1. Introduction to Bro-ids
Seth Hall
International Computer Science Institute
2011 Educause Security Professionals Conference

9. Paul Baran

13. Data Distribution?

14. “There’s generally no detection,
and there’s almost never any response or auditing”
- Bruce Schneier
from “Secrets and Lies”

18. alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Driveby bredolab request to a .ru 8080 URI"; flow:established,to_server; content:".ru|3a|8080|0D 0A|"; fast_pattern:only; classtype:bad-unknown; sid: ; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Suspicious User-Agent Possible Reverse Web Shell (Microsoft Internet Explorer 6.0)"; flow:established,to_server; content:"User-Agent|3a| Microsoft Internet Explorer 6.0"; http_header; classtype:trojan-activity; sid: ; rev:2;)

21. Bro-IDS

22. Domain specific programming language!
Event driven programming model
Built in protocol parsing
Low level context free events
Scalable deployment model

23. Network Traffic
Protocol Parsing
Scripting Language

24. This is where you will work
Network Traffic
Protocol Parsing
This is where you will work
Scripting Language

27. TS = (Dec 4 19:02: )
ORIG_H =
ORIG_P = 50193
RESP_H =
RESP_P = 80
METHOD = GET
HOST = ff.connextra.com
REQUEST = /sportingbetUSA/selector/client?client=sportingbetUSA&placement=Score....
REFERRER =
USER-AGENT = Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:
CLIENT BODY SIZE = -
RESPONSE BODY SIZE = 0
RESPONSE = 302
RESPONSE MESSAGE = Moved Temporarily
KEYS FROM COOKIE = FrequencyCappingCookie,sportingbetUSA,CxtId

28. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Worker
Worker
Worker

29. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Traffic
CLUSTER DEPLOYMENT
Manager
Frontend
Load-balancer
Worker
Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Network Traffic
Worker
Worker
Worker

30. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Traffic
CLUSTER DEPLOYMENT
Manager
Frontend
Load-balancer
Worker
Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Network Traffic
Worker
State
Worker
Worker

31. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Traffic
CLUSTER DEPLOYMENT
Manager
Frontend
Load-balancer
Worker
Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Network Traffic
Worker
State
Worker
Worker

32. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Traffic
CLUSTER DEPLOYMENT
Manager
Frontend
Load-balancer
Worker
Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Network Traffic
Worker
State
Worker
Worker

33. CLUSTER DEPLOYMENT Manager Frontend Load-balancer Worker Worker Worker
Traffic
CLUSTER DEPLOYMENT
Manager
Frontend
Load-balancer
Worker
Worker
Proxy
Worker
Worker
Worker
Worker
Proxy
Network Traffic
Worker
State
Worker
Logs & Notices
Worker

34. Upcoming Better and extensible programming model Improved logs
More complete language features
Fewer bugs
“Out of the box” integration with Barnyard 2
Integration with external intelligence sources
2.5 more years on NSF grant!

35. Questions?