Evinrude. How to build a Petri Net-Based IDS from Program Sources. MeFoSyLoMa Meeting

Transcription

1 MeFoSyLoMa Meeting Jean-Baptiste Voron - LIP6 (UPMC) Fabrice Kordon - LIP6 (UPMC) Liviu Iftode - DiscoLab (Rutgers University) Evinrude How to build a Petri Net-Based IDS from Program Sources December 5th, Version 1.3b

2 Context: Intrusion Detection Computer System (network / program / OS) Signature-based detection (misuse detection) Behavior-based detection (anomaly detection) Looking for deviations from an expected behavior Limitation: parallel and distributed programs 2

3 Context: Intrusion Detection Computer System (network / program / OS) Signature-based detection (misuse detection) Behavior-based detection (anomaly detection) Looking for deviations from an expected behavior Limitation: parallel and distributed programs 2

4 Context: Intrusion Detection Events Computer System (network / program / OS) Events IDS Events Events Signature-based detection (misuse detection) Behavior-based detection (anomaly detection) Looking for deviations from an expected behavior Limitation: parallel and distributed programs 2

5 Context: Intrusion Detection Events Computer System (network / program / OS) Event Events IDS Events Events Signature-based detection (misuse detection) Behavior-based detection (anomaly detection) Looking for deviations from an expected behavior Limitation: parallel and distributed programs 2

6 Context: Intrusion Detection Events Expected Behavior Computer System (network / program / OS) Events IDS Events Events Signature-based detection (misuse detection) Behavior-based detection (anomaly detection) Looking for deviations from an expected behavior Limitation: parallel and distributed programs 2

7 Approach & Choices Build an Intrusion Detection System (IDS) Dedicated to a program & Behavior based Handle large and complex programs C programs (real-life programs) Multi Processes / Multi Threaded programs 1 2 Program Program s Behavior Intrusion Detection System 3

8 Approach & Choices Behavior modeling relies on Petri nets Used as state-space generators Construction process is fully automatic IDS is produced from program sources No formal background required for developers No code instrumentation (neither source nor binary) Hypothesis Operating System is considered healthy 4

9 From programs to models Several steps are required to produce a model Extract (relevant) information Transform it into Petri nets Optimize the net in order to produce the smallest one C CFO Petri net Petri net Offline Analysis inside(...) { if (...) { write; } else { close; } if (unlink) ;; function beaphilo # Block 0 : pred Entry, 2, 3 D = Parser Builder Optimization 5

10 From programs to models Several steps are required to produce a model Extract (relevant) information Transform it into Petri nets Optimize the net in order to produce the smallest one C CFO Petri net Petri net Offline Analysis inside(...) { if (...) { write; } else { close; } if (unlink) ;; function beaphilo # Block 0 : pred Entry, 2, 3 D = Online Analysis Monitor Parser Builder Optimization Code Generation 5

11 Monitoring Philosophers is pretty hard with standard IDS! Multi-threaded version Pthread library calls - Thread Management - Thread Synchronization 6

12 Monitoring Philosophers is pretty hard with standard IDS! Multi-threaded version int main (int argn, char **argv) { pthread_mutex_init(&foodlock,null); Pthread library calls // Forks... for (i = 0; i < PHILO; i++) { pthread_mutex_init(&fork[i],null); pthread_create(&p[i],null,philosopher,null); } - Thread Management - Thread Synchronization for (i = 0; i < PHILO; i++) { pthread_join(p[i],null); } 6

13 Monitoring Philosophers is pretty hard with standard IDS! Multi-threaded version int main (int argn, char **argv) { pthread_mutex_init(&foodlock,null); Pthread library calls // Forks... for (i = 0; i < PHILO; i++) { pthread_mutex_init(&fork[i],null); pthread_create(&p[i],null,philosopher,null); } - Thread Management - Thread Synchronization for (i = 0; i < PHILO; i++) { pthread_join(p[i],null); } void * philosopher () { int f; printf("philo is sitting down to dinner.\n"); while((f = food_on_table())) { pthread_mutex_lock(&fork_left); pthread_mutex_lock(&fork_right); printf("philo is eating.\n"); pthread_mutex_unlock(&fork_right); pthread_mutex_unlock(&fork_left); } printf("philo is done eating.\n"); pthread_exit(null); } 6

