An Evasive Attack on SNORT Flowbits Tung Tran Universi - PDF document

AnEvasiveAttackonSNORTFlowbitsTungTranUniversityofWaterlooWaterloo,Canadat3tran@uwaterloo.caIssamAibUniversityofWaterlooWaterloo,CanadaEhabAl-ShaerUniv.NorthCarolinaCharlotte,NCRaoufBoutabaUniversityofWaterlooWaterloo,Canadarboutaba@uwaterloo.ca„Thesupportofstatefulsignaturesisanimportantfeatureofsignature-basedNetworkIntrusionDetectionSystems(NIDSs)whichpermitsthedetectionofmulti-stageattacks.However,duetothedif“cultytocompletelysimulateeveryapplicationprotocol,severalNIDSevasiontechniquesexploitthisAchillesheel,makingtheNIDSanditsprotectedsystemseeandexplainapacketsequencedifferently.Inthispaper,weproposeanevasiontechniquetotheSnortNIDSwhichexploitsits”owbitsfeature.Wespecifythe”owbitevasionattackandprovidepracticalalgorithmstosolveitwithcontrollablefalsepositivesandformallyprovetheircorrectnessandcompleteness.WeimplementedatoolcalledSFETwhichcanautomaticallyparseaSnortruleset,generateallpossiblesequencesthatcanevadeit,aswellasproduceapatchtoguardtherulesetagainstthoseevasions.AlthoughSnortwasusedforillustration,boththeevasionattackandthesolutiontoitareapplicabletoanystatefulsignature-basedNIDS.I.INTRODUCTIONSnort[12]isapopularopensourceandlightweightNetworkIntrusionDetectionandPreventionSystem(NIDPS)[2].Itismostlysignature-basedandfamousforitsintrusiondetectioncapabilitiesthatmatchpacketcontentagainstasetofrules.Snortsupportsa”exibleandrichrulelanguagewhichallowuserstoinspectall“eldsofapacket.Thewas“rstintroducedinSnort2.1.1andallowsthedetectionenginetotrackstateacrossasingleTCPsession.Thesupportofstatefulsignaturesallowsasignature-basedIDStodetectmulti-stageattacks.Becauseofitsimportance,thisfeatureissometimesseparatelyimplementedforspeci“cservices[21].isessentiallya”agthatcanbesetbysomeruleandthenusedbyanotherone.Theoptionworksbyusinglabelstosetandchangethesessionstate.Formally,ithasthe”owbits:[[un]set[[un]set|isnot|re]set,noalert][,TableIliststwo”owbitrulestakenfromBleedingEdge[1],whichtracksanFTPsession.Wewillillustratetheessenceofourevasiontechniqueusingthissimpleruleset.The“rstrulechecksifausertriestologintotheFTPserver,inwhichcaseitsetsthe”owbitandnoalertisraised”owbit).Thesecondruleraisesanalert(absenceofa”owbit)iftheuserusestheHowever,thisoccursonlyiftheuserhasnotloggedinyet,i.e.thelabelisnotset.Thisrulesetcandetectsomeoneusingthecommandwithoutpriorloginintotheserver.However,aunauthorizedattackercanalwaystrytologinthenTABLEIXAMPLEOFANORTFLOWBITSRULESET alerttcp$EXTERNAL NETany- NET21(msg:BLEEDING-EDGEFTPUSERlogin”owbitŽ;”ow:established, server;content:USERŽ;nocase;:set,login; alerttcp$EXTERNAL NETany- NET21(msg:BLEEDING-EDGEFTPHP-UXLISTcommandwithoutloginŽ;”ow:established,to