PANDA - Precice Attack Detection for Network Domains by Application Classification

如今，对大型管理网域(例如，由多个子网组成的企业网络)上的攻击的检测通常通过分析到互联网的上行链路上的数据流量来集中完成。这允许检测来自互联网的攻击，但有很大的缺点。无法检测到内部攻击，无论它们是故意发起的还是由受攻击的(私人)设备触发的。全网分布式监测将是现有程序的一种有用的替代方案，但它面临许多仍未解决的问题：1.子网中的数据速率零星地非常高，并且经常高度可变(例如，高达10Gbit/S的负载峰值)。高数据速率以及通常用于监控的标准配置通常意味着高误警率。数据流量日益加密，避开了传统的分析方法。随着虚拟技术(如虚拟机和网络)部署的增加，建立了监控措施无法访问的区域。在执行安全监控时，通常会分别执行流聚合和深度数据包检测(DPI)。到目前为止，流量分析只考虑传输层以上的记账信息。虚拟网络等新技术稀释了由流聚合产生的传输层信息，因为相同的IP地址现在代表不同的系统。此外，新的协议，如HTTP/2，进一步使分析过程复杂化，因为经常缺少附加的上下文，例如，单个连接或多路传输。同样，由于没有关于观察到的应用的上下文信息，DPI经常陷入空白。在拟议的研究项目中，将补充使用流聚集方法和DPI方法。调查的关键方面包括显著减少网络传感器要分析的数据量、检查警报相关性、监控虚拟环境中的数据流、分析加密流量以推断支持的应用程序和应用协议，以及在管理域内进行合作分析的方法。除其他外，需要解决的问题包括准确识别应用程序(如果可区分，包括观察到的协议方言)，为DPI提供上下文以允许签名基础动态适应上下文；将安全信息从应用层高效地聚合到AppFlow以进行分析重新定位；聚合网络层下的信息以将虚拟系统整合到监测中；以及从连接期间启动握手中提取参数，以建立加密通道以检测过时的加密方法带来的漏洞。

The detection of attacks on large administrative network domains, e.g., an enterprise network consisting of multiple subnets, is nowadays usually accomplished centrally by analyzing the data traffic on the uplink to the Internet. This allows detecting attacks from the Internet, but has substantial disadvantages. Insider attacks cannot be detected, no matter if they are initiated deliberately or triggered by compromised (private) devices. A network-wide distributed monitoring would be a useful alternative to established procedures, but it faces a number of still unsolved problems:1. Data rates in the subnets are sporadically very high and often highly variable (e.g., load peaks of up to 10 Gbit/s).2. High data rates along with the standard configurations typically used for monitoring usually imply high false alarm rates.3. Data traffic is increasingly encrypted and eludes traditional analysis methods.4. The increased deployment of virtualization technologies, such as virtual machines and networks, establishes areas that are inaccessible for monitoring measures.When performing security monitoring usually flow aggregation and deep packet inspection (DPI) are carried out separately. Flow analysis so far considers only accounting information up to the transport layer. New technologies, such as virtual networks, dilute transport layer information resulting from flow aggregation because same IP addresses now represent different systems. In addition, new protocols, such as HTTP/2, further complicate the analysis process because additional context is often missing, e.g., single connection or multiplexing. Likewise, the DPI often runs into the void, since there is no contextual information regarding the observed application.In the proposed research project, the methods of flow aggregation and DPI will be used complementarily. Key aspects of the investigations are a significant reduction of the data volume to be analyzed at the network sensor, the examination of alarm relevance, the monitoring of data flows also in virtual environments, analyses of cryptographic traffic to infer supported applications and applied protocols, and methods for cooperative analysis within the administrative domain. Problems to be solved include, inter alia, an accurate identification of applications (including observed protocol dialects, if distinguishable) providing context for the DPI to allow a dynamic adaptation of the signature bases to the context, an efficient aggregation of security information from the application layer to AppFlows to allow analysis relocations, the aggregation of information beneath the network layer to enable the integration of virtual systems into the monitoring, and the extraction of parameters from initiating handshakes during connection establishment of encrypted channels to detect vulnerabilities raised by outdated crypto methods.