Automatic Network Protection Scenarios Using NetFlow

Size: px

Start display at page:

Download "Automatic Network Protection Scenarios Using NetFlow"

Meagan Haynes
10 years ago
Views:

1 Automatic Network Protection Scenarios Using NetFlow Vojt ch Krmí ek, Jan Vykopal {krmicek FloCon 2012 January 9-12, Austin, Texas

2 Part I Flow-based Network Protection Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 2 / 23

3 Goals and Components Goals of Network Protection Using NetFlow data to protect network. Defending perimeter against attacks from outside. Automated attack detection. Suitable for high speed networks (10 Gbps+). System Parts Sensors ( NetFlow data). Control center ( commands). Active network components ( blocking/filtering). HAMOC platform both sensor and active component. Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 3 / 23

Suitable for high speed networks (10 Gbps+). System Parts Sensors ( NetFlow data). Control center ( commands).

4 General Architecture of Network Protection Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 4 / 23

5 NfSen/NFDUMP Collector Toolset Architecture Web Front-End User Plugins Command-Line Interface Periodic Update Tasks and Plugins NetFlow v5/v9 NFDUMP Backend NfSen NetFlow Sensor NFDUMP NetFlow display Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 5 / 23

Backend NfSen NetFlow Sensor http://nfsen.sf.

6 Methods for Data Analysis TCP SYN scanning detection Simple, e ective general method, low false positive rate. Honeypot monitoring Uses subnet allocated for high- and low-interaction honeypots. Eliminates false positives, mainly catches hosts from outside. Brute force attack detection Similar flows may be symptoms of this attack. Suitable even for encrypted services such as SSH. Round trip time anomaly detection (D)DOSes overwhelm servers and increase response time. Abrupt increase of RTT may point to attack/misconfiguration. Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 6 / 23

Brute force attack detection Similar flows may be symptoms of this attack. Suitable even for encrypted services such as SSH.

7 HAMOC Hardware Platform Features Tra c distribution among multiple CPU cores. Network applications with hardware acceleration. Capable of concurrent monitoring/blocking/filtering/etc. Low-speed networks SW alternative (NetFlow/iptables). Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 7 / 23

Capable of concurrent monitoring/blocking/filtering/etc.

8 Network Protection Deployment Scenarios Scenarios NetFlow probes + control center + RTBH 1 filtering HAMOC as NetFlow probe and firewall HAMOC as redirection to quarantine (phishing) HAMOC as NetFlow probe and active attack tool HAMOC as NetFlow probe and tra c limiter 1 Remote Triggered Black Hole Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 8 / 23

HAMOC as NetFlow probe and active attack tool HAMOC as NetFlow probe and tra c limiter 1

9 Part II Network Protection Scenarios Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 9 / 23

10 NetFlow Probes + Control Center + RTBH Filtering Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 10 / 23

11 HAMOC as NetFlow Probe and Firewall Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 11 / 23

12 HAMOC as Redirection to Quarantine (Phishing) Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 12 / 23

13 HAMOC as NetFlow Probe and Active Attack Tool Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 13 / 23

14 HAMOC as NetFlow Probe and Tra c Limiter Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 14 / 23

15 Part III Network Protection Use Case: SSH Dictionary Attack and HAMOC Firewall Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 15 / 23

16 I. Attacker Performs SSH Horizontal Scan Attacker Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 16 / 23

17 II. Attacker Starts SSH Dictionary Attack Attacker Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 17 / 23

18 III. Center Detects Attack/Inserts Blocking Rule Attacker Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 18 / 23

19 IV. New SSH Attack, Blocked at the Border Attacker Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 19 / 23

20 V. Regular User Can Access Network, Attacker Not Attacker Regular User Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 20 / 23

21 Part IV Conclusion Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 21 / 23

22 Conclusion Role of IP Flow Monitoring in High Speed Networks Flow-based monitoring suitable for large networks. Observe and automatically inspect 24x7 network data. Possible future deployment in 10Gbps/40Gbps/100Gbps networks. Automatic Network Protection Class of attacks can be detected automatically. Automatic network protection supports operators. Detect and block attacks before hosts are infected. Not usable in every situation limitations. Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 22 / 23

23 Thank you for your attention! Automatic Network Protection Scenarios Using NetFlow Vojt ch Krmí ek et al. {krmicek Project CYBER This material is based upon work supported by the Czech Ministry of Defence under Contract No. OVMASUN Krmicek et al. Automatic Network Protection Scenarios Using NetFlow 23 / 23

Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík

Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior