Rethinking Hardware Support for Network Analysis and Intrusion重新思考网络分析和入侵的硬件支持.pptVIP

Rethinking Hardware Support for Network Analysis and Intrusion Prevention Vern Paxson (ICSI) Krste Asanovic (MIT) Sarang Dharmapurikar (Nuova Systems) John Lockwood (WUSTL) Ruoming Pang (Princeton) Robin Sommer (ICSI) Nicholas Weaver (ICSI) USENIX Hot Security July 31, 2006 Network Analysis Performance Pressures Growing in Multiple Dimensions Increasingly, simple efficient signature matching proves inadequate False positives Polymorphism Zero-day attacks ? We need semantic application-aware analysis But: that costs CPU (parsing) and memory (state) Network Analysis Performance Pressures Growing in Multiple Dimensions, con’t Attacks inexorably grow in sophistication Arms race (particularly w/ attackers motivated by $$$) Analysis also increasingly requires context (= state) Problem of evasion leads to need to alter traffic via normalization … … so we need to operate in-line Plus we want to prevent attacks, not just detect them … … so we need to operate in-line We need to do a lot more processing …. Some Sobering Growth Trends Network traffic rates inexorably grow Network traffic volumes inexorably grow We need to do more analysis on larger amounts of data at higher speeds … But CPU performance is NOT inexorably growing any more. Uniprocessor Performance (SPECint) Where Will We Find The Performance?? FPGAs! ASICs! Multi-core! Parallelism is here and is growing. Yes, that’s what we will use … … but how? … and at what labor cost? Rethinking Hardware Support … Current efforts in the literature [SP01,FCH02, MLLP03,LMK+03,CS04,SP04,CMS05,LNZ+03, DKSL04,DL05,TSCV04,TS05,SL03,SML04,AL05] focus heavily on supporting signature-matching TCAMs, FPGA features, Bloom Filters for string lookups NFAs, DFAs, Aho-Corasick for reg-exp matching Nearly stateless Essentially “Snort in hardware” Rudimentary stateful analysis - TCP stream reassembly w/ adversaries - unexamined in literature until USENIX Security 2005 Commercial designs may be ahead; diff. to know How Do We Get: Stat