NetShield: Matching a Large Vulnerability Signature Ruleset for High Performance Network Defense Yan Chen Department of Electrical Engineering and Computer Science Northwestern University Lab for Internet & Security Technology (LIST) http://list.cs.northwestern.edu

Motivation of NetShield 2

NetShield Overview

Evaluation Methodology Fully implemented prototype 12,000 lines of C++ and 3,000 lines of Python Can run on both Linux and Windows Deployed at a university DC with up to 106Mbps 26GB+ Traces from Tsinghua Univ. (TH), Northwestern (NU) and DARPA Run on a P4 3.8Ghz single core PC w/ 4GB memory After TCP reassembly and preload the PDUs in memory For HTTP we have 794 vulnerability signatures which cover 973 Snort rules. For WINRPC we have 45 vulnerability signatures which cover 3,519 Snort rules The measured links experience a sustained traffic rate of roughly 20Mbps with bursts of up to 106Mbps. 4 4

Matching Results Trace TH WINRPC NU WINRPC TH HTTP NU HTTP DARPA HTTP Throughput (Gbps) Sequential CS Matching 10.68 14.37 9.23 10.61 0.34 2.63 2.37 17.63 0.28 1.85 Matching only time speed up ratio 4 1.8 11.3 11.7 8.8 Avg # of Candidates 1.16 1.48 0.033 0.038 0.0023 Max. memory per connection (bytes) 27 20 5 5

Scalability and Accuracy Results Rule scaling results Accuracy Create two polymorphic WINRPC exploits which bypass the original Snort rules but detect accurately by our scheme. For 10-minute “clean” HTTP trace, Snort reported 42 alerts, NetShield reported 0 alerts. Manually verify the 42 alerts are false positives Performance decrease gracefully

Research Contribution Make vulnerability signature a practical solution for NIDS/NIPS Regular Expression Exists Vul. IDS NetShield Accuracy Poor Good Speed Memory ?? Coverage Multiple sig. matching  candidate selection algorithm Parsing  parsing state machine Achieves high speed with much better accuracy Build a better Snort alternative! 7 7