1. NetShield: Matching a Large Vulnerability Signature Ruleset for High Performance Network Defense
Yan Chen
Department of Electrical Engineering and Computer Science
Northwestern University
Lab for Internet & Security Technology (LIST)

2. Motivation of NetShield2

3. NetShield Overview

4. Evaluation Methodology
Fully implemented prototype
12,000 lines of C++ and 3,000 lines of Python
Can run on both Linux and Windows
Deployed at a university DC
with up to 106Mbps
26GB+ Traces from Tsinghua Univ. (TH), Northwestern (NU) and DARPA
Run on a P4 3.8Ghz single core PC w/ 4GB memory
After TCP reassembly and preload the PDUs in memory
For HTTP we have 794 vulnerability signatures which cover 973 Snort rules.
For WINRPC we have 45 vulnerability signatures which cover 3,519 Snort rules
The measured links experience a sustained
traffic rate of roughly 20Mbps with bursts of up
to 106Mbps. 4 4

5. Matching Results
Trace
TH WINRPC
NU WINRPC
TH HTTP
NU HTTP
DARPA HTTP
Throughput (Gbps)
Sequential
CS Matching
10.68
14.37
9.23
10.61
0.34
2.63
2.37
17.63
0.28
1.85
Matching only time
speed up ratio 4
1.8
11.3
11.7
8.8
Avg # of Candidates
1.16
1.48
0.033
0.038
0.0023
Max. memory per connection (bytes) 27 20 5 5

6. Scalability and Accuracy Results
Rule scaling results
Accuracy
Create two polymorphic WINRPC exploits which bypass the original Snort rules but detect accurately by our scheme.
For 10-minute “clean” HTTP trace, Snort reported 42 alerts, NetShield reported 0 alerts. Manually verify the 42 alerts are false positives
Performance
decrease
gracefully

7. Research Contribution
Make vulnerability signature a practical solution
for NIDS/NIPS
Regular Expression
Exists Vul. IDS
NetShield
Accuracy
Poor
Good
Speed
Memory ??
Coverage
Multiple sig. matching  candidate selection algorithm
Parsing  parsing state machine
Achieves high speed with much better accuracy
Build a better Snort alternative! 7 7