The Internet Motion Sensor: A Distributed Blackhole Monitoring System

1. The Internet Motion Sensor: A Distributed Blackhole Monitoring System Authors: Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson Publication: Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2005. Presenter: Brad Mundt for CAP6133 Spring ‘08

2. Motivation • Stability and integrity of national infrastructure • Rapid moving threats • Worms • DDOS • Routing Exploits • Globally scoped • No geographic or topological boundaries • Evolutionary threats

3. Monitoring • Dark address space • No legitimate hosts • Misconfiguration • Attack • Challenges • Sensor coverage • Service emulation

4. Internet Monitoring System (IMS) • Distributed globally scoped Internet threat monitoring system • Sensor network • Lightweight responder • Payload signature and caching

5. IMS Architecture

6. Sensor Network • Designed to measure, characterize, and track • Less in-depth information • Increase global threat visibility • Wide and distributed address blocks • 28 distinct monitored blocks • 18 physical installations • Query system to connect all sensors • Beyond scope of the paper

7. Lightweight responder • Get responses across ports without application related information • Service agnostic: Responds to SYN requests on all ports • In UDP connection, payload can arrive in first packet • In TCP connections, payload arrives after connection

8. Lightweight responderInfection responses by target

9. Lightweight responder • Passive aspect captures UDP based attacks • Active aspect initiates TCP connection • Elicits payload to differentiate traffic • Many threats use same ports • IMS responds to SYN requests on all ports

10. Lightweight responderDifferentiate Services

11. Hashing and caching • MD5 hash the packet payload • If new • Add hash to DB • Cache payload for analysis • If already seen • Log • Also good for metrics

12. Metrics • Worm behaviors • Virulence • Demographics • Propagation • Community Reponse • Scanning • DDOS

13. Worm lifecycle

14. Worm presence

15. Scanning

16. DDOS

17. Summary • A globally scoped Internet monitoring system • Wide, dark address monitoring • Blackhole networking • Three components • Distributed Monitoring Infrastructure • Lightweight Active Responder • Payload Signatures and Caching

18. Contributions • A wider scope IMS in dark address blocks • Layer 3 lightweight responder • Unique payload caching by hashing

19. Weaknesses • Limited analysis from the lightweight responder • No layer 7 information, all layer 3 • Sensors could be identified • Fingerprinted • Blacklisted

20. How to Improve • Anti-fingerprinting techniques • Sensor rotation • Source squelching • Blackhole masking with simulated hosts and topology • Hybrid system • Combine host-based sensors with wide address space monitors • Additional techniques for characterizing attackers • OS fingerprinting • Firepower calculations

21. The End Thank you…