14 Monitoring Philosophers is pretty hard with standard IDS! Multi-threaded version int main (int argn, char **argv) { pthread_mutex_init(&foodlock,null); Pthread library calls // Forks... for (i = 0; i < PHILO; i++) { pthread_mutex_init(&fork[i],null); pthread_create(&p[i],null,philosopher,null); } - Thread Management int food_on_table () { static int food = FOOD; int myfood; - Thread Synchronization for (i = 0; i < PHILO; i++) { pthread_join(p[i],null); } void * philosopher () { int f; printf("philo is sitting down to dinner.\n"); while((f = food_on_table())) { pthread_mutex_lock(&fork_left); pthread_mutex_lock(&fork_right); printf("philo is eating.\n"); pthread_mutex_unlock(&fork_right); pthread_mutex_unlock(&fork_left); } printf("philo is done eating.\n"); pthread_exit(null); } pthread_mutex_lock(&foodlock); if (food > 0) { food--; } myfood = food; pthread_mutex_unlock (&foodlock); return myfood; } 6

15 C CFO Parser Builder Optimizer Extracting Information Use of GCC to extract information During the compilation No need to modify the MakeFile (just set ENV variable) Use of Extended Control Flow Graph (ECFG) TU Source Code GCC CFG CFG Parser Control Flow Objects GPL Parser module 7

16 C CFO Parser Builder Optimizer Dealing with Perspectives All extracted information is not relevant for analysis However, structural information is systematically extracted Need a flexible way to analyse source: Perspectives Based on a dictionary of remarkable elements Set of transformations Source Code GCC CFG Parser 8

17 C CFO Parser Builder Optimizer Dealing with Perspectives All extracted information is not relevant for analysis However, structural information is systematically extracted Need a flexible way to analyse source: Perspectives Based on a dictionary of remarkable elements Set of transformations Source Code GCC CFG Parser struct information set St 8

18 C CFO Parser Builder Optimizer Dealing with Perspectives All extracted information is not relevant for analysis However, structural information is systematically extracted Need a flexible way to analyse source: Perspectives Based on a dictionary of remarkable elements Set of transformations Source Code GCC CFG Parser struct information set thread information set St Th Sy syscall information set Perspective s definition (XML) 8

19 C CFO Parser Builder Optimizer Dealing with Perspectives All extracted information is not relevant for analysis However, structural information is systematically extracted Need a flexible way to analyse source: Perspectives Based on a dictionary of remarkable elements Set of transformations Source Code GCC CFG Parser struct information set thread information set Builder St Th Sy syscall information set Perspective s definition (XML) 8

20 C CFO Parser Builder Optimizer Perspectives & Philosophers Perspective s descriptions (XML) St Th Sy Source Code GCC CFG Parser void * philosopher () { int f; printf("philo is sitting down to dinner.\n"); while((f = food_on_table())) { pthread_mutex_lock(&fork_left); pthread_mutex_lock(&fork_right); printf("philo is eating.\n"); pthread_mutex_unlock(&fork_right); pthread_mutex_unlock(&fork_left); } printf("philo is done eating.\n"); pthread_exit(null); } 9

21 C CFO Parser Builder Optimizer Perspectives & Philosophers Perspective s descriptions (XML) GCC St Th Sy CFG Parser Source Code 1. ;; Function philosopher 2. # BLOCK 2 3. # PRED:ENTRY(fallthru) 4. printf(&"philosopher goto <bb 4> (<L1>); 6. # SUCC:4(fallthru) 7. # BLOCK 3 8. # PRED: 4 (true) 9. pthread_mutex_lock(&fork3); 10. pthread_mutex_lock(&fork1); 11. printf(&"philosopher pthread_mutex_unlock(&fork3); 13. pthread_mutex_unlock(&fork1); 14. # SUCC:4(fallthru) 15. # BLOCK # PRED:2(fallthru) 3(fallthru) 17. D.3892 = food_on_table(); 18. f = D.3892; 19. if (f!= 0) goto <L0>; else goto <L2>; 20. # SUCC:3(true) 5(false) 21. # BLOCK # PRED:4(false) 23. printf(&"philosopher pthread_exit (0B); 25. # SUCC:EXIT ECFG 9

