Bro: A System for Detecting network Intruders in Real-Time Vern Paxson

1. Bro: A System for Detecting network Intruders in Real-TimeVern Paxson Klevis Luli

2. Overview What is an IDS? Introduction to Bro Background & Related work How it works The Bro language Design Decisions Attacks on the monitor Experience & Future Improvement

3. What is an IDS? Intrusion Detection System or Network Intrusion detection System Real-time monitoring Detect attacks as they happen Provide valuable information about: Successful attacks Attack attempts Passive: monitors and reports Active (IPS): employs additional measures to stop attack Good place to put: Perimeter network (DMZ)

4. Introduction to Bro An open source IDS that passively monitors network traffic and analyzes it in real time by using deep packet inspection techniques Inspects the data portion of packets for certain patterns Goals: High speed, large volume monitoring Real-time notifications Separate mechanism and policy Extensibility No packet drops Protect itself against most attacks

5. Background & Related Work Commercial IDS that do the same Related work: Earlier version of this paper Paper from Ptacek and Newsham that focuses on attack methods No background literature for how monitors (IDS) are built This paper described how it is designed and categorizes attacks against monitors in a different way

6. How it works Captures network traffic using libpcap Filters relevant network traffic at kernel level to reduce load Applications: FTP, Finger, Portmapper, Ident, Telnet and Rlogin IP fragments TCP packets with SYN,FIN, or RST control bits set(connection information such as time, duration, hosts, ports..) Has an “event-engine”: Does Integrity checks, reassembles IP datagrams, processes UDP\TCP, creates a state for each connection, generates events And a “policy script interpreter”: Interprets policy scripts (event handlers) Event queue processed according to policy scripts Policies written in Bro language

7. How it works • Packet processing is done layer by layer, starting from the network to the policy script interpreter • If integrity checks at event engine fail a new event is generated and the packets are dropped • Policy scripts interpreter generates every event until queue is empty or timer expired • Notification is done by including generating new events, logging real-time notifications using syslog, recording data to disk…

8. The Bro Language Data types: bool, int, count (unsigned int), double, string, time, interval, port, addr, record, set, table, file, list, patterns Patterns are regular expressions used for matching Operators: C-like, in, !in Examples: filename in /rootkit-1\.[5-8]/ constallowed_services: set[addr, port] = { [ftp.lbl.gov, [ftp, smtp, ident, 20/tcp]], [nntp.lbl.gov, nntp]}; if ( [ftp.lbl.gov, ftp] in allowed_services) ... it's okay ...

9. Design Decisions Built in C++ Single threaded To avoid race conditions and blocks when waiting for resources (such as DNS lookups) Uses “calendar queues” to manage thousands timers, insert and delete operations completed at O (1) time Implemented their own regular-expression matching library Higher performance Offers more advanced pattern matching Policy scripts are interpreted Causes considerable overhead

10. Attacks on the monitor Overload Send a lot of packets that will be filtered, generate events, or lead to logging\recording to disk so that it fails to keep up with the network traffic it has to process, and then then attempt a network intrusion without being detected Mitigated with better hardware, and confidentiality of policy scripts (knowing which events require more work requires knowledge of scripts) Crash Make it run out of resources through vulnerabilities in source code or generating a large amount of traffic that creates many states, and then proceeds with the intrusion. Bro checks if the engine is jammed, terminates the Bro process while logging reason and failure data, and executes a copy of tcpdump.

11. Attacks on the monitor Subterfuge Hides the meaning of the traffic the monitor analyzes. Can never be detected if successful. Bro employs a lot of countermeasures against the most common of these attacks. Scan detection Detect port and address scans by keeping track of newly-attempted connections to distinct network addresses or ports.

12. Experience & Future Improvement Experience from 3 years: 85 MB daily connection summaries, 40 real-time notifications Many false positives Detects 4–5 address and port scans each day. 150 incident reports filed “split routing” is a problem. Future improvements: Support for additional application protocols Compiling Bro scripts Distributing monitoring across multiple hosts in the network Intrusion prevention abilities.

13. The future… Bro 2.0 just released base/frameworks/cluster base/frameworks/communication base/frameworks/control base/frameworks/dpd base/frameworks/intel base/frameworks/logging base/frameworks/logging/postprocessors base/frameworks/metrics base/frameworks/notice base/frameworks/packet-filter base/frameworks/reporter • base/protocols/ftp • base/protocols/http • base/protocols/irc • base/protocols/smtp • base/protocols/ssh • base/protocols/ssl • base/protocols/syslog • Policy/integration/barnyard2 • policy/tuning/defaults • policy/tuning • base/frameworks/signatures • base/frameworks/software • base/protocols/conn • base/protocols/dns

14. Thank you!