OAC Core: Enhancing Network Security by Implementing an ML Malware Detection and Classification Scheme in P4 Programmable Data Planes and SmartNICs

恶意软件攻击对组织构成了重大威胁，组织使用各种方法来防范它们。例子包括在通用计算机上运行的入侵检测系统、入侵防御系统和其他安全系统。这些方案执行“深度数据包检测”（DPI），通过该过程，保护组织的安全设备彻底检查传入的流量并向管理员发出可疑活动警报。虽然DPI在某些情况下可能是有效的，但它需要大量的处理。此外，如果组织收到来自Internet的大量流量，DPI可能跟不上流量，可能只检查其中的一小部分。此外，检测可能不是实时进行的，可能只是在攻击发生后才检测到恶意软件。本项目建议利用P4可编程数据平面（PDP）交换机和智能网卡的能力来执行DPI。该项目有四个目标。1)开发一个运行在pdp上的恶意软件检测和分类应用程序，以线速率运行。应用程序将执行域名系统（DNS）数据包的DPI，防止恶意软件与相应的C2服务器通信。流量将被实时监控，通常在通用cpu上执行的功能将被卸载到pdp上。该计划包括分析DNS数据，描述流量模式，并将这些信息提供给机器学习（ML）算法。机器学习算法将检测和分类恶意软件根据他们的家族（例如，特洛伊木马，后门，勒索软件）。2)开发一个运行在SmartNIC上的恶意软件检测与分类应用，用于加密DNS报文。研究将对生成此类数据包的恶意软件进行特征提取。机器学习算法将使用这些特征来检测和分类恶意软件。3)开发一个控制应用程序，共享威胁情报，避免恶意软件传播。由于PDP交换机和智能网卡检测恶意软件，它们与中央控制器共享威胁情报。4)扩展eX-IoT平台，为新检测和分类的恶意软件提供指纹、存储和索引。eX-IoT平台是一个实时平台，用于在互联网上识别受损设备的指纹。在pdp和智能网卡上运行的原型将使用社区可用的开源组件构建，并且开发的知识将通过将其合成为课程和自定进度学习的虚拟实验室图书馆来传播。这些图书馆将分配给各大院校。最后，将与Internet2和FABRIC等组织一起组织恶意软件检测和pdp教程。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Malware attacks represent significant threats to organizations, which use a variety of approaches to protect against them. Examples include intrusion detection systems, intrusion prevention systems, and other security systems that run on general-purpose computers. Such schemes perform "deep packet inspection" (DPI), a process by which a security device protecting an organization thoroughly examines incoming traffic and alerts administrators about suspicious activities. While DPI may be effective in some scenarios, it requires significant processing. Furthermore, if the organization receives a high volume of traffic from the Internet, DPI may not keep up with the traffic and may only inspect a fraction of it. Additionally, the inspection may not be conducted in real-time and may only detect the malware after the attack.This project proposes to leverage the capability of P4 programmable data plane (PDP) switches and smartNICs to perform DPI. The project has four objectives. 1) Develop a malware detection and classification application running on PDPs, operating at line rate. The application will perform DPI of Domain Name System (DNS) packets, preventing malware from communicating with the corresponding C2 server. Traffic will be monitored in real-time, and functions commonly executed on general-purpose CPUs will be offloaded to PDPs. The plan includes analyzing DNS data, characterizing traffic patterns, and feeding such information to a machine learning (ML) algorithm. The ML algorithm will detect and classify malware according to their family (e.g., trojan, backdoor, ransomware). 2) Develop a malware detection and classification application running on a SmartNIC, for encrypted DNS packets. Research will be conducted to perform feature extraction for malware generating such packets. An ML algorithm will use the features to detect and classify the malware. 3) Develop a control application that shares threat intelligence and avoids malware propagation. As PDP switches and smartNIC detect malware, they share the threat intelligence with a centralized controller. 4) Expand the eX-IoT platform to fingerprint, store, and index newly detected and classified malware. The eX-IoT platform is a real-time platform for fingerprinting compromised devices on the Internet. The prototype running on PDPs and smart NICs will be built with open-source components available to the community, and the developed knowledge will be disseminated by synthesizing it as virtual lab libraries for courses and self-paced learning. The libraries will be distributed to colleges and universities. Finally, tutorials on malware detection and PDPs will be organized with organizations such as Internet2 and FABRIC.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.