[ Pobierz całość w formacie PDF ]
tection probabilities can eliminate the stealthy advantage
tremely fortunate in the degree of restraint demonstrated
of slow worms and thus the incentive for deploying them.
by worm authors. Thus the need for an adequate defense
against future worm episodes is self-evident.
7.4 Containment
In this paper, we have described an approach for real-
Our current system reports the suspected worm signa- time detection of unknown worms and automated extrac-
tures, but can be configured to generate Snort signatures tion of unique content signatures. Our content sifting al-
in a few seconds which can then be blocked by an online gorithm efficiently analyses network traffic for prevalent
Snort deployment. We have been doing so on a small and widely dispersed content strings behavioral cues of
scale on a laboratory switch, and the system has blocked worm activity. We have demonstrated that content sifting
worm traffic based on the signatures we feed the blocker. can be implemented with moderate memory and com-
Unfortunately, the policy for applying such a contain- putational requirements and our untuned software-based
ment strategy can be quite complex. For example, since prototype has been able to process over 200Mbps of live
there is an inherent tradeoff between detection speed and traffic. While the security field is inherently an arms
false positives, as we discussed earlier, one reasonable race , we believe that systems based on content sifting
policy is to temporarily rate-limit traffic matching signa- significantly raise the bar for worm authors. To wit, in
tures with only moderate address dispersion. If the sig- our experience Earlybird has been able to detect and ex-
nature is a false positive then it likely will never reach tract signatures for all contemporary worms and has also
a higher level of dispersion and the rate-limit can be re- demonstrated that it can extract signatures for new, pre-
pealed. If it is a worm, then this conservative reaction viously unknown, worms.
will slow its spread and once its dispersion increases to a While we believe that EarlyBird can be a useful sys-
higher level the system can decide to drop all packets car- tem in itself, we believe that the underlying method
rying the signature. However, this is just one such policy (maintaining state keyed by content signatures) may gen-
option and the question deserves additional attention. eralize to address a number of other interesting research
Moreover, automated containment also provokes the problems. For example, we have found that slight mod-
issue of attackers purposely trying to trigger a worm de- ifications to Earlybird are able to detect large amounts
fense thereby causing denial-of-service on legitimate of unsolicited bulk e-mail (SPAM) based on the same
traffic also carrying the string. Thus, a clear area of re- general principles as worm detection. Similarly, mass-
search for us is to develop efficient mechanisms for com- intrusion attempts can also be revealed by this approach,
paring signatures with existing traffic corpus to un- as can denial-of-service attacks and peer-to-peer system
derstand the impact of filtering such traffic before we do activity.
so. However, even this approach may fall short against Finally, the EarlyBird system demonstrates the fea-
a sophisticated attacker with prior knowledge of an un- sibility of sophisticated wire-speed network security.
released document. In this scenario an attacker might While many industrial systems have only recently an-
coerce Earlybird into blocking the documents release by nounced signature detection at Gigabit speeds, our ex-
simulating a worm containing substrings unique only to perience with Earlybird suggests that signature learning
the unreleased document. at Gigabit speeds is equally viable. This leads us to hope
that other components of network security may also per- reconfigurable hardware. In Proceedings of the Military and
Aerospace Programmable Logic Device Conference, Sept. 2003.
mit wire-speed implementation and allow security func-
[ Pobierz całość w formacie PDF ]