Embedded systems, networks and protocols research group. Ondřej Ryšavý 3rd Annual Conference of IT4Innovation

Transcription

1 Embedded systems, networks and protocols research group Ondřej Ryšavý 3rd Annual Conference of IT4Innovation

2 Embedded systems, networks and protocols research group Task: Design of embedded systems, networks and protocols Team Leader : Miroslav Švéda Team Members (6): Petr Matoušek, Pavel Očenášek, Ondřej Ryšavý, Vladimír Veselý, Matěj Grégr, Jaroslav Ráb

3 Research statement (A1) Research cyber threats and protective methods to increase security of computer networks (A2) Research communication platform for cyber physical systems to enable building large scale distributed applications (A3) Research Software Defined Networks (SDN) as a next flexible networking technology

4 Recent and Current Projects PRISTINE (EU FP7, ) SEC6NET (MV, ) Automated attack processing (MPO ČR, ) SCADA system for control and monitoring RT processes (TAČR, ) ATLANTIS-DeSIRE^2: Dependable Systems International Research and Educational Experience (ATLANTIS-DESIRE, )

5 PRISTINE Project Goal is to investigate RINA (Recursive InterNetwork Architecture) to: Finish its specification (fill missing pieces, resolve conflicts) demonstrate its applicability to high scalability, multihoming, built-in security, seamless access to real-time information and operation in dynamic environments. Possible applications as middleware for cloud-computing, real-time distribute environments, service oriented computing

6 PRISTINE Big Picture

7 PRISTINE Project - our tasks consortium consists of TSSG, I2CAT, Telefonica, Ericsson, Nextworks, Thales, Nexedi, BiSDN, Atos, Juniper, University of Oslo, Brno University of Technology, Telecom SudParis, CREATE-NET, iminds. implementation of simulation environment to support design, development and evaluation of RINA mechanisms and policy contribution to security mechanisms, resilience and data forwarding

8 Sec6net project Modern Tools for Detection and Mitigation of Cyber Criminality on the New Generation Internet research and development of tools for recognition and monitoring network traffic, further offline analysis of network traffic, and methods of securing local networks network security: methods and tools for extracting and presenting information from network traffic, detecting anomalies in traffic network forensics: tools for extracting data from network communication, searching for patterns, unusual or specific user behavior issues: large data sets of source information, new protocols, divergences to standards, encrypted and tunneled communication

9 1 2 ABC 4 5 GHI JKL 7 8 PQRS TUV * 0 OPER 3 DEF 6 MNO 9 WXYZ # CISCO IP PHONE 7970 SERIES -? ABC 4 5 GHI JKL 7 8 PQRS TUV * 0 OPER 3 DEF 6 MNO 9 WXYZ # CISCO IP PHONE 7970 SERIES -? + Motivation RTP Detection Fast RTP Detection and Codecs ignalling and Voice Transmission in VoIP Classification in Internet Traffic SIP RTP SIP RTP Probe On-line detection of RTP communication on dynamic ports. Research Goals RTP detection without signalling protocols. On-line detection of RTP communication on dynamic ports. RTP detection without signalling protocols. Simple but precise classification of the payload Simple but precise classification of the payload (what kind of codec). On-the-fly embedded solution. Matoušek, Ryšavý, Kmet (BUT) Fast RTP Detection and Classification ICDF2C 2014, New Haven,CT 3 / 17

10 RTP Traffic

11 Two phase detection

12 Length of flow

13 Codec Detection

14 Codecs Classification Implementation Scheme of RTP detection and Codec classification Detection/classification Stream DB input packets RTP Filter RTP packets Stream Collector RTP streams classified streams RTCP packets RTCP packets RTCP Analyser Codec Mapper Implementation packet Stand-alone filter: packet C-language that application may be for Unix RTP and(udp, Windows. RTP header signature) Plugin into NetFox Detective forensics tool. flow filter: analyse a subsequence of packet within the flow Matoušek, Ryšavý, Kmet (BUT) Fast RTP Detection and Classification ICDF2C 2014, New Haven,CT 11 / 17 (sequence numbers, payload size, timestamps)

15 Method evaluation We used available data sets to evaluate the method. Except silk-class codecs the method recognise all normal RTP flows.

16 Conclusions

17 This year (SW) products QnxTimeSync - A tool for measuring real precision of network synchronization in real-time operating systems, software, 2014 IP45 Host Implementation for Linux, OSX, Windows, software, 2014 IP45 Border Gateway Implementation for Linux, software, 2014 Database of samples of VoIP communication with different codecs, software, others by the end of the year

18 Selected publications MATOUŠEK Petr, RYŠAVÝ Ondřej and KMEŤ Martin. Fast RTP Detection and Codecs Classification in Internet Traffic. The Journal of Digital Forensics, Security and Law. 2014, vol. 2014, no. 2, pp ISSN POLČÁK Libor, HRANICKÝ Radek and MARTÍNEK Tomáš. On Identities in Modern Networks. The Journal of Digital Forensics, Security and Law. 2014, vol. 2014, no. 2, pp ISSN ŠVÉDA Miroslav. Dependability in Cyber-Physical Systems Network Applications. In: Proceedings of the 5th International Conference on Circuits, Systems, Control, Signals Salerno: North Atlantic University Union, 2014, pp ISBN GRÉGR Matěj, PODERMAŃSKI Tomáš and ŠVÉDA Miroslav. Measuring Quality and Penetration of IPv6 Services. In: The Tenth International Conference on Networking and Services CHAMONIX MONT-BLANC: Institute for Systems and Technologies of Information, Control and Communication, 2014, pp ISBN

19 Current state Team focusing on network security and programability consisting of members with complementary skills. There are two running projects which is currently the maximum we can reasonable handle. Students (~20) at all levels (Bc, Mgr, Phd) participate in R&D projects. Actively searching further funding possibilities

20 Outlook IT4I work follows planned activities, some adjustments were necessary with respect to other projects Objectives are set for the next period: Network security (in Internet as well as in Industrial Networks) Communication platform for CPS (project proposal made) Specific areas of Software Defined Networking New projects are needed after 2015.

21 New proposals Design of Computer Networks with Respect to Network Applications Support (GACR) analyse the sources of these issues, identify major drawbacks of the current Internet communication propose possible solutions with respect to requirements specified by the domain of Internet-based CPS. NetFP - Network Forensic Analysis Platform (TACR) platform for network forensics capable of complex analysis of traffic data to achieve the significant improvement in the area of efficient analysis of heterogenous network forensic data in large Siemens Innovation at NineSigma Requests Cloud-base industrial control applications

22 Our group and HPC? HPC resources of IT4I not used yet, but there are some applications considered for HPC deployment: analysis of a huge amount of data from network in order to detect anomaly behaviour or creating long-term user profiles simulation of large scale networks in order to evaluate quantitative parameters (part of PRISTINE) Currently, we are doing small scale experiments in order to prepare algorithms for HPC environment

23 Embedded systems, networks and protocols research group