# Presentation: 752207

## Building Robust, flexible, Scalable  Distributed Intrusion Detection Systems (DIDSes)   

**Building Robust, flexible, Scalable  Distributed Intrusion Detection Systems (DIDSes)   **
**Hao Che**
*Department of Computer Science and Engineering*
*University of Texas at Arlington*

## Outline

** **
**Motivations**
**Proposed Solution**
**Thoughts on attack identification**
**Research goal**

##  Motivations 

**Intrusion detection systems (IDSes) must be distributed in dealing with distributed attacks**
**There are various types of DIDSes being built including:**** **
**Host-based versus network-based**
- Host-based DIDS
- Network-based DIDS
- Hybrid DIDS
**Centralized versus distributed**
- DIDS with centralized control
- DIDS with distributed control
- Both may be hierarchical or flat

##  Motivations

**A DIDS should be    **
_**Robust**_**: able to cope with partial failures of the DIDS through, e.g., dynamic resource sharing and dynamic load balancing**
_**Flexible**_**: able to allow, e.g., fast run-time software upgrade and rule table update, and flow tracking at various granularities**
_**Scalable**_**: able to keep up with multigigabit line rates and scale to large sized network  **
**In general, the existing DIDSes cannot meet all the above requirements simultaneously:**
**Most DIDSes do not address robustness issue**
**Software based IDSes cannot keep up with gigabit line rates**** **
**Hardware based solutions are lack of flexibility**

##  A Proposed Solution

**  ****Network level: building a Secured DIDS Overlay using ****	**
**   ****multipath for:**
**   **** ****both link and node resource optimization**
**   ****fast failure recovery**

- Network-based IDS

- Point-to-point multipath

- Host-based IDS

- Point-to-multipoint (multipoint-point) multipath

## A Proposed Solution

**Node level: a hybrid solution for network-based IDS design:****    **
**Separation of string matching into header matching and payload string matching**
**Stateful and stateless header matching and load balancing are handled by a fully run-time programmable network processor at multigigabit rate**
**Payload string matching is performed by a set of traditional sensors at lower rates **
**A network-based IDS may operate in one of the two modes: stealthy mode or inline mode**

## A Proposed Solution

**Stealthy Mode:  for intrusion detection only**

- tap

- To Remote Sensors

- Local Sensors

- Traffic Manager

- Framer

- SerDes

- TCAM Coprocessor

- CPU

- MEM

- Line Card

**Inline Mode:   for both intrusion detection and prevention  **

- To Remote Sensors

- Local Sensors

- Traffic Manager

- Framer

- SerDes

- TCAM Coprocessor

- CPU

- MEM

- Line Card

- Network Monitored

- Network Monitored

- Network Processor

- Network Processor

- IDS Console

- IDS Console

##  A Proposed Solution

**Intel IXP 2800 Multigigabit Network Processor:**
**Micro-engines (MEs) can be configured to work in pipeline and/or parallel**
**Each ME runs its own micro-code and the micro-code can be swapped at run-time **
**XScale Core maintains flow state and any other control plane functions**

##  A Proposed Solution

**A Four-Stage Configuration: **
**1****st**** stage: one ME distributes packets evenly to the MEs in the 2****nd**** stage**
**2****nd**** stage: a set of MEs performs stateful flow classification and load balancing**
**3****rd**** stage: a set of MEs reorder the out-of-order packets received from the 2****nd**** stage **
**4****th**** stage: outgoing packets are scheduled based on their QoS requirements****  **

- dispatcher

- load balancer

- sequencer

- scheduler

##  A Proposed Solution

**Summary of the proposed solution: **
**It enhances the robustness, flexibility, and scalability of the existing DIDSes**
**In the inline mode, the proposed IDS can also serve as a dynamic firewall for intrusion prevention**
**The run-time programmability of the proposed IDS is an important capability which can be further exploited to build intelligent DIDS   **

##  Thoughts on Attack Identification

**Two candidate techniques: **
**Robust identification**
**Frequency domain analysis**

**Two key components in a DIDS: **
**Attack identification**
**Alert correlation**

##  Thoughts on Attack Identification

**A state-of-the-art robust identification technique developed by experts in Control Area**
**Problem Statement:**
**Given:****  **
**a model of the plant under normal conditions G****o****(****λ****, ****∆****o****) **
**failure dynamics ****G****i****(****λ****, ∆****i****)**
**a bound ****δ**** on the measurement noise**
**Uncertainty sets ****∆****i**
**N input/output experiment measurements**
**Determine: **
**Whether a fault has occurred **
**In that case, isolate it and determine its strength**
**Can be used for both anomaly and misuse detections **

##  Thoughts on Attack Identification

**An immature thought on alert correlation**
**Frequency domain analysis may play an important role because: **
**Power spectrum captures the relative strength of the correlated signals at different frequencies or timescales**
**It is a mature research field and various tools are ready available**

##  Research Goal

**Research goal by the end of this summer: a detailed architecture of the proposed research with one of two possible outcomes: **
**A DIDS architecture with the proposed solution integrated with a new anomaly and misuse detection mechanism**
**A DIDS architecture that integrates the proposed solution with an existing DIDS**** **
**The outcome will serve two purposes: **
**A proposal for funding opportunities**
**The basis for the development of such a DIDS**** **

## Thanks!!!

**	**