GPN 2009 May 29, Kansas City, Missouri An open security defense architecture for open collaborative cyber infrastructures Xinming (Simon) Ou Kansas State University The Great Plains Network Annual Meeting 2009 Kansas City, Missouri

GPN 2009 May 29, Kansas City, Missouri Challenges to securing cyber infrastructures Cyber warfare is asymmetric – Attack only needs to break a few points – Defense has to be comprehensive Attackers have an upper hand in automation – Many automated exploit tools – Not so many good defense tools Openness of academic cyber infrastructures – Unrealistic to have draconic control on access 1

GPN 2009 May 29, Kansas City, Missouri Multi-step Attacks Internet Demilitarized zone (DMZ) Corporation webServer workStation webPages fileServer Firewall 2 buffer overrun Trojan horse sharedBinary NFS shell Firewall 1 2

GPN 2009 May 29, Kansas City, Missouri Solution System admin Security expert CERT advisory Information about users Linux security behavior; Windows security behavior; Common attack techniques Apache bug! Host configuration Network configuration Reasoning System potential attack paths 3

GPN 2009 May 29, Kansas City, Missouri baseline security status Automated analyzer Information collection Enterprise Network Security scanning and monitoring Suggested configuration change to harden security Broader Security Community NVD OVAL/Nessus Repository CVSS High-level security knowledge Baseline security knowledge

GPN 2009 May 29, Kansas City, Missouri MulVAL Interaction Rules from Security Experts MulVAL Scanner Analyzer Could root be compromised on any of the machines? Ou, Govindavajhala, and Appel. Usenix Security 2005 Answers Network Analyzer Vulnerability Information (e.g. NIST NVD) Network reachability information Vulnerability definition (e.g. OVAL, Nessus Scripting Language) User information 5

GPN 2009 May 29, Kansas City, Missouri Interaction Rules execCode (Attacker, Host, PrivilegeLevel) :- vulExists (Host, Program, remote, privilegeEscalation), serviceRunning (Host, Program, Protocol, Port, PrivilegeLevel), networkAccess (Attacker, Host, Protocol, Port). internet dmz webServer Firewall 1 vulExists (webServer, httpd, remote, privilegeEscalation). serviceRunning (webServer, httpd, tcp, 80, apache). networkAccess (attacker, webServer, tcp, 80). execCode (attacker, webServer, apache). Oops! From MulVAL Scanner & OVAL, NVD From MulVAL Scanner Derived 6

GPN 2009 May 29, Kansas City, Missouri MulVAL Attack-Graph Toolkit Datalog representation Machine configuration Network configuration Security advisories MulVAL reasoning engine Proofs of assertions Graph Builder Logical attack graph Interaction rules Ou, Boyer, and McQueen. ACM CCS 2006 Joint work with Idaho National Laboratory 7

GPN 2009 May 29, Kansas City, Missouri Test on a Real Network Used MulVAL to check the configuration of four Linux servers – Reported a potential two-stage attack path due to multiple vulnerabilities on a server. Three local kernel vulnerabilities One buffer overflow bug in libpng Local users are trusted Web browser links libpng 8

GPN 2009 May 29, Kansas City, Missouri system administrator Network Monitoring Tools Abnormally high traffic TrendMicro server communicating with known BotNet controllers memory dump Seemingly malicious code modules Found open IRC sockets with other TrendMicro servers netflow dump These TrendMicro Servers are certainly compromised! 9 The next challenge: Situation Awareness

GPN 2009 May 29, Kansas City, Missouri High-confidence Conclusions with Evidence Targeting subsequent observations Mapping observations to their semantics IDS alerts, netflow dump, syslog, server log … Observations Internal model Reasoning Engine 10

GPN 2009 May 29, Kansas City, Missouri High-confidence Conclusions with Evidence Targeting subsequent observations Mapping observations to their semantics IDS alerts, netflow dump, syslog, server log … Observations Internal model Reasoning Engine 11

GPN 2009 May 29, Kansas City, Missouri Observation Correspondence Mapping observations to Internal condition. what you can see what you want to know obs(anomalyHighTraffic)int(attackerNetActivity) obs(netflowBlackListFilter(H, BlackListedIP)) obs(memoryDumpMaliciousCode(H)) obs(memoryDumpIRCSocket(H1,H2)) p int(compromised(H)) l l int(exchangeCtlMessage(H1,H2)) l 12

GPN 2009 May 29, Kansas City, Missouri High-confidence Conclusions with Evidence Targeting subsequent observations Mapping observations to their semantics IDS alerts, netflow dump, syslog, server log … Observations Internal model Reasoning Engine 13

GPN 2009 May 29, Kansas City, Missouri Internal Model Logical relation among internal conditions. Condition1 Condition2 “leads to” relation i.e. Condition1 may cause Condition2 m1m1 m2m2 int(compromised(H1))int(probeOtherMachine(H1,H2)) pc int(compromised(H1))int(sendExploit(H1,H2)) pc int(compromised(H2)) l p int(compromised(H1)), int(exchangeCtlMessage(H1,H2)) p c int(compromised(H2)) 14

GPN 2009 May 29, Kansas City, Missouri Proof Strengthening Observations: f is likely true O1O1 O2O2 f is certainly true proof strengthening O3O3 15

GPN 2009 May 29, Kansas City, Missouri The SnIPS system Reasoning Engine Snort alerts (summarized tuples) Observation Correspondence User query, e.g. which machines are “certainly” compromised? High-confidence answers with evidence pre-processing Internal Model Snort Rule Repository Done only once 16

GPN 2009 May 29, Kansas City, Missouri Automate Model Building for Snort alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC guestbook.pl access”;uricontent:"/guestbook.pl”; classtype:attempted-recon; sid:1140;) obsMap(obsRuleId_3615, obs(snort(’1:1140’, FromHost, ToHost, _Time)), int(probeOtherMachine(FromHost, ToHost)), ? ). Internal predicate mapped from “classtype” 17

GPN 2009 May 29, Kansas City, Missouri Automate Model Building for Snort Impact: Information gathering and system integrity compromise. Possible unauthorized administrative access to the server. Possible execution of arbitrary code of the attackers choosing in some cases. Ease of Attack: Exploits exists obsMap(obsRuleId_3614, obs(snort(’1:1140’, FromHost, ToHost, _Time)), int(compromised(ToHost)), p ) Hints from natural-language description of Snort rules obsMap(obsRuleId_3615, obs(snort(’1:1140’, FromHost, ToHost, _Time)), int(probeOtherMachine(FromHost, ToHost)), ). l ? 18

GPN 2009 May 29, Kansas City, Missouri Coverage Internal Predicate% of rules Predicates Handled by the internal model 59% Suspicious41% Snort has about 9000 rules. This is just a base-line and needs to be fine-tuned. Would make more sense for the rule writer to define the observation correspondence relation when writing a rule. 19

GPN 2009 May 29, Kansas City, Missouri Experiment on Treasure Hunt data Data collected during a graduate-level course exercise Data set contains multi- stage attacks as in real world scenario A large variety of monitoring data 20

GPN 2009 May 29, Kansas City, Missouri Some Results | ?- show_trace(int(compromised(H), c)). int(compromised(’ ’),c) strengthenedPf int(compromised(’ ’),l) intRule_1 int(probeOtherMachine(’ ’,’ ’),l) obsRulePre_1 obs(snort(’122:1’,’ ’,’ ’,_h272)) int(compromised(’ ’),l) intRule_3 int(sendExploit(’ ’,’ ’),c) obsRuleId_3749 obs(snort(’1:1807’,’ ’,’ ’,_h336)) An exploit was sent to A probe was sent from was certainly compromised! 21

GPN 2009 May 29, Kansas City, Missouri Summary Open knowledge sharing and automated knowledge reuse is key in effective cyber defense Advantages of logic-based techniques – Publishing and incorporation of knowledge/information through well-understood logical semantics – Efficient and sound analysis by leveraging the reasoning power of well-developed logic-deduction systems 22

GPN 2009 May 29, Kansas City, Missouri Who We Are 23 Argus: Cyber Security Research Group at Kansas State University Contact me: Simon Ou

GPN 2009 May 29, Kansas City, Missouri Thank You! Questions?