330 likes | 439 Views
New Opportunities for Load Balancing in Network-Wide Intrusion Detection Systems. Victor Heorhiadi , Michael K. Reiter, Vyas Sekar. UNC Chapel Hill UNC Chapel Hill Stony Brook U. Network Intrusion Detection Systems. Popular way to detect attacks Bro & Snort are common software packages
E N D
New Opportunities for Load Balancing in Network-Wide Intrusion Detection Systems Victor Heorhiadi, Michael K. Reiter, VyasSekar UNC Chapel Hill UNC Chapel Hill Stony Brook U
Network Intrusion Detection Systems • Popular way to detect attacks • Bro & Snort are common software packages • Scan network packets for known attacks • Types of analysis: • Deep packet inspection • Signature matching • Scan detection
NIDS Deployments Today N1 N2 N3 N5 N4
Prior Work: On Path Distribution N1 N2 N3 N5 N4 Does not go far enough
Asymmetric Routing Challenge N3 N1 Forward Flow N2 N4 N5 Reverse Flow
Our Work • Generalized network-wide NIDS architecture • Solves the scaling challenge • Solves the asymmetry problem • Leverages new load balancing opportunities • Replication • Aggregation • Backwards compatible, no changes to existing NIDS
Outline • Introduction • Design: New Opportunities • Replication • Aggregation • Implementation • Evaluation
Replication N3 N2 N1 N4 N5 Replicate traffic to the cluster
Controlling Load via Process Fractions N3 N1 N2 N5 N4
Traffic Coverage =1 + + + Flocal(n1n4) N3 Flocal(n1n4) N1 N2 Foffload(n1n4) N5 N4 Flocal(n1n4)
Node Capacity and Link Constraints 100 Kpps 1Mpps N3 40% utilization 100 Kpps N1 N2 N5 N4 40% utilization 100Kpps
Global optimization Routing Traffic Matrix NIDS Capacities Linear program Minimize max-loaded node Subject to Coverage, Link Capacity constraints
LP Output Translation N1N4, Node 1, ¼ process N1N4, Node 1, [0,0.25), process N1N4, Node 2, ½ process N1N4, Node 2, [0.25,0.75), process Translate fractions into hash ranges Iterate & increment Similarly, for offload responsibilities
Per-Packet Decision Making h [0,1] 0 1 Flocal_n1(n1n4) Flocal_n2(n1n4) Flocal_n3(n1n4) Foffload_n2(n1n4) • Hash h of a 5-tuple (protocol, srcip, dstip, srcport, dstport)
Extension to Asymmetric Routing Might not get full coverage • Ffwd_off N3 N1 Forward Flow • Fcommon_loc N2 • Fcommon_off N4 N5 Reverse Flow • Frev_off Old way doesn’t work Treat forward and reverse paths separately
Outline • Introduction • Design: New Opportunities • Replication • Aggregation • Evaluation
Aggregation Scan all the things! +10 Alert 22>20 +5 N2 N1 N3 N5 N4 +7
Outline • Introduction • Design: New Opportunities • Replication • Aggregation • Implementation • Evaluation
Implementation • Backwards compatible • Logic is in the shim • Low overhead
Outline • Introduction • Design: New Opportunities • Replication • Aggregation • Implementation • Evaluation
Comparison to Alternatives Ingress Path, no replicate Path, replicate Path, augmented N3 N1 N2 10x N5 N4
Load reduction by 50% Even compared to “Path, augmented” Reduction in Max Load
We built it, runs with vanilla Snort Corresponds to our simulation results Emulab Deployment
Performance Under Traffic Variability Our setup does not cross max capacity
Coverage with Asymmetric Routing Randomized process for choosing path overlap Miss rates lower than any existing solution
Conclusion • NIDS have problems • Scaling up • Routing asymmetry • Generalized framework • Replication • Aggregation • Enhanced detection • Realized with no changes to existing NIDS • Significant performance and coverage benefits
Future Work • Combining replication and aggregation • Extension to NIPS and active monitoring • Traffic re-routing • Change to traffic patterns • Increased robustness to traffic dynamics