PANDA - Precice Attack Detection for Network Domains by Application Classification

对大型管理网络域（例如，由多个子网组成的企业网络）的攻击检测，现在通常通过分析互联网上行链路上的数据流量来集中完成。这允许检测来自Internet的攻击，但有很大的缺点。内部攻击是无法检测到的，无论它们是故意发起的还是由受损的（私有）设备触发的。网络范围内的分布式监测将是现有程序的一种有用的替代方案，但它面临许多尚未解决的问题：子网中的数据速率偶尔非常高，并且通常变化很大（例如，负载峰值可达10gbit /s）。高数据速率以及通常用于监控的标准配置通常意味着高误报率。数据流量越来越加密，传统的分析方法无法对其进行分析。虚拟化技术（如虚拟机和网络）部署的增加，建立了监控措施无法访问的区域。在进行安全监控时，通常将流量聚合和DPI （deep packet inspection）分开进行。到目前为止，流分析只考虑到传输层的会计信息。新技术，如虚拟网络，淡化了由流聚合产生的传输层信息，因为相同的IP地址现在代表不同的系统。此外，新的协议，如HTTP/2，使分析过程进一步复杂化，因为通常缺少额外的上下文，例如，单连接或多路复用。同样，DPI也经常陷入空白，因为没有关于观察到的应用程序的上下文信息。在本研究项目中，将采用流量聚合和DPI相辅相成的方法。调查的关键方面是显著减少要在网络传感器上分析的数据量，检查报警相关性，监测虚拟环境中的数据流，分析加密流量以推断支持的应用程序和应用协议，以及在管理领域内进行合作分析的方法。需要解决的问题包括，除其他外，准确识别应用程序（包括观察到的协议方言，如果可区分的话），为DPI提供上下文，使签名库能够动态适应上下文；从应用层到AppFlows的安全信息的有效聚合，以允许分析重新定位；网络层下的信息聚合，使虚拟系统能够集成到监控中；对加密通道建立连接过程中发起握手的参数进行提取，检测过时的加密方法带来的漏洞。

The detection of attacks on large administrative network domains, e.g., an enterprise network consisting of multiple subnets, is nowadays usually accomplished centrally by analyzing the data traffic on the uplink to the Internet. This allows detecting attacks from the Internet, but has substantial disadvantages. Insider attacks cannot be detected, no matter if they are initiated deliberately or triggered by compromised (private) devices. A network-wide distributed monitoring would be a useful alternative to established procedures, but it faces a number of still unsolved problems:1. Data rates in the subnets are sporadically very high and often highly variable (e.g., load peaks of up to 10 Gbit/s).2. High data rates along with the standard configurations typically used for monitoring usually imply high false alarm rates.3. Data traffic is increasingly encrypted and eludes traditional analysis methods.4. The increased deployment of virtualization technologies, such as virtual machines and networks, establishes areas that are inaccessible for monitoring measures.When performing security monitoring usually flow aggregation and deep packet inspection (DPI) are carried out separately. Flow analysis so far considers only accounting information up to the transport layer. New technologies, such as virtual networks, dilute transport layer information resulting from flow aggregation because same IP addresses now represent different systems. In addition, new protocols, such as HTTP/2, further complicate the analysis process because additional context is often missing, e.g., single connection or multiplexing. Likewise, the DPI often runs into the void, since there is no contextual information regarding the observed application.In the proposed research project, the methods of flow aggregation and DPI will be used complementarily. Key aspects of the investigations are a significant reduction of the data volume to be analyzed at the network sensor, the examination of alarm relevance, the monitoring of data flows also in virtual environments, analyses of cryptographic traffic to infer supported applications and applied protocols, and methods for cooperative analysis within the administrative domain. Problems to be solved include, inter alia, an accurate identification of applications (including observed protocol dialects, if distinguishable) providing context for the DPI to allow a dynamic adaptation of the signature bases to the context, an efficient aggregation of security information from the application layer to AppFlows to allow analysis relocations, the aggregation of information beneath the network layer to enable the integration of virtual systems into the monitoring, and the extraction of parameters from initiating handshakes during connection establishment of encrypted channels to detect vulnerabilities raised by outdated crypto methods.