server;content:LISTŽ;nocase;:isnotset,login;) usethecommandeventhoughtheloginwasnotgranted.TherulesetmakesSnorttreatanyloginattemptassuccessfulandhenceallowsthecommand.ThisisanexamplewhereaNIDSmisjudgestheapplicationprotocolsessionandtheevasionsucceeds(noalertraised).Inthispaper,actualsessionreferstotheapplicationprotocolsessionbeingprotected,andactualsessionstatereferstothestateofthatapplicationprotocolsession.Snortsessionpicturesaninternalrepresentativesession(oftheapplicationprotocol)maintainedbySnort,andsessionstaterepresentsthecollectivevalueofeach”owbitoftheruleset(ref.Def.1below).Thein-Snortsessionstatesupposedtore”ecttheactualsessionstate.However,thelargenumberandcomplexityofexistingprotocolsandcontinuousappearanceofnewonesmakesitgenerallyimpossibletocompletelysimulateactualsessionstatesinSnortbecauseofobviousperformanceandstoragereasons.Theevasionattackweidentifyinthispaperexploitsthispracticalinevitability.AlthoughitisillustratedforSnort”owbitrulesets,ourevasioncanbeappliedtoanyNIDSsupportingstatefulsignatures.II.RELATEDSeveralattacksonIDSeshavebeenidenti“edinthelit-erature.PtacekandNewsham[11]werethe“rsttobringupawaytoevadeaNIDSbyusingTCPSegmentationandIPFragmentation,andFragRouteisthetoolcreatedtocarryouttheseevasiontechniques.ANIDSneedstocarryoutTCPsegmentsandIPfragmentsreassemblytodefendtheseevasiontechniques.[6]describesadifferentsolutiontostatefulIDSevasionthatreliesonanextendedversionoftheIDSstatetransitiondiagram.HandleyandPaxson[5][10]discussedevasiontechniquesbasedoninherentambiguitiesoftheTCP/IPprotocolwhichleadstoadifferencebetweenaNIDSanditsprotectedsysteminperformingTCPsegmentsandIPfragmentsreassembly.Traf“cnormalizationsuggestedbyHandleyetal.[5]triestoremovetheseambiguitiesby2012IEEE 351 patchingthepacketstream.AnothersolutiontothisisActiveMapping,whichwasproposedbyShankarandPaxson[16]andeliminatesTCP/IP-basedambiguityinaNIDSanalysiswithminimalruntimecostandisimplementedintheStream5[9]preprocessorofSnort.BesidesNIDSevasiontechniques,thereareattacksonNIDSsaswell.WagnerandSoto[23]revealedmimicryattacksonaHost-basedIDS.Snot[18],Stick[4],IDSWakeup[15]andMucus[8]areover-stimulationtoolsthatcauseaDOSattackonSnortbytryingtooverloadSnortwithalertsfrommutatedpacketsconstructedfromSnortrules.AnotherDOSattacktoaNIDScomesfromthealgorithmiccomplexityissue[3][17],especiallytheauthorsin[17]presentedahighlyeffectiveattackagainstSnort,andprovidedapracticalalgorithmicsolutionthatsuccessfullythwartstheattack.Relatedtothesignature(rules)testingandevaluation,Vignaetal.[22]introducedamechanismthatgeneratesalargenumberofvariationsofanexploitbyapplyingmutantoperatorstoanexploittemplate.ThesemutantexploitsarethenrunagainstavictimhostprotectedbyaNIDS.Theresultsofthesystemsindetectingthesevariationsprovideaquantitativebasisfortheevaluationofthequalityofthecorrespondingdetectionmodel.Besides,Mucus[8]isalsoatestingtoolforSnortrulesbyusingmatchingpacketswithrandomdatainthepacket“eldsnotconsideredbyagivenRubinetal.[14]observedthatdifferentattackinstancescanbederivedfromeachotherusingsimpletransformations.TCPandapplication-leveltransformationsaremodeledasinferencerulesinanatural-deductionsystem.Startingfromanexemplaryattackinstance,theyusedaninferenceenginetoautomaticallygenerateallpossibleinstancesderivedbyasetofrules.TheycreatedAGENT,atoolcapableofbothgeneratingattackinstancesforNIDStestinganddeterminingwhetheragivensequenceofpacketsisanattack.However,ourattackisnotaninstancegeneratedbyAGENT,assumingthattherulesetrepresentstheoriginalexemplaryattackinstance.OurattackisneitheraTCPnoranapplication-leveltransformation.Existingevasiontechniquescanbeusedbyourattack,how-ever,thesetechniquesonlyapplytoinjectedpacketswhicharenotpartoftheactualsession.AlthoughourpaperonlydealswithSnortrules,whicharemainlymanuallywrittenbyusers,automaticallygeneratedsemantic-awaresignatures[24]orsessionsignatures[13]arealsopotentiallyvulnerabletoouridenti“edattack.Inordertoavoidfalsepositives,thesegeneratedsignaturesmustconsiderinnocentŽpaths(orsequences)whicharenotattackinstances.OurattackexploitstheseinnocentŽpathsandtriestoconvinceSnortthattheactualsessionisfollowingoneofthem.III.SNORTLOWBITVASIONLetS=,...,beaSnort”owbitruleset.Wede“nearulethatraisesanalertwhentriggered(i.e.hasno”owbit)asaTargetrule;andTargetrulesetthesetofalltargetrulesinaruleset.Theevasionproblemconsistsof“ndingallpossiblepacketsequencesthatsuccessfullyattacktheserviceprotectedbySyetmanagenottotriggeranytargetruleofS.Itcanalsobede“nedonatargetrulegroup,whichisasubsetofthetargetrulesetcontainingruleshavingthesamematchoptionsexceptthe”owbitsconditions.De“nition1(Sessionstate):Itrepresentsthegroupof”owbits(labels)thatarecurrentlyset(duringaruntimesession).Ifisthenumberof”owbitsusedintheruleset,thentherearepotentiallydifferentin-Snortsessionstates.ItisaTargetstateifthe”owbitsetitrepresentscorrespondtotheconditionofatargetrule,otherwiseitiscalledanon-targetTargetpacketisapacketthatmatchesanytargetruleandpresumablythelastpacketinthepacketsequenceofarealattack.A”owbitruleisevadableifitcanbetriggeredbytheattackertochangeanin-Snortsessionstatewhilepreservingtheactualsessionstate.Anevadablerulecanbetriggeredbytwodifferentkindsofpackets:apacket(fromtheconnectionsession)thattriggerstheruleandcorrectlyre”ectswhatSnortthinksŽaboutthesession,andapacketthatisnotsupposedtotriggertheruleandmakesSnortmisjudgethesession.Givenarule,letrepresentthe“rstkindofpackets,callednormalpacketsrepresentthesecondkind,calledevasionpacketspacketscauseachangeinthein-Snortsessionstate(by),buthavenoeffectontheactualsessionstate.Apacketsequenceisconsideredasuccessfulevasionattackifrightbeforethetargetpacketissentthepacketsequenceputstheactualsessioninoneofthetargetstatesandputsthein-Snortsessioninoneofthenon-targetstates.Wecanassumethat,whentheactualsessionisinoneofthetargetstatesandthein-Snortsessionisinoneofthenon-targetstates,theattackerwillalwaystriggerthesendingofthecorrespondingtargetpacket.Asaresult,theproblemcanberede“nedas“ndingallpossiblepacketsequencesthatputtheactualsessioninatargetstateandthein-Snortsessioninanon-targetstate.IV.LANGUAGEOFALLLOWBITSVASIONSADeterministicFiniteStateAutomaton(DFA)representa-tionofa”owbitsrulesetcanbederivedusingamappingfromsessionstates.Alg.1constructsthein-Snort()andactual)sessionstateDFAofarulesetS.Ascanbenoticed,thetwoautomatahavethesamealphabet,setofstates,startstateandthesetofacceptstates.Theonlydifferenceisinthetransitionfunctionwherechangesstateforevasionpackets(line14)whiledoesnot.bethelanguagescorrespondingtorespectively.WhilerepresentsallpacketsequencesthatSnortthinkstoputthesessioninatargetstate,representsallpossiblepacketsequencesthattrulyputthesessioninatargetstate.Thegoalisthento“ndallpossiblepacketsequencesthattrulyputinatargetstatebutnot.Thesepacketsequencesmusthencebeacceptedbyandrejectedby.Inotherwords,thesepacketsequencesareacceptedbyboththe.Ifweconsiderthesepacketsequencesasalanguage,say,then:Lemma1(Languageofall”owbitsevasions):languageofallpacketsequencesthatsuccessfullyattack 