22 C CFO Parser Builder Optimizer Perspectives & Philosophers Perspective s descriptions (XML) GCC St Th Sy CFG Parser Struct set Source Code 1. ;; Function philosopher 2. # BLOCK 2 3. # PRED:ENTRY(fallthru) 4. printf(&"philosopher goto <bb 4> (<L1>); 6. # SUCC:4(fallthru) 7. # BLOCK 3 8. # PRED: 4 (true) 9. pthread_mutex_lock(&fork3); 10. pthread_mutex_lock(&fork1); 11. printf(&"philosopher pthread_mutex_unlock(&fork3); 13. pthread_mutex_unlock(&fork1); 14. # SUCC:4(fallthru) 15. # BLOCK # PRED:2(fallthru) 3(fallthru) 17. D.3892 = food_on_table(); 18. f = D.3892; 19. if (f!= 0) goto <L0>; else goto <L2>; 20. # SUCC:3(true) 5(false) 21. # BLOCK # PRED:4(false) 23. printf(&"philosopher pthread_exit (0B); 25. # SUCC:EXIT 9

23 C CFO Parser Builder Optimizer Perspectives & Philosophers Perspective s descriptions (XML) GCC St Th Sy CFG Parser Struct set Thread set Source Code 1. ;; Function philosopher 2. # BLOCK 2 3. # PRED:ENTRY(fallthru) 4. printf(&"philosopher goto <bb 4> (<L1>); 6. # SUCC:4(fallthru) 7. # BLOCK 3 8. # PRED: 4 (true) 9. pthread_mutex_lock(&fork3); 10. pthread_mutex_lock(&fork1); 11. printf(&"philosopher pthread_mutex_unlock(&fork3); 13. pthread_mutex_unlock(&fork1); 14. # SUCC:4(fallthru) 15. # BLOCK # PRED:2(fallthru) 3(fallthru) 17. D.3892 = food_on_table(); 18. f = D.3892; 19. if (f!= 0) goto <L0>; else goto <L2>; 20. # SUCC:3(true) 5(false) 21. # BLOCK # PRED:4(false) 23. printf(&"philosopher pthread_exit (0B); 25. # SUCC:EXIT 9

24 C CFO Parser Builder Optimizer Perspectives & Philosophers Perspective s descriptions (XML) GCC St Th Sy CFG Parser Struct set Thread set Syscall set Builder Source Code 1. ;; Function philosopher 2. # BLOCK 2 3. # PRED:ENTRY(fallthru) 4. printf(&"philosopher goto <bb 4> (<L1>); 6. # SUCC:4(fallthru) 7. # BLOCK 3 8. # PRED: 4 (true) 9. pthread_mutex_lock(&fork3); 10. pthread_mutex_lock(&fork1); 11. printf(&"philosopher pthread_mutex_unlock(&fork3); 13. pthread_mutex_unlock(&fork1); 14. # SUCC:4(fallthru) 15. # BLOCK # PRED:2(fallthru) 3(fallthru) 17. D.3892 = food_on_table(); 18. f = D.3892; 19. if (f!= 0) goto <L0>; else goto <L2>; 20. # SUCC:3(true) 5(false) 21. # BLOCK # PRED:4(false) 23. printf(&"philosopher pthread_exit (0B); 25. # SUCC:EXIT 9

25 C CFO Parser Builder Optimizer Building (small) Petri Nets Production rules : Source to Petri net patterns Each perspective comes with its own production rules - 7 rules to build the structural model - 6 for Thread perspective / 6 for Process Management perspective Each information set is transformed into a Petri net Struct information set gives Structural Model Others give submodels to be plugged to the structural one 10

