1. Dependable Intrusion Tolerance March 2002 Magnus Almgren, Alfonso Valdes SRI International Acknowledgements Research sponsored under DARPA Contract N66001-00-C-8058. Views presented are those of the authors and do not represent the views of DARPA or the Space and Naval Warfare Systems Center

2. Outline t Background t System Components t The Single Proxy t Example t Validation t Performance t Stopping Code Red t Future Work

3. Background t Intrusion Tolerant Server

4. Background t Intrusion Tolerant Server u Redundancy & Diversity

5. Background t Intrusion Tolerant Server u Redundancy & Diversity u Hardened Proxy l StackGuard l Online Verifiers l Small Code Base

6. Background t Intrusion Tolerant Server u Redundancy & Diversity u Hardened Proxy l StackGuard l Online Verifiers l Small Code Base u HIDS/NIDS/app-IDS l EMERALD/Snort

7. System Components t Application Servers u Solaris, Win2k, RedHat, FreeBSD t IDS t Proxy u RedHat-6.2 u Our own code base MS Win2k IIS Solaris 8 (Sparc5) Apache eXpert-BSM RedHat 7.1 iPlanet FreeBSD 4.2 Apache App-IDS eXpert-Net eBayes-TCP eBayes-Blue Snort RedHat 6.2 Proxy eAggregator C-R

8. Proxy in Detail e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime

9. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

10. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

11. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

12. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

13. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager web attack Proxy Server Regime Manager

14. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

15. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

16. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

17. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager web answer

18. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager

19. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Regime Manager Policy/Regime Block client Block URI

20. Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Regime Manager Policy/Regime

21. Plans for Validation t Performance u Preliminary Results t Resistance to attacks u Compile a list of existing Web exploits u Run these against system u Problem: A very new attack, which we might not have thought about l Assembly of Complementary Mechanisms l Red Teaming?

22. Performance Measurement 1)Round-trip time measured through the proxy u Regime 1 — 4 2)Round-trip time measured directly for each application server Asking for index.html with all included images and measured round-trip time. About 34 kb in 9 requests.

23. Round-trip time 10 simultaneous clients

24. Response vs Number of Clients

25. Outline General principles Architecture overview Proxy functionality t Stopping Code Red t Summary

26. Stopping Code Red (and NIMDA) Proxy Bank IDS Appliance IIS 1. 3/4 of Code Red attempts miss the IIS server 2. IDS detects attempt. System invokes agreement mode 4. Clients get valid content while compromised server is rebuilt 3. In case of a successful infection, corrupt content is detected and reinfection attempts are blocked

27. Dependable Intrusion Tolerance t Intrusion Detection to Date u Seeks to detect an arbitrary number of attacks in progress u Relies on signature analysis and probabilistic (including Bayes) techniques u Response components immature u No concept of intrusion tolerance t New Emphasis u Detection, damage assessment, and recovery u Finite number of attacks or deviations from expected system behavior u Seek a synthesis of intrusion detection, unsupervised learning, and proof-based methods for the detection aspect u Concepts from fault tolerance are adapted to ensure delivery of service (possibly degraded)

28. Summary t Developing an adaptable intrusion tolerant server architecture t General Principles: u Hardened proxy u Redundant capability with diverse implementation u Adaptive response t A variety of IDS, symptom detectors, and on-line verifiers provide situational awareness t Stepped policy response enforces content agreement in suspicious situations

29. Future directions t Refine Alert Manager t Multiple proxies t Validate with existing exploits t Dynamic content