1 Flexible, High-Speed Intrusion Detection Using Bro Vern Paxson Computational Research Division Lawrence Berkeley National Laboratory and ICSI Center for Internet Research International Computer Science Institute Berkeley, CA USA

2 Protect Rather Than Secure Modern science critically depends on diverse, high- performance Internet communication Increasingly difficult given rising security threats Alternative institutional approach: network intrusion detection —Monitor network traffic, look for attacks —Key point: tenable due to threat model at open research institutes Few jewels Low level of compromises is tolerable Particularly effective when combined with dynamic blocking (reactive firewall) Potentially keeps Default Allow viable

3 Bro Design Goals (1990’s) Monitor traffic in a very high performance environment Real-time detection and response Separation of mechanism from policy Ready extensibility of both mechanism and policy Resistant to evasion

4 How Bro Works Taps GigEther fiber link passively, sends up a copy of all network traffic. Network

5 How Bro Works Kernel filters down high-volume stream via standard libpcap packet capture library. Network libpcap Packet Stream Filtered Packet Stream Tcpdump Filter

6 How Bro Works “Event engine” distills filtered stream into high- level, policy-neutral events reflecting underlying network activity —E.g., connection_attempt, http_reply, user_logged_in Network libpcap Event Engine Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control

7 How Bro Works “Policy script” processes event stream, incorporates: —Context from past events —Site’s particular policies Network libpcap Event Engine Policy Script Interpreter Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control Real-time Notification Record To Disk Policy Script

8 How Bro Works “Policy script” processes event stream, incorporates: —Context from past events —Site’s particular policies … and takes action : Records to disk Generates alerts via syslog, paging Executes programs as a form of response Sends events to other Bro’s Network libpcap Event Engine Policy Script Interpreter Packet Stream Filtered Packet Stream Tcpdump Filter Event Stream Event Control Real-time Notification Record To Disk Policy Script

9 Signature Engine Bro also includes a signature engine for matching specific patterns in packet streams: —Conceptually simple —Easy to share —Compatible with Snort ( widely used freeware IDS ) E.g., can run on Snort’s default set of 1,900+ signatures —… but of limited power; basically, a useful hack As with other Bro analysis, signature matches generate events amenable to high- level policy script processing, rather than direct alerts

10 Status Operational 24x7: LBNL (border & internal), NERSC, UC Berkeley, TUM, NCSA Runs on commodity Unix PCs … but getting hard! ~ 80K lines C++, 12K lines of policy scripts, 200 page user manual Main LBNL Bro blocks remote addresses/day, mostly for scanning Provides extensive logs, invaluable for forensics & site traffic analysis

11 R&D Support Funded variously via overhead, operations, research grants Current research support: —NSF Strategic Technologies for the Internet Likely DOE support soon for developing as a potential community resource... Pending R&D proposal to DOE for very high-speed monitoring …

12 R&D Support Funded variously via overhead, operations, research grants Current research support: —NSF Strategic Technologies for the Internet Likely DOE support soon for developing as a potential community resource... Pending R&D proposal to DOE for very high-speed monitoring …

13 Making Bro Broadly Available Broader documentation: setup, operational procedures, analysis techniques, FAQ Tutorials (already have in-house) Bug-tracking system Test suites Production vs. research code trees Framework for integrating contributions GUIs for configuration, log analysis Framework for rapid dissemination of new scripts/policies/signatures

14 R&D Support Funded variously via overhead, operations, research grants Current research support: —NSF Strategic Technologies for the Internet Likely DOE support soon for developing as a potential community resource... Pending R&D proposal to DOE for very high-speed (10-40 Gbps) monitoring …

15 Prefiltering (Prototyped at SC02, SC03)

16 Shunting

17 Discussion/Questions?