26 C CFO Parser Builder Optimizer Philos R Nets (still small) Entry Struct Model Exit 11

27 C CFO Parser Builder Optimizer Philos R Nets (still small) 2_1 Entry [printf] 2 3_11 4 [printf] 5 3 5_23 [printf] Exit Syscall Models 11

28 C CFO Parser Builder Optimizer Philos R Nets (still small) 2_1 Entry 3_9 [printf] 2 [v=free] fork_1 <v> <lock> 3_13 3_11 4 fork_1 <v> <free> [printf] 3_ [v=free] fork_3 <v> <lock> 5_23 3_12 <v> fork_3 [printf] Exit <free> Thread Models 11

29 C CFO Parser Builder Optimizer Building (big) Petri Nets Merge all subnets into the structural model Find the right order thanks to the ECFG metadata Traceability of the origin of Petri nets elements Manage all specificities of Petri nets to produce correct nets - Color classes / Color domains - Initial marking One net for each main function Potentially several nets for large applications - When composed of several executables (start / stop / status...) 12

30 One philosopher [printf] 0_Entry 0_Exit 0_4 fork_3 <v> <free> <v> <lock> [v=free] <v> <lock> [v=free] fork_1 <free> <v> CFO C Parser Builder Optimizer [printf] 0_2_1_pre 0_2_1_post struct_0_2_4 struct_0_entry_2 [printf] 0_5_23_pre 0_5_23_post sys_0_5_23_printf sys_0_2_1_printf struct_0_5_exit 0_3_9_pre th_0_3_9_lock th_0_3_10_lock 0_3_10_pre 0_3_11_pre sys_0_3_11_printf 0_3_13_pre th_0_3_13_unlock th_0_3_12_unlock 0_3_12_pre struct_0_3_4 struct_0_4_3 0_3_13_post struct_0_4_5

31 C CFO Parser Builder Optimizer One philosopher... 0_Entry struct_0_entry_2 Use of standard structural reductions 0_3_9_pre 0_2_1_pre sys_0_2_1_printf [printf] th_0_3_9_lock [v=free] 0_3_10_pre <v> <lock> <v> 0_2_1_post 0_3_11_pre [v=free] <lock> 0_5_23_pre struct_0_2_4 0_4 struct_0_4_3 [printf] sys_0_3_11_printf th_0_3_10_lock 0_3_12_pre <v> fork_3 <v> fork_1 sys_0_5_23_printf [printf] 0_5_23_post struct_0_4_5 struct_0_3_4 th_0_3_12_unlock 0_3_13_pre <free> struct_0_5_exit th_0_3_13_unlock <free> 0_Exit 0_3_13_post 13

32 C CFO Parser Builder Optimizer One philosopher... 0_Entry struct_0_entry_2 Use of standard structural reductions 0_3_9_pre 0_2_1_pre sys_0_2_1_printf [printf] th_0_3_9_lock [v=free] 0_3_10_pre <v> <lock> <v> 0_2_1_post 0_3_11_pre [v=free] <lock> 0_5_23_pre struct_0_2_4 0_4 struct_0_4_3 [printf] sys_0_3_11_printf th_0_3_10_lock 0_3_12_pre <v> fork_3 <v> fork_1 sys_0_5_23_printf [printf] 0_5_23_post struct_0_4_5 struct_0_3_4 th_0_3_12_unlock 0_3_13_pre <free> struct_0_5_exit 0_Exit th_0_3_13_unlock <free> 0_3_13_post cannot be optimized cannot be optimized eligible for optimization 13

33 C CFO Parser Builder Optimizer Offline Analysis Some basic properties can be checked before runtime Structural properties Dead code / Infinite loops Reachability properties Dead code / Deadlock Causal properties Starvation / Race Condition User-specified: Can a read occurs on a file after I closed it 14

