1. UltraPAC ： automated protocol parser generator Daniel Burgener Jing Yuan

2. outline Background BinPAC BinPAC vs. UltraPAC Work so Far Future work

3. Background Anomaly detection – accuracy (vulnerability signature) – speed Vulnerability signature –parse the traffic stream based on application- level – obtain the signature by recovering the protocol field

4. Binpac Goal: –General parser for different application-level traffic Binpac ： –build a hierarchical topology to recursively parse the protocol Not effective for high speed NIDS/NIPS –construct the parsing tree –call the parsing function recursively

5. UltraPAC vs. Binpac UltraPAC –Based on binpac – specially for the vulnerability signature matching – parsing tree vs. parsing state machine

6. Work so Far: Designing UltraPAC UltraPAC parses a protocol written in the binPAC language to create a C++ parser The necessary data for this parser is stored in the “Field Table” fieldPrevNextlenvar lengtharcoun t Label, ptr_lo 8Y labellength? N ptr_lolength?8N

7. Work so Far: Designing UltraPAC BinPAC has many different data structures we need to handle. Expressions in the length or next field can be any of the following: Number : number Variable set in &let : store the expression, and mark necessary variables to be saved &oneline : the regular expression “.*\n” &restofdata : get the remaining length from the buffer class &until : If dependent on $input, lookup in buffer class, if dependent on $element, store and mark as in &let

8. Work so Far: Designing UltraPAC BinPAC has many different data structures we need to handle. Expressions in the length or next field can be any of the following: Regular expression matching : store a regular expression Case : store the expression that generates the case variable &If : store the expression to be checked Arrays : always given an ending condition, so parse that

9. Future Work Implement UltraPAC The Field Table has already been implemented by Hongyu Our job is to parse the various expressions as described in previous slides and store them in the field table By the end of the quarter, we expect to have a working parser generator Schedule: Two weeks: a parser that works for HTTP Three weeks: a parser working for all ASCII protocols Four weeks: a perfectly working parser