Bro 2.0 and Beyond · 2012. 2. 13. · v0.2 Bro 2.0 1st CHANGES entry v0.6 RegExps Login analysis...

Dagstuhl 2012

Network Attack Detection and Defense Early Warning Systems Schloss Dagstuhl, 2012

Bro 2.0 and Beyond

The Bro Network Security Monitor

Dagstuhl 2012

Bro Introduction“Much different from the typical IDS you may know”

Hot off the Press: Bro 2.0Focus on operational deployment

Current Research ProjectsReal-time IntelligencePerformance for next-gen environments

Outline

Dagstuhl 2012 4

What is Bro?

Dagstuhl 2012

Packet Capture

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

Log RecordingNetFlow

syslog

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

FlexibilityAbstraction

Data Structures

syslog

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

Data Structures

syslog

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

Data Structures

syslog

Data Structures

What is Bro?

Dagstuhl 2012

Packet Capture

Traffic Inspection

Attack Detection

Data Structures

Log Recording

“Domain-specific Python”NetFlow

syslog

Data Structures

What is Bro?

Dagstuhl 2012

Fundamentally different from other IDS.Reset your idea of an IDS before starting to use Bro.

Real-time network analysis framework.Primarily an IDS, but many use it for general traffic analysis.

Can accommodate a range of detection approaches.Policy-neutral at the core.

Highly stateful.Tracks extensive application-layer network state.

Supports forensics.Extensively logs what it sees.

Philosophy

Dagstuhl 2012

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2011

Bro History

1995 20101996

Vern writes 1st line of code

Dagstuhl 2012

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2011

Bro History

1995 20101996

LBNL starts using Bro

operationally

Dagstuhl 2012

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2011

Bro History

1995 20101996

Bro Waters

Bro 2.0v0.21st CHANGES

v0.6RegExps

Login analysis

v0.8aX/0.9aXSSL/SMB

STABLE releasesBroLite

v1.1/v1.2when StmtResource

tuningBroccoli

v1.5BroControl

v0.7a90Profiling

State Mgmt

v1.4DHCP/BitTorrent

HTTP entitiesNetFlow

Bro Lite Deprecated

v1.0BinPAC

IRC/RPC analyzers64-bit supportSane version

numbers

v0.4HTTP analysisScan detectorIP fragmentsLinux support

v0.7a175/0.8aX Signatures

SMTPIPv6 supportUser manual

v0.7a48Consistent CHANGES

v1.3Ctor expressions

GeoIPConn Compressor

0.8a37Communication

PersistenceNamespacesLog Rotation

operationally

Dagstuhl 2012

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2011

Bro History

USENIX PaperStepping Stone

Detector

AnonymizerActive MappingContext Signat.

TRWState Mgmt.

Independ. State

Host ContextTime Machine

Enterprise Traffic

BinPACDPD

2nd Path

Bro ClusterShunt

Autotuning

Parallel Prototype

20101996

Bro Waters

Bro 2.0v0.21st CHANGES

v0.6RegExps

Login analysis

v0.8aX/0.9aXSSL/SMB

STABLE releasesBroLite

v1.1/v1.2when StmtResource

tuningBroccoli

v1.5BroControl

v0.7a90Profiling

State Mgmt

v1.4DHCP/BitTorrent

HTTP entitiesNetFlow

Bro Lite Deprecated

v1.0BinPAC

IRC/RPC analyzers64-bit supportSane version

numbers

v0.4HTTP analysisScan detectorIP fragmentsLinux support

v0.7a175/0.8aX Signatures

SMTPIPv6 supportUser manual

v0.7a48Consistent CHANGES

v1.3Ctor expressions

GeoIPConn Compressor

0.8a37Communication

PersistenceNamespacesLog Rotation

operationally

Academic Publications

Dagstuhl 2012

“Who’s Using It?”

Dagstuhl 2012 8

Example Logs

Dagstuhl 2012

> bro -i en0 [ ... wait ...]> cat conn.log

Example Logs

Dagstuhl 2012

#fields ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration1144876741.1198 192.150.186.169 53115 82.94.237.218 80 tcp http 16.14929 1144876612.6063 192.150.186.169 53090 198.189.255.82 80 tcp http 4.437460 1144876596.5597 192.150.186.169 53051 193.203.227.129 80 tcp http 0.372440 1144876606.7789 192.150.186.169 53082 198.189.255.73 80 tcp http 0.597711 1144876741.4693 192.150.186.169 53116 82.94.237.218 80 tcp http 16.02667 1144876745.6102 192.150.186.169 53117 66.102.7.99 80 tcp http 1.004346 1144876605.6847 192.150.186.169 53075 207.151.118.143 80 tcp http 0.029663

