1. Counting bloom filters for pattern matching and anti-evasion at the wire speed
Author:
Gianni Antichi, Domenico Ficara, Stefano Giordano, Gregorio Procissi, and Fabio Vitucci.
Publisher:
IEEE Network 2009
Presenter: Chun-Yi Lee
Date: 2009/07/21

2. Outline Introduction The Anti-Evasion System Performance
System Architecture
Small Packets
System Optimization
Performance

3. Introduction How to evade standard pattern matching?
Splitting malicious strings into several packets, thus making useless the pattern matching on single packets.
Pattern : architecture
Packet flow a r c h i t e c t u r e
Packet 1
Packet 2
Packet 3 3

4. The Anti-Evasion System
Pattern Match Engine
System Architecture
Substring Detector 4

5. The Anti-Evasion System
System Architecture
Split strings to be searched in three-byte-long substrings and create a subCBF representing them 1 2
Sub pattern 1: ABC
Pattern : ABCDE
subCBF
Sub pattern 2: BCD
Sub pattern 3: CDE 5

6. The Anti-Evasion System
System Architecture
PME
pattern 1 striCBF
Substring Detector (SD) 1 ‥‥ 3
flow 1
subCBF
hit
pattern 2 striCBF
packet 1 2 ‥‥ 1 2 ‥‥
pattern 5 striCBF
flow 2 2 1 ‥‥ ‥‥
pattern k striCBF
flow m 1 ‥‥ 2 6

7. The Anti-Evasion System
System Architecture
Whenever a striCBF is completely reset to zero, it is assumed that the string was detected.
hi(sub pattern)
subCBF match sub pattern of
patter k 1 2 3 1 2
Pattern k striCBF of flow n
Pattern k striCBF of flow n 7

8. The Anti-Evasion System
System Architecture
Such a CBF represents all the remaining characters of the string in the format (char, pos)
pos is the sequence number of the byte that gets off the string is associated to the filter. 8

9. The Anti-Evasion System
Small Packets
If an attacker splits the signature in several one or two byte long packets, the system cannot detect the attack
Pattern : architecture
Packet flow a r c h i t e c t u r e
Packet 1
Packet 2
Packet 3
Packet 4
Packet 5
Packet 6 9

10. The Anti-Evasion System
Small Packets
We divert all the small packets to a slow path engine.
The slow path engine must reassemble such flows and perform a deterministic pattern matching on them to verify the actual presence of an attack. 10

11. The Anti-Evasion System
System Optimization
In some cases the beginning of a signature is missed, because it is too short to be revealed by the substring detectors.
Pattern : architecture
Packet flow X a r c h i t e c t u r e
Packet 1
Packet 2
Packet 3 11

12. The Anti-Evasion System
System Optimization
In for the efficiency of our system, it seems advisable to set an “emptying threshold ” α for the striCBFs
attack is considered as detected 12

13. Performance
Performance of the standard system in terms of detected attacks and false positives 13

14. Performance
The effects of deleting the most frequent substrings. 14

15. Performance
Detection percentage and false positives by varying α 15