WP3 WISDOM SOFTWARE PACKAGE Elias Athanasopoulos FORTH Cork, Ireland, January 2009

Good News! WSIM: A software platform to simulate all-optical security operations. –Antonis Krithinakis, Lubomir Stroetmann, Elias Athanasopoulos, Georgios Kopidakis, Evangelos P. Markatos. –In Proceedings of the 4th European Conference on Computer Network Defense (EC2ND 2008). December 2008, Dublin, Ireland. Elias Athanasopoulos, FORTHWP32

Organization SAPI –Software core, mini Operating System WSIM –Simulated environment Integration (SAPI, WSIM) –WISDOM Software Package –Main front-end 3Elias Athanasopoulos, FORTHWP3

SAPI High-Level API –Filter Creation –Firewall Configuration –Bridge with device using DLL provided by Avanex Filter creation –Predefined or custom Filter processing –Export in a snort-like language Filter feeding –WISDOM firewall –WISDOM simulator 4Elias Athanasopoulos, FORTHWP3

Example – Filter Creation /* filter example. */ SAPI_TCP_Filter *mailFilter = new SAPI_TCP_Filter(); mailFilter->SetDestinationPort(25); Elias Athanasopoulos, FORTHWP35

Example – Feed Rule to Device SAPI_Firewall *fw = SAPI::Board_Init(); /* filter example. */ SAPI_TCP_Filter *mailFilter = new SAPI_TCP_Filter(); mailFilter->SetDestinationPort(25); mailFilter->Apply(fw); Elias Athanasopoulos, FORTHWP36

Example – Feed Rule to WSIM SAPI_Simulator *ws = new SAPI_Simulator(); /* filter example. */ SAPI_TCP_Filter *mailFilter = new SAPI_TCP_Filter(); mailFilter->SetDestinationPort(25); ws->Attach(mailFilter->Export()); ws->Run(); Elias Athanasopoulos, FORTHWP37

Main Front End 8Elias Athanasopoulos, FORTHWP3 Launch WSIM Set Rules in the actual device Rule Inspector Predefined Rules Custom Rules

WSIM – Simulated Environment Information source –Real-time, traces Configuration –User driven, SAPI’s rule-set Stable application 9Elias Athanasopoulos, FORTHWP3

WSIM – Evaluation (40 Gbps) Elias Athanasopoulos, FORTHWP310 Packet Drops due to Congestion No False Positives Overall Processing

WISDOM Software Package Demo