Network Security Lab Jelena Mirkovic Sig NewGrad presentantion

Main Research Areas Distributed Denial of Service Distributed Denial of Service Distributed defense: DefCOM Distributed defense: DefCOM Internet Worms Internet Worms Worm simulation: PAWS Worm simulation: PAWS Cooperative defense: WIN Cooperative defense: WIN Detecting new malicious executables Detecting new malicious executables Application-level Honeynets, summarizing firewall logs, predicting routing changes … Application-level Honeynets, summarizing firewall logs, predicting routing changes …

Distributed Denial of Service

Ideal solution! Too much traffic Attack traffic looks like legitimate

Distributed Denial of Service Detect attack Stop attack Differentiate between attack and legitimate traffic

DefCOM Distributed defense against DDoS Distributed defense against DDoS Combines nodes at: Combines nodes at: Victim – Alert generators: detect attack and alert other nodes Victim – Alert generators: detect attack and alert other nodes Core – Rate limiters: stop attack by dropping traffic Core – Rate limiters: stop attack by dropping traffic Source – Classifiers: differentiate between legitimate and attack traffic Source – Classifiers: differentiate between legitimate and attack traffic Nodes cooperate through an overlay Nodes cooperate through an overlay

DefCOM AG RL C C Attack! 1. Attack detection

DefCOM AG RL C C 2. Forming the traffic tree mark = 3 mark = 5 mark = 12 mark 56 I see mark 3! I see mark 5! I see marks 12 and 56!

DefCOM AG RL C C 2. Forming the traffic tree

DefCOM AG RL C C 3. Distributed rate-limiting 100Mbps 50Mbps

DefCOM AG RL C C 4. Traffic differentiation 100Mbps 50Mbps L=76 M=43 L=6 M=20 L=33 M=17 L=4 M=25

DefCOM AG RL C C 4. Traffic differentiation 100Mbps 50Mbps L=76 M=43 L=6 M=20 L=33 M=17 L=4 M=25

Internet Worms  A program that:  Scans network for vulnerable machines  Breaks into machines by exploiting the found vulnerability  Installs some piece of malicious code – backdoor, DDoS tool  Moves on  Don’t need any user action to spread  Spread very fast!

PAWS  Parallel worm simulator  Runs on multiple machines – gain memory and CPU resources  Can simulate greater detail than single-node simulators  Can simulate various defenses  Machines synchronize with network messages

WIN  Worm information network  We need fast, automatic response to stop worms  How can we detect worms  How can we devise signatures quickly and automatically  How can we share signatures with other networks  How can we accept signatures from others and be sure we won’t filter out legitimate traffic