Distilling Network Activity at Scale

Transcription

1 Distilling Network Activity at Scale Robin Sommer! International Computer Science Institute 2014 ARO-MURI on

2 ! Adding a Global Vantage Point to the Local Mission 2

3 The Global SSL Landscape 3

4 Recap: ICSI SSL Notary A global perspective on the SSL ecosystem. External SSL Servers Data Provider ICSI Outgoing Sessions Bro Database Certificates Internal SSL Clients Notary DNS *.notary.icsi.berkeley.edu Client Client Client 4

5 Notary Statistics > 2.3M certificates > 90B connections > 200M requests 5

6 Notary Updates Dynamics of SSL Trust Relationships! Extremely hard to identify malicious anomalies! Heartbleed analysis! Tracked certificate replacements over time! Google/Akamai patched 12/5 days ahead of release! Android root store analysis! Usage of certificates used in practice! Understand impact of vulnerabilities! Poodle: Measure SSLv3 deployments! GnuTLS: Scanning notary for problematic certificates; test server! Major rewrite of the Bro s SSL/TLS analyzer! Lots more data extracted; rolling out to data providers now! 6

7 Distributed Summary Statistics for Network Profiling! 7

8 Summary Statistics Applications! Network profiling! Statistical anomaly detection! Objectives! Simple, yet flexible user interface! Data agnostic! Extensible! Real-time processing! Scalable 8

9 Distributed Architecture Observation Reducer Statistical Framework Results & Outputs Sensor 1 Observation Reducer Result Tap Observation Reducer Result Values Notify & Poll Master Merger Result Summary Statistics Sensor n Predicate Tap Observation Reducer Result Observation Reducer Result Notify & Poll Values Merger Result Trigger Operations sum, avg, stddev, var, max, min, unique, top-k, sample 9

10 Evaluating Bro Implementation Probability density base load using top k using scan CPU utilization 10

11 Usage Case Studies! Brute-force login detection! SQL injection detector! Traceroute detection! Top-traffic sources and sinks! Traffic matrix! Real-time visualization! Mozilla:! HTTP brute-force detector (401 ratio)! TLS ciphers & protocols! Excessive errors! Top 100 ports! Per /24 subnet statistics (src/dst/volume) 11

12 Monitoring Enterprise Networks 12

13 Creating Visibility MySQL login tfoerste ok rows: 0! query create table foo (id BIGINT( 10 ) UNSIGNED NOT! query insert into foo (animal, name) values ("dog",! query insert into foo (animal, name) values ("cat",! query select * from foo ok rows: 3! SMB Parsers for Enterprise Protocols MySQL, Kerberos, SMB, Modbus, DNP3, BACnet SESSION_SETUP_ANDX NTLMSSP_AUTHENTICATE TEST\Administrator TREE_CONNECT_ANDX - \\ \GOOGLE SUCCESS A:! TRANSACTION2 GET_DFS_REFERRAL \ \Google TREE_CONNECT_ANDX - \\ \IPC$ SUCCESS! NT_CREATE_ANDX - \srvsvc SUCCESS TEST\Administrator Modbus DIAGNOSTICS! REPORT_SLAVE_ID! READ_COILS! READ_HOLDING_REGISTERS! WRITE_SINGLE_REGISTER 13

14 Monitoring Water Treatment Plants PLC Controller /! Human Machine Interface! Testbed setup: Water tank with heater 14

15 Prediction Models Autoregression: Shewart control limits: {L min, L max } 15

16 Real-World Environments Two real-life water treatment plants that serve a total of about one million people in two urban areas. Data: Site 1: 3 days (64 GB, 7 PLCs) Site 2: 14 days (101 GB, 3 PLCs) PLC project files We see between 135 and 3500 process variables per PLC. 16

17 Tech Transfer with Bro Tracking assets! Software/applications, services, devices, certs, hosts! Input & Intelligence frameworks! Enables dynamic integration of external intelligence! Protocol support! Modbus, DNP3, RADIUS, MySQL, SMB, Kerberos (pending)! Lots of SSL updates! Real-time file analysis! Summary Statistics framework 17

18 Next Steps Notary! What-if studies! Extend data collection! Industrial Control Systems! Building automation & energy networks! Semantic policies for SMB! Security vs. Safety! Broker! A novel communication framework for distributed monitoring 18