Design and Implementation of a Stateful High Speed Intrusion Detection System

隨著網路的普及，許多個人生活及企業運作都與網路息息相關。然而，近年來系統弱點突破以及攻擊行為都有日益增多的現象，使得網路安全越來越受到重視。 入侵偵測系統(IDS)因為能夠即時偵測攻擊行為以及做出適當的防範措施，在網路安全領域具有相當高的重要性。在現行的系統中，規則式(Rule-based)技術最為常見。然而傳統的規則式入侵偵測系統將每個封包視作獨立個體，分別比對每條規則來偵測攻擊行為。此種不記憶狀態(stateless, memoryless)的偵測方式已無法偵測今日越來越複雜的攻擊行為。 因此，我們設計了狀態化高速入侵偵測系統。針對日益普遍的狀態化的應用層協定(stateful application protocol)，我們提出了狀態化應用層檢測(application layer stateful inspection)來完整瞭解網路行為及偵測複雜的攻擊行動。此外，我們也觀察到今日的攻擊行為大多採取多步驟的攻擊方式。為了能夠瞭解此種攻擊的行為模式，以及提供有效的偵測，我們設計了多步驟事件關聯(Multi-staged Event Correlation)。並且我們將此雛形系統實作在系統單晶片(SoC)的環境下，利用硬體加速字串比對模組功能以提高整體系統效能。根據實驗評估，我們系統不論在處理速度以及偵測能力上都超越Snort的表現。As technologies are greatly advanced, more and more individuals and companies rely on Internet for communication and business. However, with the continuous disclosure of vulnerabilities associated with computers and network systems, network security has become an increasing important issue. Intrusion Detection System (IDS) plays an important role in addressing these security problems by providing timely identification of potential attacks and effective responses. Among IDSs currently available, rule-based technique is most popular due to the convenience in inserting or modifying rules incrementally for newly discovered intrusions. However, traditional IDS used a stateless approach in which network traffic is inspected packet by packet and compared with numerous rules to identify possible attacks. With the growing popularity and variety of intrusions, these simple pattern-matching techniques may not be sufficient to detect sophisticated attacks. Thus, we consider that there is a need to develop a stateful IDS for high speed network. We adopt the idea of stateful inspection that continuously inspects content of packets with memory of related ones and maintains the current “state” information to detect and analyze intrusions in an integrated way. Besides stateful TCP inspection, we also provide application layer stateful inspection to understand the complete network behavior. Moreover, we thoroughly study on multi-staged event correlation and proposed an approach to fully realize and effectively detect multi-stage attacks. Furthermore, we implement the prototype system on a System-on-a-Chip (SoC) and offload CPU-intensive string matching function to the FPGA based hardware component to boost the performance. Through intensive evaluations, our designed IDS is shown outperforming snort in terms of effective and efficiency.謝詞 I 論文摘要 II THESIS ABASTRACT III Contents IV List of Tables VII List of Figures VIII Chapter 1 Introduction 1 1.1. Intrusion Detection System 1 1.2. Motivation 2 1.3. Goal 6 1.4. Thesis Organization 6 Chapter 2 Literature Survey 7 2.1 Stateful Intrusion Detection System 7 2.1.1. Snort 7 2.1.2. State Transition Analysis Technique (STAT) 9 2.1.3. Bro 10 2.2 Hardware-based Intrusion Detection System 12 2.2.1. Hardware-based TCP/IP Content Scanning System 12 2.2.2. Hardware-based Network Node IDS (NNIDS) 14 2.3 Event Correlation 15 2.3.1. Alert Correlation by Similarity 16 2.3.2. Alert Correlation by Prerequisites and Consequences 17 2.3.3. Alert Correlation by Attack Graphs 18 2.3.4. Active Event Correlation 20 Chapter 3 Design of Stateful High Speed Intrusion Detection System 22 3.1 Stateful Inspection 22 3.2 Efficient Rule-matching 26 3.3 Event Correlation 27 Chapter 4 Multi-staged Event Correlation 29 4.1 Lifespan of Correlated Intrusion Events 29 4.2 Example Attacks 32 4.2.1. Sadmind DDoS 32 4.2.2. Sasser Worm 33 4.2.3. Netsky Worm 35 4.3 Characterization of Multi-stage Attack 36 4.4 Multi-staged Event Correlation 38 Chapter 5 Prototype Intrusion Detection System 40 5.1 Development Environment 40 5.2 Software Architecture 41 5.2.1. Cooperation of Rule-matching, State Transition Update, and Event Correlation 44 5.2.2. Implementation of Rule Matching Module 45 5.2.3. Protocol Finite State Machines 52 5.3 Hardware Architecture 59 5.3.1. Block RAM Design 60 5.3.2. String Matching Procedure 62 5.3.3. Performance Evaluation of Hardware Implementation 63 Chapter 6 Performance Evaluation 65 6.1 Evaluation Environment 65 6.2 Evaluation of Efficiency 66 6.2.1. UDP Throughput 66 6.2.2. TCP Throughput 69 6.2.3. FTP Throughput 71 6.3 Evaluation of Effectiveness 71 6.3.1. LLDOS 1.0 72 6.3.2. LLDOS 2.0.2 75 Chapter 7 Conclusion and Future Work 76 References 78 簡歷 8