34 From Models to Monitor Objective : building a dedicated program monitor User Process System Call Kernel System 15

35 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! User Process Monitor System Call Kernel System 15

36 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! User Process Monitor System Call Kernel System 15

37 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! User Process Monitor System Call 3 Behavior Container States Container Kernel System Embed the Petri net built during previous phase 15

38 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! 1 Sensors User Process Monitor System Call 3 Behavior Container States Container Kernel System Embed the Petri net built during previous phase 15

39 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! 1 System Call Sensors System Call System Call User Process Monitor System Call 3 Behavior Container States Container Kernel System Embed the Petri net built during previous phase Catch events related to the program execution 15

40 From Models to Monitor Objective : building a dedicated program monitor Raise alarm when bad behaviors occur! 1 System Call Sensors System Call System Call User Process Monitor 2 Firing Manager System Call 3 Behavior Container States Container Kernel System Embed the Petri net built during previous phase Catch events related to the program execution Compare real events to expected events 15

41 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

42 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

43 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit o Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

44 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

45 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit r Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

46 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

47 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round 0_Exit o Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

48 Playing with Nets All transitions can consume tokens from pool place Execution is divided into rounds Catching an event = beginning of a round When the pool place is empty = end of a round The pool place must be empty before beginning a new round! 0_Exit o Pool place Event Color open o read write r w 0_Entry [open] 0_2 close exit c e [read] 0_4 [write] 0_5 [close] 0_6 16

49 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r write w 0_Exit Pool place close exit c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

50 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit Pool place write close exit w c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

51 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit Pool place write close exit w c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

52 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit Pool place write close exit w c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

53 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit o Pool place write close exit w c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

54 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit Pool place write close exit w c e 0_Entry [open] 0_2 [read] 0_4 [write] 0_5 [close] 0_6 17

55 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit Pool place write close exit w c e 0_Entry [open] 0_2 Return adress has been replaced during the attack! [read] 0_4 [write] 0_5 [close] 0_6 17

56 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit r Pool place write close exit w c e 0_Entry [open] 0_2 Return adress has been replaced during the attack! [read] 0_4 [write] 0_5 [close] 0_6 17

57 Playing with Nets & Stack! Not sufficient to handle mimicry attacks Attacks that mimic a correct behavior but doing bad things - System call sequence of these attacks is correct - Introduce anomalies into call stack Event open read Color o r Current Stack State 0_Exit r Pool place write close exit w c e 0_Entry [open] 0_2 Return adress has been replaced during the attack! [read]! 0_4 [write] 0_5 [close] 0_6 17

58 Implementation: Evinrude Needs GCC Written in Java Evinrude Provide flexibility API Multi-platform Well known by engineers 18

59 Implementation: Evinrude Needs GCC Written in Java Can be plugged to Coloane GUI for C-AMI platform View / Edit / Save models Evinrude Coloane Provide flexibility API Multi-platform Well known by engineers 18

60 Implementation: Evinrude Needs GCC Written in Java Can be plugged to Coloane Evinrude Tools GUI for C-AMI platform View / Edit / Save models Provide flexibility API Multi-platform Well known by engineers Coloane C-AMI Check Petri nets syntax Allow offline analysis 18

61 Implementation: Evinrude Needs GCC Written in Java Can be plugged to Coloane Evinrude IDS Dynamic Library LD_PRELOAD Export before run Tools GUI for C-AMI platform View / Edit / Save models Provide flexibility API Multi-platform Well known by engineers Coloane C-AMI Check Petri nets syntax Allow offline analysis 18

62 Conclusion Automatic construction of a program dedicated IDS Select subset of information: Perspective mechanism Use the same model for both offline & online analysis WYCIWYC : What You ve Checked is What You ll Check Evinrude has already produced models for: Before reduction After reduction GZip 842 / 1119 / / 165 / 498 Wu-FTPD 4132 / 5331 / / 963 / 3018 LigHTTPd 3403 / 4264 / / 761 / 2392 places / transitions / arcs 19

63 Questions? Thank you for your attention... 20