2012IEEENetworkOperationsandManagementSymposium(NOMS) Algorithm1ConstructionofSnort()andActual(SessionDFAs Setofstates:reachablesessionstatesconstructedfromtheruleStartstate:thestatewherenolabelisset.Acceptstates:alltargetstatesisnotatargetruleisevadableisnotatargetruleTransitionfunctionforallnontargetruleforallstateAstateBcanbetriggeredatAoutputstateofwhentriggeredfromendifA,PtobothisevadableA,PA,Pendifendforendfor theserviceprotectedbyarulesetSusing”owbitsevasionV.TNORTFFECTINGCTUALTATEA.Packet-basedpropertyofSnortSnortisapacket-basedNIDSandmostpacketsitreceivesarecheckedbythedetectionengine.Thisfeatureallowsthecreationofevasionpackets.Onemethodistoconstructapacketthatmatchesagivenrule,however,withanoutoforderŽTCPsequencenumber.ThispacketisnotprocessedbythereceiverapplicationlayerbutisstillexaminedbytheSnortdetectionengine(thentriggerstherule).Snort,withthestream5preprocessorenabled,knowsthatthepacketdoesnothaveanexpectedsequencenumberforthesessionstreamandisoverlappingwithapreviouspacket(assumingthatthispreviouspackethassomepayload).Inthiscase,Snortdoesexactlyastheprotectedhost:notreassemblethispacketintothesessionstream.However,thepacketisstillpasseddowntothedetectionenginebecausethepacketmaymatchsomeTCP-basedattackswherethesequencenumberisnotimportant(e.g:Nmap[7]usesTCPpacketswithrandomsequencenumbertoprobeahostsOS).Hence,itisalwayspossibletoconstructapacket(withanout-of-orderŽTCPsequencenumber)tofakearequestfromtheclientandinjectitintotheconnectionsession.Therefore,anySnort”owbitrulematchingtraf“cfromtheclientsidecanbetriggeredwithoutcausingtheactualsessionstatechange.ThiswastestedwithSnort2.9.1[20],thenewestversionatthistime.B.LooserulesWesaythata”owbitruleisifitdoesnotmatchpacketsusingtightoptionslike,oroffset.Alooserulecanwronglyexplaintheintentionofapacketifthepacketjusthappenstomatchtherulebutlogicallydoessomethingelse.Moreover,itispossibletocreateortriggerthesendingofsuchapacket.Thepacketcanevenbecreatedfromtheconnectionsessionitself.Dependingontheserviceprotocol,anattackermaybeabletomakearequestfromtheclient-sidethatmatchesalooserulewhilelogicallydoingsomethingelseratherthanwhattheruleexpects.Forexample,consideralooserulethatchecksifauserthatiscurrentlyinanFTPsessionistryingtoquitthesessionbyexaminingclient-sidepacketscontainingintheirpayload.Theattackercanmakearequesttocreateadirectorynamed,whichhappenstohavethepacketpayloadandcausesSnorttomisjudgethesession.Itishardertoevasivelytriggeralooserulematchingtraf“cfromtheserversidethantheclientsidebecausetraf“cfromtheserversideisnotalwayscontrollablebytheattacker.However,whendealingwithinteractiveprotocols,therearemanytrickstheattackercanusetocausetheservertosendapacketcontainingdesiredstringsandthentriggertherule.ConsiderarulewhichchecksforanypacketfromtheserverinatelnetsessioncontainingthestringGrantedŽinthepayload.TheattackercanissueaninvalidcommandcontainingGrantedŽ.Theserverwillsendbackanunknowncommanderrormessage,whichhappenstocontainthestringGrantedŽ,andhencetriggerstherule.AnothertrickistocreateafoldernamedGrantedŽandthentrytolistallthefolders.VI.EXAMPLEOFALOWBITSVASIONTherulesetinTableIIfollowsanFTPsessionandraisesanalertifanon-adminusertriestodoanythingrelatedtoanimportant“lewhoseaccessisrestrictedtoadministratorsonly.Forsimplicity,weshowonlytheandtheoptionsinarule.Theoptiondenotesthepurposeofadetermineifanon-adminuserisloggingin.indicatesthattheuserisdeniedtologin.iftheuserhassuccessfullyloggedin.indicatesthattheuserhasloggedoutoftheFTPsession,andchecksifthelogged-inusertriestodoanythingwitharestricted“leandraisesanalert.Onlyisatargetrule.Theoretically,anyruleisevadable,butinthisexample,forsimplicity,weassumethatonlyis.Thismeansthattheattackercancomeupwithawaytotriggerwithoutaffectingtheactualsessionstate.HecanaccomplishthisinmanydifferentwayswhicharediscussedinSectionV.Threelabelsareusedinthisruleset,leadingtopossiblestates.However,onlyfourofthesearereachable,includingthestartstate(nolabelset):A=,B=nalu,nalpandD=nalu,nalp,nauld.Thein-SnortDFAandactualsessionstateDFAaredepictedinFig.1andFig.2.Theintersectionof,whichisconstructedinFig.3,where(A,A)isthestartstateand(D,A), 2012IEEENetworkOperationsandManagementSymposium(NOMS) Fig.1.oftheFTPruleset Fig.2.oftheFTPrulesetTABLEIIFLOWBITSRULESETTODETECTANONADMINUSERACCESSINGARESTRICTEDFILEFROMAN msg:FTPNon-adminUserLoginAttempt-Senduser-:set,nalu;:noalert; msg:FTPNon-adminUserLoginAttempt-Sendpass-wordŽ;:isset,nalu;:set,nalp; msg:FTPlogindeniedŽ;:isnotset,nauld;:isset,nalu;:isset,nalp;:unset,nalu;:unset,nalp;:noalert; msg:FTPlogingrantedŽ;:isset,nalp;set,nauld;:noalert; msg:FTPuserexitsŽ;content:QUITŽ;nocase;:isset,nauld;:unset,nauld;:unset,:unset,nalp;:noalert; msg:Non-adminUseraccessesrestricted“leŽ;isset,nauld; (D,B),and(D,C)areacceptstates.Thelanguagecorrespond-ingtothisrepresentsallpossiblepacketsequencesthatsuccessfullyattacktheFTPserver.Forexample,isasuccessfulevasivepacketse-quenceacceptedbythis.Theattackercanapplythispacketsequencetoperformarealattackasfollows:First,theattackerlogsinasanormaluser(nonadmin)withacorrectusernameandpassword.Thisactionneedstobesentfromtheattackerandleadstothesendingoffromtheservertoindicatethattheuserissuccessfullyauthorized.Thenextsteptheattackerneedstodoistocausethesendingof.Therearetwooptionstocreate.The“rstistomanuallyconstructandinjectintotheconnectionapacketthatmatchesbuthasanout-of-ordersequencenumber.ThesecondistosendapacketthatmatchesbutlogicallydoessomethingelseratherthanexitingthesessionasSnortthinks.Theattackercancreateadirectorynamed,whichmakesSnortmisjudgethesessionandthinkthattheuserhasloggedout.Afterthat,theattackercandownloadoraccesstherestricted“leattheserver.Thislastactiondoesnottriggersthetargetruleandtheevasionsucceeds. Algorithm2”owbitsRectify small(TargetRuleGroup bethe”owbitsevasionDFAfortargetrulegroupforallacceptstateremoveoutgoingtransitionsofendforthesetofallsimplepathsfromthestartstateoftoanacceptstate.forallsimplepath,whereisthesignature(oranevasion)ofruleCreateanew”owbitsrulesetbea”owbitslabelthatissetbydefaultforCreate”owbitslabelAddtotheruleconsistingof:”owbits:isset,;”owbits:set;”owbits:noalert;alloptionsinintheoriginalruleset(headerandbody)exceptthe”owbitsoptionsendfor//targetruleCreate”owbitslabelbeatargetruleinAddtotheruleconsistingof:”owbits:isset,;”owbits:setalloptionsinintheoriginalruleset(headerandbody)exceptthe”owbitsoptionsendfor