CT-ISG: High-Speed Network Defense with Massive and Diverse Vulnerability Signatures

国家科学基金会提案0831508：海量多样漏洞的CT-ISG高速网络防御签名PI：严辰，西北大学鉴于日益复杂的互联网攻击，基于网络的入侵检测/防御系统至关重要。这样的系统主要有两个重要的衡量标准：准确性和吞吐量。准确性尤其重要，尤其是对于内联设备，当通过签名匹配识别为恶意连接时，这些内联设备会限制连接。最新的工作假设正则表达式(RE)是签名格式化的正确选择。然而，有一些多态和变质的变异可以躲避基于稀土的检测。RE签名的根本问题是在很多情况下无法捕获漏洞情况，在本项目中，我们设计了一个基于语义的下一代网络入侵检测/入侵检测系统(简称NetShield)，该系统包含数千个具有丰富多样性的漏洞签名，包括协议、文件和Web语义签名。在提供更高的准确性的同时，NetShield提供了可与最先进的基于正则表达式的入侵检测系统相媲美的高吞吐量。设计了1)高效的协议解析算法和2)海量协议语义签名匹配算法。此外，我们将解析和匹配解决方案扩展到Web和文件语义签名，该项目具有重要的广泛影响。研究部分将产生基础知识，这些基础知识将推动网络入侵检测系统/IPS系统的最先进水平。我们与行业研究人员的广泛合作将促进这种技术转让。此外，我们计划通过及时向开放源码社区发布软件/硬件、跟踪和基准来传播我们的工作，以供更广泛的使用。与这一研究议程相辅相成的是一个强有力的紧密结合的教育和外联部分。

NSF Proposal 0831508: CT-ISG High-Speed Network Defense with Massive and Diverse Vulnerability SignaturesPI: Yan Chen, Northwestern UniversityGiven the ever-increasing sophisticated Internet attacks, network-based Intrusion Detection/Prevention Systems (IDS/IPS) are of critical importance. Such systems mainly have two important metrics: accuracy and throuput. Accuracy is of particular importance, especially for IPSes which are inline devices that throttle connections when they are identified as malicious via signature-matching. The latest works assume that regular expressions (RE) are the right choice for signature formatting. However, there are polymorphic and metamorphic variations that can evade the RE-based detection. The fundamental problem of RE signatures is that in many cases it cannot capture the vulnerability conditions.In this project, we design a next-generation semantic based network IDS/IPS system (called NetShield) which contains thousands of vulnerability signatures with rich diversity, including protocol, file and web semantic signatures. While offering much better accuracy, NetShield provides high throughput comparable to that of the state-of-the-art regular expression based IDS. We design algorithms for 1) efficient protocol parsing and 2) massive protocol semantic signature matching. Furthermore, we extend the parsing and matching solutions to Web and file semantic signatures.This project has the potential for significant broad impact. The research component will produce fundamental knowledge that will advance the state-of-the-art in the network IDS/IPS systems. Our wide collaboration with industry researchers will facilitate such technology transfer. In addition, we plan to disseminate our work through timely releases of software/hardware, traces, and benchmarks to the open source community for broader usage. This research agenda is complemented by a strong and tightly integrated educational and outreach component.