Example Logs

Dagstuhl 2012

> cat http.log

Example Logs

Dagstuhl 2012

#fields ts id.orig_h id.orig_p [...] host uri status_code user_agent [...]1144876741.6335 192.150.186.169 53116 docs.python.org /lib/lib.css 200 Mozilla/5.01144876742.1687 192.150.186.169 53116 docs.python.org /icons/previous.png 304 Mozilla/5.0 1144876741.2838 192.150.186.169 53115 docs.python.org /lib/lib.html 200 Mozilla/5.0 1144876742.3337 192.150.186.169 53116 docs.python.org /icons/up.png 304 Mozilla/5.0 1144876742.3337 192.150.186.169 53116 docs.python.org /icons/next.png 304 Mozilla/5.01144876742.3337 192.150.186.169 53116 docs.python.org /icons/contents.png 304 Mozilla/5.0 1144876742.3337 192.150.186.169 53116 docs.python.org /icons/modules.png 304 Mozilla/5.0 1144876742.3338 192.150.186.169 53116 docs.python.org /icons/index.png 304 Mozilla/5.0 1144876745.6144 192.150.186.169 53117 www.google.com / 200 Mozilla/5.0

> cat http.log

Example Logs

Dagstuhl 2012

> cat http.log

Example Logs

Dagstuhl 2012

Task: Report all Web requests for files called “passwd”.

Script Example: Matching URLs

Dagstuhl 2012

event http_request(c: connection, # Connection. method: string, # HTTP method. original_URI: string, # Requested URL. unescaped_URI: string, # Decoded URL. version: string) # HTTP version.{ if ( method == "GET" && unescaped_URI == /.*passwd/ ) NOTICE(...); # Alarm.}

Task: Report all Web requests for files called “passwd”.

Script Example: Matching URLs

Dagstuhl 2012

Task: Count failed connection attempts per source address.

Script Example: Scan Detector

Dagstuhl 2012

global attempts: table[addr] of count &default=0;

event connection_rejected(c: connection){ local source = c$id$orig_h; # Get source address. local n = ++attempts[source]; # Increase counter. if ( n == SOME_THRESHOLD ) # Check for threshold. NOTICE(...); # Alarm.}

Task: Count failed connection attempts per source address.

Script Example: Scan Detector

Dagstuhl 2012 11

Distributed Scripts

Dagstuhl 2012

Bro comes with >10,000 lines of script code.Prewritten functionality that’s just loaded.

Scripts also generate the logs.Amendable to extensive customization and extension.

Distributed Scripts

Dagstuhl 2012

Version 2.0

Dagstuhl 2012

Version 2.0

Default scripts rewritten from scratch.Focus ease of use and operational deployment.

New logging infrastructure.New build and packaging system.New auto-documentation system (Broxygen).Lots of bugs fixed.Obsolete code removed.

New development infrastructure.New regression testing framework.New web server.New mailing lists.New logo.

Dagstuhl 2012

Upcoming

Dagstuhl 2012

Upcoming

Bro 2.1

Overhauled IPv6 support.New user’s guide.Logging extensions.

Binary logging/Postgresql/CouchDB/SQLite(?) / Threads.

Input framework.Reaction framework.New/improved analyzers.

Syslog/GridFTP/NFS/SMB/BitTorrent.

Extended test-suite.

Aiming for 3-4 months release cycle.

Dagstuhl 2012

Current ResearchReal-Time Intelligence

Dagstuhl 2012

REN-ISAC’s Security Event System

Source: REN-ISAC

Dagstuhl 2012

Argonne Federated Model

Source: Argonne National Lab

Dagstuhl 2012

Real-time Intelligence with Bro

Dagstuhl 2012

Bro Policy Script

Output Framework

ASCIIBinary

Python

Dagstuhl 2012

Bro Policy Script

Output Framework

External Partners

BinaryDBs

Python

Dagstuhl 2012

Bro Policy Script

Output Framework

Input Framework

External Partners

ASCIIBinary

BinaryDBs

Python

Dagstuhl 2012

Bro Policy Script

Output Framework

Input Framework

External Partners

ASCIIBinary

BinaryDBs

Python

Research QuestionsWhat capabilities does the new context give us?

What is the quality of the shared information?Do sites see the similar attacks?

Dagstuhl 2012

Current ResearchPerformance

Dagstuhl 2012

Back in 2005 ...

Dagstuhl 2012

Back in 2005 ...

Data: Leibniz-Rechenzentrum, München

1997 1998 1999 2000 2001 2002 2003 2004 2005

Total bytesIncoming bytes

Total upstream bytesIncoming bytes

Munich Scientific Network (Today)3 major universities, 2x10GE upstream~100,000 Users~65,000 Hosts

Dagstuhl 2012

1996 1998 2000 2002 2004 2006 2008 2010

Total bytesIncoming bytes

Oct 2005

Today ...

