1. RAID2005 CardGuard: Towards software-based signature detection for intrusion prevention on the network card Herbert Bos and Kaiming Huang presented by Willem de Bruijn

2. RAID2005 IDS is insufficient intrusion prevention is preferable over detection active guarding nullifies evasion & insertion attemps but, prevention problematic at traditional firewalls performance issues lack of knowledge internal nodes expected safe rigid, leading to circumvention

3. RAID2005 Move IPS to the edge using a software based solution on the network card full payload scanning,at line-rate* to create a (crude) cost-effective local IPS CardGuard implements

4. RAID2005 Introduction Architecture Implementation Results

5. RAID2005 distributed firewalling signature detection is easier at the network edge can overwhelm CPU 69Mbps max on 1.8 Ghz P4 a solution is to offload to the NIC: unobtrusive & difficult to subverge

6. RAID2005 Network Processors Programmable NICs that combine cheap software with fast hardware they contain ● stream processors ● asynchronous memory ● hardware assist (e.g., CAM)

7. RAID2005 Efficient Pattern Matching snort ruleset >28.000 pattern-based rules requires parallel processing Aho Corasick pattern-matching algorithm single-pass complexity independent of #patterns

8. RAID2005 Aho Corasick Example a deterministic finite automaton (DFA) for the Slammer worm identifies 5 different patterns

9. RAID2005 Introduction Architecture Implementation Results

10. RAID2005 IXP1200 PCI daughterboard or stand-alone box two 1Gbps ports 6 stream µEngines 4 HW threads/engine 1 StrongARM CPU @ 200Mhz IXP 2XXX

11. RAID2005 software mapping Cp Rx Tx ToE AC ToE RegEx =

12. RAID2005 Flow handling TCP reconstruction light: basic flow-accounting datastream sanitisation Out-of-order handling: put on hold, or two-pass scan Cp Rx ACToETx Cp ACToE

13. RAID2005 efficient memory use size latency Scratch, 16KB, 12..14 cycles SRAM : 8 MB, 16..20 cycles SDRAM : 256 MB, 30...40 cycles Istore, 1KB, 1 cycle Registers, 512B, 1 cycle; shared inline DFA in-memory DFA memory access is the bottleneck

14. RAID2005 Introduction Architecture Implementation Results

15. RAID2005 inline DFA in-memory DFA

16. RAID2005 benchmarks processing costs scale linearly with datarate, not packetrate Full TCP scan sustainable at 100Mbit

17. RAID2005 conclusions intrusion prevention is feasible at the network edge NP-based solutions are cheap and unobtrusive caveat CardGuard is only a crude prototype lacks a sophisticated management plane