Research & Development Roadmap
1
Outline
A New Communication Framework
Giving Bro Control over the Network
Security Monitoring for Industrial Control
Systems
Parallelism on Concurrent Architectures
2
COMMUNICATION NG
3
Communication Today
Primitives
Sending events
&synchronized
Limitations
Model doesn’t scale; no hierarchies
Loose semantics: best effort service
No integration with persistence
Implementation lacks robustness
Two separate protocol implementations
4
Initial Proposal
Extend event propagation
Routing
Subscription groups
Push/pull models
Remove &synchronized (and the proxies...)
Add global, persistent data structure
Probably just key/value store
Explicit API
5
Initial Proposal (cont’d.)
Implementation
“Data nodes” in charge of tables; nodes attach
Receive updates and broadcast them back out
Limit values to atomic data types
Use existing libraries
Implement as a library
Trading “magic” for better semantics and control
6
GIVING BRO CONTROL OVER THE
NETWORK
7
Objectives
Bro controls what it sees
Adapt the front-end load-balancing
Bro controls what the network does
Block, steer, shape
8
Science DMZs
100
G
10/10
0G
Source: ESNet
10
100 Gb/s Cluster
Science DMZ
Switch
API
100GE
Border
Router
100G Load-balancer
API
Bro Cluster
11
Control
Control
10GE
Transparent Script Interface
Packet Acquisition
drop(entity)
sample(entity)
notify(entity, cond)
Packet Control
drop(entity)
sample(entity)
throttle(entity)
redirect(entity, destination)
12
Transparent Script Interface
(cont’d.)
“Entity” could be very different things ...
Plugins implement what hardware supports
13
SECURITY MONITORING FOR ICS
14
Industrial Control Systems
Critical resources, yet lacking in protection
Often legacy hardware hard to protect
Not built with security in mind
Class IDS not a good fit
Attacks rare / unknown
Behavioral approaches don’t take context into
account
15
Industrial Control Systems (cont’d.)
Significant potential through incorporating
semantics
Understand protocols Bro-style
Create visibility
Develop models of what we should be seeing
Anomaly detection could actually work here
16
First steps ...
Protocol support in 2.2
Modbus
DNP3
Only basic script analysis so far
17
Research Thrusts (1)
Measurement study: What do we see?
Actors, workloads, cross-site characterization
As we do that, extend Bro’s logging
Environments
Municipal water and gas plants
Campus power-plant
Building automation at a large research lab
Looking for more ...
18
Research Thrusts (2)
Semantic models for monitoring
Statistical profiling
Summary statistics framework
Power Grid State Model
PLC Memory Maps
19
PLC Memory Maps
Categorize registers
Constant, attribute, continuos
Derive predictive models
... and validate them
20
PARALLELISM ON CONCURRENT
ARCHITECTURES
21
Concurrency Potential
22
Concurrent Analysis
Logs
Analysis Logic
Notification
Policy Script
Interpreter
Events
Protocol Decoding
Event Engine
Packets
Network
23
Architecture
Notification
Scripting Language
Script Threads
Detection Logic
Events
Event Engine
Event Engine
Threads
Packet Analysis
Dispatcher
Network
24
Packet Dispatcher (NIC)
New Platform: Abstract Machine
A High-Level Intermediary Language for Traffic Inspection
Domainspecific Data
Types
State
Management
Concurrent
Analysis
Real-time
Performance
Robust/Secure
Execution
High-level
Standard
Components
First-class
networking types
built-in
Containers with
state management
support
Domain-specific
concurrency model
Scalability through
parallelization
Well-defined,
contained
execution
environment
Platform for
building high-level,
reusable
functionality on
Timers can drive
execution
Support for
incremental
processing
Compilation to
native code
Static type-system,
and robust error
handling
Extensive
optimization
potential
26
HILTI Toolchain
A High-Level Intermediary Language for Traffic Inspection
27
Research Questions
How to identify state dependencies?
Static program analysis to drive scheduling
How to leverage hardware capabilities?
E.g., network processors, hardware lookup modules
28
HILTI enables more ...
BinPAC++ Demo
29
Robin Sommer
International Computer Science Institute, &
Lawrence Berkeley National Laboratory
robin@icsi.berkeley.edu
http://www.icir.org/robin
30