CT-ISG: High-Speed Network Defense with Massive and Diverse Vulnerability Signatures

NSF提案0831508：具有大规模和多样化漏洞特征的CT-ISG高速网络防御研究论文作者：陈燕，西北大学鉴于日益复杂的互联网攻击，基于网络的入侵检测/防御系统（IDS/IPS）至关重要。这样的系统主要有两个重要的指标：准确性和吞吐量。准确性尤其重要，特别是对于内联设备ips，当它们通过签名匹配被识别为恶意时，会限制连接。最新的工作假设正则表达式（RE）是签名格式化的正确选择。然而，存在多态和变质的变异，可以逃避基于re的检测。RE签名的根本问题是，在许多情况下，它无法捕获漏洞条件。在本课题中，我们设计了一个下一代基于语义的网络入侵防御系统（NetShield），该系统包含数千个具有丰富多样性的漏洞签名，包括协议、文件和web语义签名。在提供更好的准确性的同时，NetShield提供了可与最先进的基于正则表达式的IDS相媲美的高吞吐量。我们设计了1)高效协议解析和2)海量协议语义签名匹配算法。此外，我们将解析和匹配解决方案扩展到Web和文件语义签名。这个项目有可能产生重大的广泛影响。研究部分将产生基础知识，将推进网络IDS/IPS系统的最新技术。我们与行业研究人员的广泛合作将促进这种技术转让。此外，我们计划通过及时发布软件/硬件、跟踪和基准来传播我们的工作，以供开源社区更广泛地使用。这一研究议程还辅之以强有力的紧密结合的教育和外联部分。

NSF Proposal 0831508: CT-ISG High-Speed Network Defense with Massive and Diverse Vulnerability SignaturesPI: Yan Chen, Northwestern UniversityGiven the ever-increasing sophisticated Internet attacks, network-based Intrusion Detection/Prevention Systems (IDS/IPS) are of critical importance. Such systems mainly have two important metrics: accuracy and throuput. Accuracy is of particular importance, especially for IPSes which are inline devices that throttle connections when they are identified as malicious via signature-matching. The latest works assume that regular expressions (RE) are the right choice for signature formatting. However, there are polymorphic and metamorphic variations that can evade the RE-based detection. The fundamental problem of RE signatures is that in many cases it cannot capture the vulnerability conditions.In this project, we design a next-generation semantic based network IDS/IPS system (called NetShield) which contains thousands of vulnerability signatures with rich diversity, including protocol, file and web semantic signatures. While offering much better accuracy, NetShield provides high throughput comparable to that of the state-of-the-art regular expression based IDS. We design algorithms for 1) efficient protocol parsing and 2) massive protocol semantic signature matching. Furthermore, we extend the parsing and matching solutions to Web and file semantic signatures.This project has the potential for significant broad impact. The research component will produce fundamental knowledge that will advance the state-of-the-art in the network IDS/IPS systems. Our wide collaboration with industry researchers will facilitate such technology transfer. In addition, we plan to disseminate our work through timely releases of software/hardware, traces, and benchmarks to the open source community for broader usage. This research agenda is complemented by a strong and tightly integrated educational and outreach component.