor Router Switch LAN Inter net GRAID sensor • Attached to a router or access point as a black box • Edge network detection is particularly powerful Monitor each port separately (c) Monitor aggregated traffic from all ports

GRAID Sensor Architecture Normal flows Reversible k-ary sketch monitoring Streaming packet data Filtering Remote aggregated sketch records Sent out for aggregation Local sketch records Sketch based statistical anomaly detection (SSAD) Keys of suspicious flows 13 Part I Sketchbased monitoring & detection Keys of normal flows Statistical detection Suspicious flows Per-flow monitoring Signature -based detection Network fault detection Traffic profile checking Data path Control path Modules on the critical path Part II Intrusion or anomaly alarms to fusion centers Modules on the non-critical path Per-flow monitoring & detection

Scalable Traffic Monitoring and Analysis - Challenge • Potentially tens of millions of time series ! – Need to work at very low aggregation level (e. g. , IP level) – Each access point (AP) can have 200 Mbps – a collection of 10 -100 APs can easily go up to 2 -20 Gbps – The Moore’s Law on traffic growth … • Per-flow analysis is too slow or too expensive – Want to work in near real time 14

Sketch-based Change Detection 15 (ACM SIGCOMM IMC 2003, 2004) (k, u) … Sketch module Sketches Forecast module(s) Error Sketch Change Alarms detection module • • • Input stream: (key, update) Summarize input stream using sketches Build forecast models on top of sketches • Report flows with large forecast errors

Evaluation of Reversible K-ary Sketch • Evaluated with tier-1 ISP trace and NU traces • Scalable – Can handle tens of millions of time series • Accurate – Provable probabilistic accuracy guarantees – Even more accurate on real Internet traces • Efficient – For the worst case traffic, all 40 byte packets: » 16 Gbps on a single FPGA board » 526 Mbps on a Pentium-IV 2. 4 GHz PC – Only less than 3 MB memory used • Patent filed 16

GRAID Sensor Architecture Normal flows Reversible k-ary sketch monitoring Streaming packet data Filtering Remote aggregated sketch records Sent out for aggregation Local sketch records Sketch based statistical anomaly detection (SSAD) Keys of suspicious flows 17 Part I Sketchbased monitoring & detection Keys of normal flows Statistical detection Suspicious flows Per-flow monitoring Signature -based detection Network fault detection Traffic profile checking Data path Control path Modules on the critical path Part II Intrusion or anomaly alarms to fusion centers Modules on the non-critical path Per-flow monitoring & detection

Current IDS Insufficient for Wireless Networks • Most existing IDS signature-based – Especially for wireless networks – Detect denial-of-service attacks caused by the WEP authentication vulnerability, e. g. , Airespace • Current statistical IDS has manually set parameters – Cannot adapt to the traffic pattern changes • However, wireless networks often have transient connections – Hard to differentiate collisions, interference, and attacks 18

Statistical Anomaly/Intrusion Detection and Mitigation for Wireless Networks • Use statistics from MIB of AP to understand the current wireless network status – Metrics considered: capacity, transmission fail count, multiple retry count, duplicate count, received fragment count, etc. – Infer the wireless network status: congested ? Interfered ? • Automatically adapt to different learned profiles on observing status changes • Applicable to both WLAN and celluar network infrastructure protection 19

20 Intrusion Detection and Mitigation Attacks detected Mitigation Denial of Service (Do. S), SYN defender, SYN proxy, or SYN e. g. , TCP SYN flooding cookie for victim Port Scan and worms Ingress filtering with attacker IP Vertical port scan Quarantine the victim machine Horizontal port scan Monitor traffic with the same port # for compromised machine Spywares Warn the end users being spied

GRAID Sensor Architecture Normal flows Remote aggregated sketch records Sent out for aggregation Reversible k-ary sketch monitoring Streaming packet data Filtering Local sketch records Sketch based statistical anomaly detection (SSAD) Keys of suspicious flows 21 Part I Sketchbased monitoring & detection Keys of normal flows SIGCOMM 04 Suspicious flows Per-flow monitoring Signature -based detection Statistical detection Network fault detection Traffic profile checking Data path Control path Modules on the critical path Part II Intrusion or anomaly alarms to fusion centers Modules on the non-critical path Per-flow monitoring & detection

