1. Network Security Lab Jelena Mirkovic sunshine@cis.udel.edu Sig NewGrad presentantion

2. Main Research Areas Distributed Denial of Service Distributed Denial of Service Distributed defense: DefCOM Distributed defense: DefCOM Internet Worms Internet Worms Worm simulation: PAWS Worm simulation: PAWS Cooperative defense: WIN Cooperative defense: WIN Detecting new malicious executables Detecting new malicious executables Application-level Honeynets, summarizing firewall logs, predicting routing changes … Application-level Honeynets, summarizing firewall logs, predicting routing changes …

3. Distributed Denial of Service

5. Ideal solution! Too much traffic Attack traffic looks like legitimate

6. Distributed Denial of Service Detect attack Stop attack Differentiate between attack and legitimate traffic

7. DefCOM Distributed defense against DDoS Distributed defense against DDoS Combines nodes at: Combines nodes at: Victim – Alert generators: detect attack and alert other nodes Victim – Alert generators: detect attack and alert other nodes Core – Rate limiters: stop attack by dropping traffic Core – Rate limiters: stop attack by dropping traffic Source – Classifiers: differentiate between legitimate and attack traffic Source – Classifiers: differentiate between legitimate and attack traffic Nodes cooperate through an overlay Nodes cooperate through an overlay

8. DefCOM AG RL C C Attack! 1. Attack detection

9. DefCOM AG RL C C 2. Forming the traffic tree mark = 3 mark = 5 mark = 12 mark 56 I see mark 3! I see mark 5! I see marks 12 and 56!

10. DefCOM AG RL C C 2. Forming the traffic tree

11. DefCOM AG RL C C 3. Distributed rate-limiting 100Mbps 50Mbps

12. DefCOM AG RL C C 4. Traffic differentiation 100Mbps 50Mbps L=76 M=43 L=6 M=20 L=33 M=17 L=4 M=25

13. DefCOM AG RL C C 4. Traffic differentiation 100Mbps 50Mbps L=76 M=43 L=6 M=20 L=33 M=17 L=4 M=25

14. Internet Worms  A program that:  Scans network for vulnerable machines  Breaks into machines by exploiting the found vulnerability  Installs some piece of malicious code – backdoor, DDoS tool  Moves on  Don’t need any user action to spread  Spread very fast!

15. PAWS  Parallel worm simulator  Runs on multiple machines – gain memory and CPU resources  Can simulate greater detail than single-node simulators  Can simulate various defenses  Machines synchronize with network messages

16. WIN  Worm information network  We need fast, automatic response to stop worms  How can we detect worms  How can we devise signatures quickly and automatically  How can we share signatures with other networks  How can we accept signatures from others and be sure we won’t filter out legitimate traffic