VII.FLOWBITSVASIONECTIFICATIONA.SolutionforsmallrulesetsWecanconsiderasadirectedgraph.Theoretically,weneedtoaddarulesettodetecteachpathfromthestartstatetoanacceptstate,whichwecallanevasionpath.Fortunately,itisenoughtoconsideronlysimpleevasionpaths,whereasimplepathisapathwithnocycles.Thisisbecauserulesaddedtodetectallsimpleevasionpathscanactuallydetectallevasionpaths.Moreover,itissuf“cienttoconsideronlysubsetpathsoverallsimplepaths.Alg.2detailsthisprocedure.Simplepathtranslationintoarulesetisgiveninlines12-19withthetargetruleinlines21-27.Forexample,thesetof 2012IEEENetworkOperationsandManagementSymposium(NOMS) Fig.3.oftheFTPruleset Fig.4.SimpleevasionpathsimplepathsSPcollectedfromofFig.3hasonesimplepath(afterremovingsubsetpaths)asshowninFig.4.Thereare“verulesaddedforthissimplepathasshowninTableIII.ThefactthatAlg.2searchesforallsimplepathstotargetstates(line5)attributestoitanexponentialworsttimecomplexity.Hence,Alg.2isonlysuitableforrulesetsofasmallsize.Intheevaluation,thecomputationallimitisquicklyachievedforrulesetsofsize.Inthefollowing,wepresentadifferentsolutionthatisfeasibleforbothsmallandlargeruleB.SolutionforlargerulesetsForlargerulesets,wewilluseThm.1below(proofinDe“nition2(VulnerableRule):Itisanevadablerulethatrenderstherulesetvulnerable()evenifallotherrulesarenotevadable.Theorem1:Ifasetofevadablerulesmakestherulesetvulnerable,thenatleastoneoftheseevadablerulesisvulnerable.(Thistheoremcanbeprovenusingcontradiction)Itfollowsthatanyevasionsequenceneedstoexploitatleastoneevadablerule,i.e.,itcontainsatleastoneevasionpacket.Hence,theideaistobehaveinawayandseta”agwheneveranevadableruleistriggered.IfSnortseesatargetpacketwhilethe”agisset,itraisesanalert.Interestingly,TABLEIIIULESADDEDFORTHESIMPLEPATHIN ”owbits:set,;”owbits:noalert; ”owbits:isset,;”owbits:set,;”owbits:noalert; ”owbits:isset,;”owbits:set,;”owbits:noalert; ”owbits:isset,;”owbits:set,;”owbits:noalert; ”owbits:isset, Algorithm3”owbitsRectify Large(TargetRuleGroup correspondingto//Findvulnerablerulesof;//setofvulnerablerulesforallnontargetruleinrulesetS,whereistheonlyevadablerule.hasareachableacceptstateendifendforcreatenewlabelAddnewruleconsistingof:begin”owbits:isset,;//the”owbitsconditionallheaderandbodyoptionsinatargetruleofexcept”owbits.forallAddto”owbits:set,endforendif Thm.1tellsusthatweonlyneedtodothiswithvulnerableAlg.3startsbydeterminingthesetofvulnerablerules(lines4…10).Next,itpatchesineverydestinationstateofavulnerablerulebysettingthe”ag(line19).Onceavulnerablerulehasbeentriggered,analertisraisedattheencounterofasignaturebelongingtoatargetruleregardlessofthe”owbitsstate(lines15…16).Thispessimisticapproachcomesataperformancecost.However,itbringsthebene“tofhavingapolynomialcomplexity,whichisanimportantscalabilityenhancementoverAlg.2.ConsideringtherulesetofTableIIandassumingallrulesareevadable,the“rststepofthealgorithm(lines1…9)indicatesthatonlyrulesarevulnerable(notethatFig.3isthecreatedassumingonlyisvulnerable). 