Demonstrationof10GbpsIDSIPSLivioRicciullilivio@.ppt

Demonstration of 10 Gbps IDS/IPS Livio Ricciulli livio@ (408) 399-2284 Active Networks (DARPA Program) Change behavior of network components (routers) dynamically (add new protocols, flow control algorithms, monitoring, etc..) Discrete. Update network through separate management operations Integrated. Packets cause network to update itself Broad scope did not result in industry adoption Lack of “killer application” Lack of tight industry interaction Tried to change too much too soon Metanetworks’ bottom-up approach Achieve programmability while reusing current infrastructure Augment networks with new, non-invasive technology Application-driven rather than design-driven Work closely with users/operators Revisit hardware computational model Open architecture to leverage open source software More robust, more flexible, promotes composability Directly support Snort signatures Abstract hardware as a network interface from OS prospective Retain high-degree of programmability New threat models (around the corner) Extend to application beyond IDS/IPS Line-speed/low latency to allow integration in production networks Unanchored payload string search Support analysis across packets Gracefully handle state exhaustion Hardware support for adaptive information management Detailed reporting when reporting bandwidth is available Dynamically switch to more compact representations when necessary Support the insertion of application-specific analysis code in the fast path Knowing what is in your network is very important Catch misuses both incoming and outgoing FBI says that effective network monitoring (not even IDS) is in top 3 most important things to do Who and how is using the bandwidth Decentralization Cannot find out what the traffic is unless you do content inspection Many p2p applications randomly changing ports (VOIP) Key exchanges need to be monitored Would like to know what applications are doing High Speed High Complexity 1G and 10G make content inspectio