Total upstream bytesIncoming bytes

Data: Leibniz-Rechenzentrum, München

Munich Scientific Network3 major universities, 2x10GE upstream~100,000 Users~65,000 Hosts

Dagstuhl 2012

Load-balancing Architecture

Dagstuhl 2012

Detection LogicPacket Analysis

10Gbps

Dagstuhl 2012

10Gbps

Detection Logic

Packet Analysis

NIDS 2

Detection Logic

Packet Analysis

NIDS 1

Detection Logic

Packet Analysis

NIDS 3

Dagstuhl 2012

10Gbps

Detection Logic

Packet Analysis

NIDS 2

Detection Logic

Packet Analysis

NIDS 1

Detection Logic

Packet Analysis

NIDS 3

Communication

Dagstuhl 2012

10Gbps

“Bro Cluster”

Detection Logic

Packet Analysis

NIDS 2

Detection Logic

Packet Analysis

NIDS 1

Detection Logic

Packet Analysis

NIDS 3

Communication

Dagstuhl 2012

cPacket’s cFlow 10G

Dagstuhl 2012

cPacket’s cFlow 10G

Dagstuhl 2012

Next Stop: 100 Gb/s

Source: ESNet

Now these sites need a monitoring solution ... Working with cPacket on a 100GE load-balancer!

Source: ESNet

DOE/ESNet 100G Advanced Networking Initiative

Dagstuhl 2012

100 Gb/s Load-balancer

Dagstuhl 2012

100Gbps cFlow 100G

10Gb/s

Bro Cluster

Dagstuhl 2012

100Gbps cFlow 100G

10Gb/s

Bro Cluster

Dagstuhl 2012

Host Application

Application Core

C Interface

Native Executable

Analysis Specification

Native Object Code

System Linker

Analysis Compiler

HILTI Machine Code

HILTI Compiler

Runtime Library

HILTI Machine Environment OS Toolchain

hilti-build

hiltic

Improving Bro’s Performance

A High-Level Intermediary Language for Traffic Inspection

Dagstuhl 2012

Host Application

Application Core

C Interface

Native Executable

Analysis Specification

Native Object Code

System Linker

Analysis Compiler

HILTI Machine Code

HILTI Compiler

Runtime Library

HILTI Machine Environment OS Toolchain

hilti-build

hiltic

Improving Bro’s PerformanceBottlenecks: Script interpretation & single-thread structure

A High-Level Intermediary Language for Traffic Inspection

Dagstuhl 2012

Summary

Dagstuhl 2012

Summary

www.bro-ids.orggit.bro-ids.org

tracker.bro-ids.org@Bro_IDS on Twitter

Dagstuhl 2012

Summary

Bro 2.0 is a major step forward.From research to operations.Crucial engineering resources available.Aiming to setup a long-term development model.

Dagstuhl 2012

Summary

Bro 2.0 is a major step forward.From research to operations.Crucial engineering resources available.Aiming to setup a long-term development model.

Bro remains a research platform.Real-time intelligencePerformance for next-gen environments

Bro 2.0 and Beyond · 2012. 2. 13. · v0.2 Bro 2.0 1st CHANGES entry v0.6 RegExps Login analysis...

Documents

Genesis Bro

BRO Magazine

Social Bro

Bro Befriends Suricata - zeek.org · Bro Befriends Suricata 23/09/16 20:23 Page 1 of 47 BRO BEFRIENDS SURICATA SURICATA AND BRO FIGHTING MALWARE TOGETHER

Drainase - bro

Lehman bro

Placement Bro

cdigital.dgb.uanl.mxcdigital.dgb.uanl.mx/la/1020001211_C/1020001212_T2/1020001212_05… · R. P. Fr. Jose Rojas. 2.0 Maestro de Ceremonias, ... P bro. Ignacio Silva. Sacristan Mayor

Raihana2 bro

· PDF fileNoli Me Tangere No. 42 Mother Cha ter A. Mabini Chapter A.Mabini Chapter ... 18. 19. 20. 21. 22. 23. 25. Note: Bro. Bro. Bro. Bro. Bro. Bro. Bro. Bro

Welding Bro

Flexflo Bro F3f 08:Grove Flexflo Bro

5969 ARZN Comp Bro - AERZENcatalog.aerzen.com/Asset/0000523695_030.pdf · Drive coupling and guard:Dry, ﬂexible type, fully accessible. Service factor ≥2.0; coupling with steel

United bro

bro factory

7705sar Bro

Bro Befriends Suricata - The Bro Network Security … · Bro Befriends Suricata 23/09/16 20:23 Page 1 of 47 BRO BEFRIENDS SURICATA SURICATA AND …

Bro Clusters

Hydraulisk modellering av Selångersån genom Sundsvall/Menu/general/extGroup... · 2014-05-15 · W 11sept2001 Bro 12 Tivolibron Bro 11 Puckelbron Bro 10 Fiskbron Bro 9 Bro 8 Storbron

bro 10 · 2013-02-04 · bro 10 ... bro 10