2012IEEENetworkOperationsandManagementSymposium(NOMS) Fig.5.VulnerableandsaferulesetspercentagewhenSFETisruninthecautiousmode Fig.6.AverageOverheadtopatchsmallrulesets Fig.7.AverageOverheadfromfalsepositivescontrolpatch(forsmallandlargerulesets) Fig.8.Averagefalsepositivesratecausedbythesmallruleset Fig.9.Averagefalsepositivesratecausedbythelargeruleset Fig.10.Averagefalsenegativesrateforthesmallandlargerulesetsolutionsaremodi“edbyinsertingthe”owbitsoptionistheaddedruleandallotherrulesarethesame.TableIVshowsthemodi“edandaddedrulestopatchtheruleset.WecanformallyprovethatbothAlg.2andAlg.3arecomplete(rulesetssemanticspreserved)andsound(fullyeliminatethe”owbitsevasion).C.FalsepositivescontrolEventhoughtheapproachusedforlargerulesetsalsoworksforsmallrulesets,itpotentiallycausesmorefalsepositives.Whilethelatteronlyraisesanalertifacompleteevasionsequenceisseen,theformerdoessoonlyforimportantpacketsinanevasionsequence.However,theoverheadcausedbythelatterislarger.Inordertoavoidfalsepositives,Snortneedstoconsidersessionpacketsbeyondatargetstate(inthepatchedruleset).Thesecangivecluesaboutwhoisrunningthesession.Ifatargetpacketisencounteredright 2012IEEENetworkOperationsandManagementSymposium(NOMS) TABLEIVODIFIEDANDADDEDRULESUSINGTHELARGERULESETSAPPROACH ”owbits:isnotset,nauld;”owbits:isset,nalu;”owbits:isset,nalp;”owbits:unset,nalu;”owbits:unset,nalp;”owbits:set,;”owbits:noalert; ”owbits:isset,nauld;”owbits:unset,nauld;”owbits:un-set,nalu;”owbits:unset,nalp;”owbits:set,;”owbits: msg:NormalUseraccessesimportant“leŽ;”owbits:isset, awayitismostlikelythatitisanattack.Otherwise,ifthefollowingpacketscontinuetriggeringnormaltransitionsinasnormalusersdo,itbecomesmoreandmoreprobablethatitisabenignsession.Hence,themoresessionpacketsareconsideredafterward,themoreaccuratethedecisionbecomes.InordertodetermineallpossibleactionsanormalusermightdoafterSnortisputintoatargetstate,weneedtoknowallthestatesinafteranevasionsequencehasbeenidenti“ed(forsmallrulesetsolution)orafteravulnerableruleistriggered(forlargerulesetsolutions).Thenallpossibleactionsofanormaluserareequivalenttoallpathsstartingfromanyofthesestates.Asaresult,wecancreaterulescorrespondingtothesepathstocontrolthefalsepositivesratecausedbythepatchedruleset.Thereisalwaysatradeoffbetweenvulnerabilityandfalsepositives.Apatchedruleset(whetherforthesmallorlargerulesetalgorithms)haszerofalsenegativesyetpotentiallyalotoffalsepositives.Ontheotherhand,anonpatchedvulnerablerulesethasnofalsepositives(withregardsto”owbitevasion).Thefalsepositivescontrolpatchmakestherulesetvulnerableagainbecauseasmartattackercanalwayssendpacketscorrespondingtoallpossibleactionsanormalusermightdobeforesendingthetargetpacket.However,thisfalsepositivescontrolpatchisusefulwhenmissingfewevasionsisbetterthanhavingtoomanyfalsepositives.LetLbethelengthofactions(orpathlength)Snortconsidersafteritisputintoatargetstatetodecideifthesessionisrunbyanormaluserornot.ThetradeoffwehaveisthattheshorterLweuse,thelessfalsepositivesweobtain,however,themorefalsenegativeswemightcause.VIII.IMPLEMENTATIONVALUATIONWedevelopedaprogramcalledSFET(SnortFlowbitsEvasionTool)toparsearuleset,checkiftherulesetisvulnerabletotheproposedattack,generatethecorresponding(orevasionsequences)andpatchtherulesetaccordinglydependingonitssizeandthenumberofevasionsequences.SFETcanberunin3modes:speci“edmode,automaticmodeandcautiousmode.Inthespeci“edmode,SFETallowsuserstospecifywhichruleisevadableandwhichruleisatargetrule.Intheautomaticmode,SFETitselfdecidesthepossibilityofaruletobeevadablebasedontherulesmatchingoptions(likecontentoptionsandtraf“cdirectiontherulematches)andchoosesruleswithnoastargetrules.Lastly,inthecautiousmode,SFETassumesallrulesinarulesetareevadable.Arulesetisconsideredvulnerableifthereexistsanevasionsequenceforanychosentargetrule.Wecollectedpubliclyavailablerulesets(mostlyfromBleedingEdge[1]andSourceFire[19]).About60%oftherulesuse”owbitsmatchingtraf“ccomingfromtheclientsside(presumablyfromtheattackersside),hencetheserulesareconsideredevadable.Alltogether(consideringdifferentruleoptionsaswell),thereisabout68%outoftherulesusing”owbitsdeterminedbySFETasevadable.Inaddition,thereareabout6%and4%of400rulesets(using”owbits)detectedvulnerabletotheproposedattackwhenSFETwasruninthecautiousmodeandtheautomaticmoderespectively.WhenrunningSFETinthespeci“edmodewithsomechosenrulesets(weknowexactlywhichruleisevadable),allevasionsequencesgeneratedbySFETcanbeconvertedtoarealattack(thisisnottrueforothermodes).Eventhoughlargerulesets(thenumberofrulesmakeuponly20%oftheconsideredrulesets,theyaremoresusceptibletotheattackthansmallrulesets.While10%oflargerulesetsarevulnerabletotheattack,only5%ofsmallrulesetsarevulnerable.ThisisshowninFig.5.Whenapplyingtheproposedsolutiontosmallvulnerablerulesets,thenumberofaddedrulesinaverageistriplethatofrulesintheruleset(forbothautomaticandcautiousmodes).Fig.6showstheaveragenumberofaddedrulesforeachrulesetsize(note:wedonot“ndanyvulnerablerulesetofsizeForlargevulnerablerulesets,thenumberofmodi“edrulesisthesameasthatofvulnerablerules.Eventhoughsomelargerulesetshavemanyevadablerules,inaverage,only10%ofevadablerulesarevulnerable.Inaddition,thenumberofaddedrulesforeachlargerulesetisatmostthenumberoftargetrulesintheruleset.Theaveragenumberofaddedrulesisonly3.5forbothautomaticandcautiousmodes.WeappliedthefalsepositivescontrolpatchfordifferentvaluesofL.Onaverage,thenumberofrulesaddedtocontrolfalsepositivesincreasesexponentiallyasLincreases(asexpected)andthisisshowninFig.7.Tomeasurefalsepositivescausedbyourpatches,werunSnortwithvulnerablerulesetsandgeneratedtraf“caccordingtotheirDFAs.Tobemoreaccurate,wegeneratedtraf“cwithbothnormalandevasionpackets.However,wesettherateofevasionpacketstobesmall(anywherefrom1%to5%).Afalsepositiveoccurswhenthepatchedrulesetraisesanalertonabenignpacketsequence(notanevasionsequenceandtheoriginalrulesetdoesnotraiseanalerton).Fig.8showstheaveragefalsepositivesrateforthesmallrulesetsolution.Weseethatpatchedrulesetsofsmallersizetendtohavemorefalsepositivesthanthoseofbiggersize.Besides,rulesetsofsize2or3havehighaveragefalsepositivesratebecausetheirDFAsaresmallandthereisnosigni“cantdifferencebetweenthenumberofevasionsequencesandthenumberofnormalsequences.However,whenthefalsepositivesrateishigh,thefalsepositivescontrol 2012IEEENetworkOperationsandManagementSymposium(NOMS)