Abstract:With information technology entering new fields and levels of deployment, e.g., in areas of energy, mobility, and production, network security monitoring needs to be able to cope with those environments and their evolution. However, state-of-the-art Network Security Monitors (NSMs) typically lack the necessary flexibility to handle the diversity of the packet-oriented layers below the abstraction of TCP/IP connections. In this work, we advance the software architecture of a network security monitor to facilitate the flexible integration of lower-layer protocol dissectors while maintaining required performance levels. We proceed in three steps: First, we identify the challenges for modular packet-level analysis, present a refined NSM architecture to address them and specify requirements for its implementation. Second, we evaluate the performance of data structures to be used for protocol dispatching, implement the proposed design into the popular open-source NSM Zeek and assess its impact on the monitor performance. Our experiments show that hash-based data structures for dispatching introduce a significant overhead while array-based approaches qualify for practical application. Finally, we demonstrate the benefits of the proposed architecture and implementation by migrating Zeek's previously hard-coded stack of link and internet layer protocols to the new interface. Furthermore, we implement dissectors for non-IP based industrial communication protocols and leverage them to realize attack detection strategies from recent applied research. We integrate the proposed architecture into the Zeek open-source project and publish the implementation to support the scientific community as well as practitioners, promoting the transfer of research into practice.

Network Monitor Technology in Windows

Design of SNMP Probe Within Network Management Platform

Data Packet Capture and Applications Based on WinPcap

Port Scanning Techniques and Analysis of Attack and Defense

An LAN-Monitor Experiment Based on Winpcap and Visual C++

Analysis of SNMP and implementation of SNMP protocol stack

Research on Network Management Systems Via Multi-Agent Technology

The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies.

Advancing Protocol Diversity in Network Security Monitoring

Research on the Key Techniques of Packet Interception Based on Network Emulation

Intranet Security using a LAN Packet Sniffer to Monitor Traffic

Implementation of IDS Based on WinPcap and Boyer-Moore

Know Yourself As Well As the Enemy and You Can Fight a Hundred Battles with No Danger of Defeat--A Study of Network Sniffing Technology and Its Precautionary Measures

Study of Network Security Monitor System Based on Intelligent Agents

Implementation of Upper-Layer Monitoring Software Based on Socket

THE REALIZATION AND RESULTS ANALYSIS OF A GROUND MONITOR SYSTEM COMMUNICATION FOR REMOTE SENSING PLATFORM

Survey on SNMP Network Management

Intelligent Industry Monitoring Network Architecture Upnp Based

Network computer security hidden dangers and vulnerability mining technology

Intranet security strategy based on a monitor system

TSN-Peeper: an Efficient Traffic Monitor in Time-Sensitive Networking