1. Bro: A System for Detecting Network Intruders in Real-Time Overview Structure Language Implementation Decisions Attack Against the System Application Processing Performance

2. Overview Real-Time Analysis Pure traffic analysis Separation of mechanism and policy Policy neutral Archiving Application layer Individual packets Supports intrusion prevention

3. Structure Passive tap Copies packets Libpcap tcpdump Event Engine organization PSI Event handlers

4. Language Highly Domain-Specific Data types Traditional: bool,int,count,double,string Specific: time,interval,port,addr,hostname Aggregate: record,table Operators Very similar to C Variables: Declaration/Indexing Statements

5. Implementation C++ Single-Threaded Blocking Timers Clendar queues Regular-Expression matching Custom: performance,functionality,compilation Policy Interpretation AST and execution stack Off-Line analysis

6. Attacking the Monitor Overload All Levels net_stats_update Crash Resource consumption UNIX alarm, self-check and tcpdump Subterfuge Difficult to perform and defend Extract tcp payload

7. Applications Finger record,check user,check buffer FTP Track unique sessions/state,port/multi-tcp,bounce Portmapper Detect RPC access Ident Check ports, check user ID, record Telnet/Rlogin Bifurcation,embedded occurrences,session contents Scan Detection: Policy script

8. Performance Buffers Tested with ~730 pckts/sec, peak 1,200 pckts/sec No dropped packets Abnormal legitimate behavior Private IP,TCP retransmit/acknowledgement, Urgent SYN,DF fragments, Split Routing Detectable w/ warning Distributed communicating Bros