Defending against Internet worms using a phase space method from chaos theory

Transcription

1 Defending against Internet worms using a phase space method from chaos theory Jing Hu and Jianbo Gao Department of Electrical & Computer Engineering University of Florida Nageswara S. Rao Computer Science and Mathematics Division Oak Ridge National Laboratory 1

2 Outline Motivations Theoretical background: phase space reconstruction by time delay embedding Detecting network intrusions and worms by phase space based method Concluding discussions 2

3 Motivations Enterprise networks are facing ever-increasing security threats from worms, viruses, intrusions, etc., causing billions of dollars of loss Existing monitoring methods can not detect worms effectively in real-time Purpose: to develop effective methods to defend against Internet worms in a real-time manner 3

4 Worm detection: state-of-the-art and challenges Internet worm: a self-propagating program that automatically replicates itself to vulnerable systems and spreads across the Internet. Basic strategies: Monitor network traffic data Look for specific byte sequences (attack signatures) that are known to appear in the attack traffic Challenges: How to find a good attack signature fast enough for real-time use? A good attack signature should be general enough to capture all attack traffic of certain type specific enough to avoid overlapping with normal traffic to reduce false alarms Existing methods (e.g., expectation maximization and hidden Markov models) need extensive training, thus can not be applied in real-time 4

5 Phase space reconstruction Phase space: enables one to study dynamics of a complicated system geometrically X 1 (t) X 2 (t) X 2 t 2 t 1 t o t 1 t 2 t t o t 1 t 2 a) (b) (c) t o t 2 t 1 t o t X 1 Phase space reconstruction (Takens 1981; Sauer et al. 1991) V i = [x(i),x(i + L),...,x(i + (m 1)L)] x(i): given time series, m: embedding dimension, L: delay time 5

6 Optimal embedding The dynamics of the harmonic oscillator can be described by Equivalently, dx dt = y, dy dt = ωx d 2 x dt 2 = ωx The general solution is: x(t) = Acos(ωt + φ ), y(t) = Asin(ωt + φ ) If we embed x(t) to a 2-D space, then V t = [x(t),x(t + τ)] 6

7 Optimal embedding (Cont) Time-Dependent Exponent (TDE) curves (Gao & Zheng 1993, 1994) ( ) Vi+k V j+k Λ(m,L,k) = ln V i V j (1) Introduce a sequence of shells ε i V i V j ε i + ε i, i = 1,2,3, (2) where ε i and ε i are arbitrarily chosen small distances The angle brackets denote the ensemble average within a shell It is suggested that for a fixed small k, an optimal m is such that Λ(m,L,k) no longer decreases much when further increasing m. After m is chosen, L can be selected by minimizing Λ(m,L,k) 7

8 Normal and worm traffic trace 3 datasets are collected from a double-honeypot system deployed in a local network for automatic detection of worm attacks from the Internet. Courtesy of Dr. Chen at the Univ. of Florida 3 Package Sequence 2 Normal Worm

9 $ ' Phase diagrams for normal and worm traffic Left: worm traffic; Right: normal traffic Region x(n+1) x(n+1) Region x(n) Region 1 & 1 15 x(n) 2 25 Region 4 % 9

10 Accuracy of the phase space based method index based on percentage of number of points in region 1 35 index based on percentage of number of points in region Normal Worm 3 Normal Worm Frequency Frequency Percentage of points (%) Percentage of points (%) 1

11 Accuracy of the phase space based method (Cont) 7 6 index based on percentage of number of points in regions 3 and 4 Normal Worm 5 Frequency Percentage of points (%) 11

12 Comparison with other methods The separation between normal and worm traffic data is much smaller than that of our method! Adapted from Tang & Chen 25 12

13 Concluding discussions Proposed a phase space based method for detecting Internet intrusions and worms The method is simple, computationally fast and very effective The method can automatically indicate the attack signature of a specific worm (a) it identifies a subspace that contains the signature sequence of the worm in the phase space (b) it depends only on the rules (or dynamics) that the worm signature sequence is generated (a) & (b) together define an invariant subspace of the specific worm 13

14 Q & A Collaborations are highly welcomed! Thank you! 14