A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. We discuss the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. We examine a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics. We discuss the key practical issues of "cold start" and attacks on the normalizer, and develop a methodology for systematically examining the ambiguities present in a protocol based on walking the protocol's header. We then present norm, a publicly available user-level implementation of a normalizer that can normalize a TCP traffic stream at 100,000 pkts/sec in memory-to-memory copies, suggesting that a kernel implementation using PC hardware could keep pace with a bidirectional 100 Mbps link with sufficient headroom to weather a high-speed flooding attack of small packets.

/pdf/network-intrusion-detection-evasion-traffic-normalization-4ygey5zbcg.pdf

Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Two Formal Analyses of Attack Graphs

A review of cyber security risk assessment methods for SCADA systems

Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments

Flow monitoring has become a prevalent method for monitoring traffic in high-speed networks By focusing on the analysis of flows, rather than individual packets, it is often said to be more scalable than traditional packet-based traffic analysis Flow monitoring embraces the complete chain of packet observation, flow export using protocols such as NetFlow and IPFIX, data collection, and data analysis In contrast to what is often assumed, all stages of flow monitoring are closely intertwined Each of these stages therefore has to be thoroughly understood, before being able to perform sound flow measurements Otherwise, flow data artifacts and data loss can be the consequence, potentially without being observed This paper is the first of its kind to provide an integrated tutorial on all stages of a flow monitoring setup As shown throughout this paper, flow monitoring has evolved from the early 1990s into a powerful tool, and additional functionality will certainly be added in the future We show, for example, how the previously opposing approaches of deep packet inspection and flow monitoring have been united into novel monitoring approaches

/pdf/flow-monitoring-explained-from-packet-capture-to-data-55ebj7g9hl.pdf

Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX

Traffic measurements are becoming increasingly complex due to the variety of traffic types and the integration of different network media. Although traditional tools such as sniffers and network probes are still useful for traffic measurement, they often limit their scope to network packet analysis and visualization. This means that human operators need to manually perform specific actions when some anomalous traffic conditions happen since they have very limited, if any, support from the above tools. This article covers the design and implementation of ntop, an open-source Web-based traffic measurement and monitoring application. It enables users to track relevant network activities including traffic characterization, network utilization, network protocol usage, and congestion detection. Ntop's extensibility through dynamically loadable software components opens it to extensions by network administrators. In addition, its native security flaw detection facilities allow ntop to detect potentially dangerous traffic conditions, and hence to dynamically and autonomously adapt network configuration to tackle the identified problems.

Effective traffic measurement using ntop

Network management platforms provide flexible facilities for setting up custom applications able to detect network anomalies on a specific environment. This is because each network is made of users, services and computers with a specific behaviour that is then reflected in the generated network traffic. Goal of this paper is to show that in every network there are some global variables that can be profitably used for detecting network anomalies, regardless of the type of network users and equipment. As most of the relations among these variables are fixed, this paper shows that it is possible to define generic network rules aimed to automatically detect selected network anomalies. Finally, it covers the design and implementation of an open-source application used to effectively validate this work on a large campus network. 1 Background and Motivation This paper focuses on network-based intrusion detection and it explores a different approach to the problem. Intrusion detection techniques can be categorised into signature detection and anomaly detection [1][2]. Signature detection systems use patterns of well-known attacks or weak spots of the system to match and identify known intrusions. They perform a pattern matching between network traffic captured and attack signature. If the matching succeds, then the system generates an alarm. The main advantage of signature detection paradigm is that it can accurately and efficiently detect instances of known attacks. The main disadvantage is that it lacks the ability to detect the newly

http://senseslab.di.uniroma1.it/administrator/components/com_jresearch/files/publications/DesignAndImplementationOfAnAnomalyDetectionSystemAnEmpiricalApproach.pdf

Design and Implementation of an Anomaly Detection System: an Empirical Approach

Risk management is a process that includes several steps, from vulnerability analysis to the formulation of a risk mitigation plan that selects countermeasures to be adopted. With reference to an information infrastructure, we present a risk management strategy that considers a sequence of hierarchical models, each describing dependencies among infrastructure components. A dependency exists anytime a security-related attribute of a component depends upon the attributes of other components. We discuss how this notion supports the formal definition of risk mitigation plan and the evaluation of the infrastructure robustness. A hierarchical relation exists among models that are analyzed because each model increases the level of details of some components in a previous one. Since components and dependencies are modeled through a hypergraph, to increase the model detail level, some hypergraph nodes are replaced by more and more detailed hypergraphs. We show how critical information for the assessment can be automatically deduced from the hypergraph and define conditions that determine cases where a hierarchical decomposition simplifies the assessment. In these cases, the assessment has to analyze the hypergraph that replaces the component rather than applying again all the analyses to a more detailed, and hence larger, hypergraph. We also show how the proposed framework supports the definition of a risk mitigation plan and discuss some indicators of the overall infrastructure robustness. Lastly, the development of tools to support the assessment is discussed.

Hierarchical Model Based Risk Management of Critical Infrastructures

Today's networks present several management challenges due to the variety of network types and the integration of different network media. Network administrators need automated tools to support human effort, gathering information about the status and behaviour of network elements. Network monitoring is probably the most fundamental aspect of automated network management. The goal of this paper is to describe the design and implementation of ntop a simple, open-source, portable traffic measurement and monitoring tool, which supports various management activities, including network optimisation and planning, and detection of network security violations. In addition, it describes some scenarios where ntop can be effectively used for identifying common network problems as well as detecting intruders and security violations.

Monitoring networks using ntop

The task of network management is becoming increasingly complex due to the increasing number of networked computers running different operating systems and speaking various network protocols. Most of network monitoring and diagnostic tools such as ping and traceroute are suitable just for tackling simple connectivity problems. Complex network problems often need to be addressed using rather expensive management tools or probes affordable only by mid-large companies.

This paper covers the design and the implementation of ntop, an open-source web-based network usage monitor that enables users to track relevant network activities including network utilisation, established connections, network protocol usage and traffic classification. ntop's portability across various platforms, its support of many network media, ease of use and lightweight CPU utilisation makes it suitable for people who want to monitor their network without having to adopt a sophisticated yet expensive management platform.

/pdf/ntop-beyond-ping-and-traceroute-10h8unyn6d.pdf

S. Suin

Papers

Effective traffic measurement using ntop

Design and Implementation of an Anomaly Detection System: an Empirical Approach

Hierarchical Model Based Risk Management of Critical Infrastructures

Monitoring networks using ntop

Ntop: Beyond ping and traceroute