NetShield: massive semantics-based vulnerability signature matching for high-speed networks

Authors:
Zhichun Li;Gao Xia;Hongyu Gao;Yi Tang;Yan Chen;Bin Liu;Junchen Jiang;Yuezhou Lv
Affiliations:
Northwestern University, Evanston, IL, USA;Tsinghua University, Beijing, China;Northwestern University, Evanston, IL, USA;Tsinghua University, Beijing, China;Northwestern University, Evanston, IL, USA;Tsinghua University, Beijing, China;Tsinghua University, Beijing, China;Tsinghua University, Beijing, China
Venue:
Proceedings of the ACM SIGCOMM 2010 conference
Year:
2010

Citing 23
Cited 3

Lower bounds for orthogonal range searching: part II. The arithmetic model

Journal of the ACM (JACM)
High-speed policy-based packet forwarding using efficient multi-dimensional range matching

Proceedings of the ACM SIGCOMM '98 conference on Applications, technologies, architectures, and protocols for computer communication
Packet classification using tuple space search

Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Packet classification on multiple fields

Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Bro: a system for detecting network intruders in real-time

Computer Networks: The International Journal of Computer and Telecommunications Networking
Scalable packet classification

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
Classifying Packets with Hierarchical Intelligent Cuttings

IEEE Micro
Active Mapping: Resisting NIDS Evasion without Altering Traffic

SP '03 Proceedings of the 2003 IEEE Symposium on Security and Privacy
Packet classification using multidimensional cutting

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Shield: vulnerability-driven network filters for preventing known vulnerability exploits

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Vigilante: end-to-end containment of internet worms

Proceedings of the twentieth ACM symposium on Operating systems principles
Survey and taxonomy of packet classification techniques

ACM Computing Surveys (CSUR)
Towards Automatic Generation of Vulnerability-Based Signatures

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Algorithms to accelerate multiple regular expressions matching for deep packet inspection

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
binpac: a yacc for writing application protocol parsers

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Fast and memory-efficient regular expression matching for deep packet inspection

Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems
Robust TCP stream reassembly in the presence of adversaries

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
ShieldGen: Automatic Data Patch Generation for Unknown Vulnerabilities with Informed Probing

SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
A hybrid finite automaton for practical deep packet inspection

CoNEXT '07 Proceedings of the 2007 ACM CoNEXT conference
XFA: Faster Signature Matching with Extended Automata

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Deflating the big bang: fast and scalable deep packet inspection with extended finite automata

Proceedings of the ACM SIGCOMM 2008 conference on Data communication
High-Speed Matching of Vulnerability Signatures

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Efficient regular expression evaluation: theory to practice

Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems

Towards vulnerability-based intrusion detection with event processing

Proceedings of the 5th ACM international conference on Distributed event-based system
ALERT-ID: analyze logs of the network element in real time for intrusion detection

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses
An efficient parallelized L7-filter design for multicore servers

IEEE/ACM Transactions on Networking (TON)

Quantified Score

Hi-index	0.00

Visualization

Abstract

Accuracy and speed are the two most important metrics for Network Intrusion Detection/Prevention Systems (NIDS/NIPSes). Due to emerging polymorphic attacks and the fact that in many cases regular expressions (regexes) cannot capture the vulnerability conditions accurately, the accuracy of existing regex-based NIDS/NIPS systems has become a serious problem. In contrast, the recently-proposed vulnerability signatures (a.k.a data patches) can exactly describe the vulnerability conditions and achieve better accuracy. However, how to efficiently apply vulnerability signatures to high speed NIDS/NIPS with a large ruleset remains an untouched but challenging issue. This paper presents the first systematic design of vulnerability signature based parsing and matching engine, NetShield, which achieves multi-gigabit throughput while offering much better accuracy. Particularly, we made the following contributions: (i) we proposed a candidate selection algorithm which efficiently matches thousands of vulnerability signatures simultaneously requiring a small amount of memory; (ii) we proposed an automatic lightweight parsing state machine achieving fast protocol parsing. Experimental results show that the core engine of NetShield achieves at least 1.9+Gbps signature matching throughput on a 3.8GHz single-core PC, and can scale-up to at least 11+Gbps under a 8-core machine for 794 HTTP vulnerability signatures.