Research methodology Combination of theory, synthetic/real trace driven simulation, and real-world implementation and deployment 22

Potential Collaborative Research Areas with Motorola • Wireless virus/worm detection • Spyware detection • Both by operators at infrastructure level (e. g. , access point) • Intrusion detection and mitigation for cellular network infrastructure • Automatic attack responding and survival for Motorola infrastructure products 23

24 Thank You! More Questions?

25 Backup Slides

26 RF Management and Monitoring • • • (e. g. , Airespace) Rogue Access Point/Ad-Hoc networks RF Interference Fake Access Point AP Impersonation Spoofed Deauthenticate Frame Honeypot AP

27 Network Diagnosis and Fault Location • Infrastructure ossification led to thrust of overlay applications • Traceroute gives hop-by-hop round-trip latency – Asymmetric routing – Can’t get hop-by-hop loss rate ! • Network tomography – Infer the properties of links from end-to-end measurements – Limited measurements -> under-constrained system, 1’ unidentifiable links 1 1 2 – Existing work uses various constraints and assumptions » Tree-like topology » The number of lossy links is small

Our Approach: Virtual Links • Minimal link sequences (path segments) whose loss rates uniquely identified – Locate the faults to certain link(s) • The first lower-bound on the network tomography granularity • Use algebraic scheme to find virtual links – Leverage our work on overlay network monitoring (ACM SIGCOMM IMC 2003, ACM SIGCOMM 2004) 28

GRAID Sensor Architecture Normal flows Reversible k-ary sketch monitoring Streaming packet data Filtering Remote aggregated sketch records Sent out for aggregation Local sketch records Sketch based statistical anomaly detection (SSAD) Keys of suspicious flows 29 Part I Sketchbased monitoring & detection Keys of normal flows Statistical detection Suspicious flows Per-flow monitoring Signature -based detection Network fault detection Traffic profile checking Data path Control path Modules on the critical path Part II Intrusion or anomaly alarms to fusion centers Modules on the non-critical path Per-flow monitoring & detection

30 Intrusion/anomaly Alarm Fusion • Individual IDS has bad accuracy due to limited view • Crucial to collect information from multiple vantage points – distributed IDS (DIDS) – Each IDS generate local symptom report, send to sensor fusion center (SFC) • Help understand the prevalence, cause and patterns of global-scale attacks • Existing DIDS – Centralized fusion – Distributed fusion with unscalable communication

GRAID Sensor Interconnection • Though Cyber Attack Disease DHT Injected (distributed hash table) for Internet alarm fusion – Scalability – Load balancing – Fault-tolerance – Intrusion CDDHT correlation Mesh IDS + SFC 31 GRAID Coverage Attack Injected

32 Basic Operations of CDDHT • put (disease_key, symptom report) – Send report to SFC • attack_info = get (disease_key) – Query about certain attacks from SFC • Each operation only O(n) hops – n is the total number of nodes in CDDHT

33 CDDHT: Disease Key Design Intrusion ID Characterization Field(s) Do. S Attack 0 Victim IP (subnet) Scans 1 0 (for vertical & block scan) Source IP address Destination IP (for vertical scan) 0 (for block scan) 1 (for horizontal & Scan port Source IP (for horizontal scan) coordinated scan) number 0 (for coordinated scan) Viruses/Worms 2 0 (for known virus/worm) Worm ID 1 (for unknown virus/worm) Destination port number

34 Other Challenges of CDDHT • Load balancing • Supporting complicated queries – E. g. , aggregate queries • Attack resilience – OK to have some IDS sensors compromised – What about SFCs?

Conclusion for GRAID Systems • Online traffic recording and analysis on highspeed networks • Online statistical anomaly detection • Integrated approach for false positive reduction – Signature-based detection – Network element fault diagnostics – Traffic signature matching of emerging applications • Hardware speedup for real-time detection • Scalable anomaly/intrusion alarm fusion with distributed hash tables (DHT) 35