Abstract:With information technology entering new fields and levels of deployment, e.g., in areas of energy, mobility, and production, network security monitoring needs to be able to cope with those environments and their evolution. However, state-of-the-art Network Security Monitors (NSMs) typically lack the necessary flexibility to handle the diversity of the packet-oriented layers below the abstraction of TCP/IP connections. In this work, we advance the software architecture of a network security monitor to facilitate the flexible integration of lower-layer protocol dissectors while maintaining required performance levels. We proceed in three steps: First, we identify the challenges for modular packet-level analysis, present a refined NSM architecture to address them and specify requirements for its implementation. Second, we evaluate the performance of data structures to be used for protocol dispatching, implement the proposed design into the popular open-source NSM Zeek and assess its impact on the monitor performance. Our experiments show that hash-based data structures for dispatching introduce a significant overhead while array-based approaches qualify for practical application. Finally, we demonstrate the benefits of the proposed architecture and implementation by migrating Zeek's previously hard-coded stack of link and internet layer protocols to the new interface. Furthermore, we implement dissectors for non-IP based industrial communication protocols and leverage them to realize attack detection strategies from recent applied research. We integrate the proposed architecture into the Zeek open-source project and publish the implementation to support the scientific community as well as practitioners, promoting the transfer of research into practice.

Custompro: Network Protocol Customization Through Cross-Host Feature Analysis

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

TOSS: Tailoring Online Server Systems through Binary Feature Customization

PROFACTORY: Improving IoT Security via Formalized Protocol Customization

Verify-Pro: A Framework for Server Authentication Using Communication Protocol Dialects.

Vulnerabilities and Attacks of Inter-device Coordination in Programmable Networks.

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Toward Scalable and Low-Cost Traffic Testing for Evaluating DDoS Defense Solutions

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

Hecate: Automated Customization Of Program And Communication Features To Reduce Attack Surfaces

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

MORPH: Enhancing System Security through Interactive Customization of Application and Communication Protocol Features

Rethinking robust and accurate application protocol identification.

Prognosis: Closed-Box Analysis of Network Protocol Implementations

Realproct: Reliable Protocol Conformance Testing with Real Nodes for Wireless Sensor Networks

Protocol State Based Active Probing Method for Detecting Applications of Proprietary Protocol

Integrated TCP/IP protocol software testing for vulnerability detection

AMASS: Automated Software Mass Customization Via Feature Identification and Tailoring.

PTFW: a protocol testing framework for wireless sensor networks

Advancing Protocol Diversity in Network Security Monitoring