UltraPAC ： automated protocol parser generator Daniel Burgener Jing Yuan

outline Background BinPAC BinPAC vs. UltraPAC Work so Far Future work

Background Anomaly detection – accuracy (vulnerability signature) – speed Vulnerability signature –parse the traffic stream based on application- level – obtain the signature by recovering the protocol field

Binpac Goal: –General parser for different application-level traffic Binpac ： –build a hierarchical topology to recursively parse the protocol Not effective for high speed NIDS/NIPS –construct the parsing tree –call the parsing function recursively

UltraPAC vs. Binpac UltraPAC –Based on binpac – specially for the vulnerability signature matching – parsing tree vs. parsing state machine

Work so Far: Designing UltraPAC UltraPAC parses a protocol written in the binPAC language to create a C++ parser The necessary data for this parser is stored in the “Field Table” fieldPrevNextlenvar lengtharcoun t Label, ptr_lo 8Y labellength? N ptr_lolength?8N

Work so Far: Designing UltraPAC BinPAC has many different data structures we need to handle. Expressions in the length or next field can be any of the following: Number : number Variable set in &let : store the expression, and mark necessary variables to be saved &oneline : the regular expression “.*\n” &restofdata : get the remaining length from the buffer class &until : If dependent on $input, lookup in buffer class, if dependent on $element, store and mark as in &let

Work so Far: Designing UltraPAC BinPAC has many different data structures we need to handle. Expressions in the length or next field can be any of the following: Regular expression matching : store a regular expression Case : store the expression that generates the case variable &If : store the expression to be checked Arrays : always given an ending condition, so parse that

Future Work Implement UltraPAC The Field Table has already been implemented by Hongyu Our job is to parse the various expressions as described in previous slides and store them in the field table By the end of the quarter, we expect to have a working parser generator Schedule: Two weeks: a parser that works for HTTP Three weeks: a parser working for all ASCII protocols Four weeks: a perfectly working parser