Intrusion detection strategies for hypertext transport protocol

• US 20080276316A1
• Filed: 09/29/2004
• Published: 11/06/2008
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Roelker, Daniel J., Norton, Marc A.
• Granted Patent: US 7,496,962 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A hypertext transport protocol (HTTP) inspection engine for an intrusion detection system (IDS) includes an HTTP policy selection component, a request universal resource identifier (URI) discovery component, and a URI normalization module. The HTTP policy selection component identifies an HTTP intrusion detection policy using a packet. The request URI discovery component locates a URI within the packet. The URI normalization module decodes an obfuscation within the URI. In another embodiment, a packet transmitted on the network is intercepted. The packet is parsed. An Internet protocol (IP) address of the packet is identified. An HTTP intrusion detection policy for a network device is determined. A URI is located in the packet. A pattern from an intrusion detection system rule is compared to the located URI. In another embodiment, an IDS includes a packet acquisition system, network and transport reassembly modules, an HTTP inspection engine, a detection engine, and a logging system.

Claims

1. A computer-implemented hypertext transport protocol inspection engine for decoding an obfuscated universal resource identifier in a communication packet transmitted in a packet network, for use with an intrusion detection system, comprising:

a hypertext transport protocol policy selection component configured to identify a Web server hypertext transport protocol intrusion detection policy associated with a packet, responsive to the packet which is uninspected, so as to determine if the packet is moving to or from a Web server;

a request universal resource identifier discovery component configured to locate a universal resource identifier in the packet based on the Web server hypertext transport protocol intrusion detection policy only if the Web server hypertext transport protocol intrusion detection policy is identified by the hypertext transport protocol policy selection component; and

a universal resource identifier normalization module configured to decode an obfuscation within the universal resource identifier after it is located by the request universal resource identifier discovery component.

2. The hypertext transport protocol inspection engine of claim 1, the hypertext transport protocol policy selection component identifying the Web server hypertext transport protocol intrusion detection policy by using an Internet protocol address obtained from the packet parsed by the intrusion detection system as a key to a keyword trie associating Internet protocol addresses with Web server hypertext transport protocol intrusion detection policies.

3. The hypertext transport protocol inspection engine of claim 2, the Web server hypertext transport protocol intrusion detection policy comprising one or more of universal resource identifier parsing instructions and universal resource identifier decoding instructions.

4. The hypertext transport protocol inspection engine of claim 1, the request universal resource identifier discovery component locating the universal resource identifier within the packet parsed by the intrusion detection system based on a Web server hypertext transport protocol intrusion detection policy identified by the hypertext transport protocol policy selection component.

5. The hypertext transport protocol inspection engine of claim 4, the request universal resource identifier discovery component locating the universal resource identifier within the packet parsed by the intrusion detection system by reading through the hypertext transport protocol application data one time.

6. The hypertext transport protocol inspection engine of claim 5, the reading through the hypertext transport protocol application data one time comprising using a state machine.

8. The hypertext transport protocol inspection engine of claim 1, the obfuscation comprising an encoding of a universal resource locator field recognized by a Web server identified by the hypertext transport protocol policy selection component.

9. The hypertext transport protocol inspection engine of claim 1, the universal resource identifier normalization module decoding the obfuscation within the universal resource identifier located by the request universal resource identifier discovery component by one or more of hex decoding, double percent hex decoding, double nibble hex decoding, first nibble hex decoding, second nibble hex decoding, eight bit unicode transformation format decoding, eight bit unicode transformation format bare byte decoding, Microsoft™

%U decoding, and mismatch decoding.

10. The hypertext transport protocol inspection engine of claim 1, the universal resource identifier normalization module decoding the obfuscation within the universal resource identifier located by the request universal resource identifier discovery component by reading through the hypertext transport protocol application data one time.

11. The hypertext transport protocol inspection engine of claim 10, the reading through the hypertext transport protocol application data one time comprising using a state machine.

27. The hypertext transport protocol inspection engine of claim 1, wherein

the request universal resource identifier discovery component is further configured to locate all universal resource identifiers, including the universal resource identifier, within the packet by reading through the entire hypertext transport protocol application data, and

the universal resource identifier normalization module is further configured to decode obfuscations within all of the universal resource identifiers located by the request universal resource identifier discovery component.

7. (canceled)

12. A method for detecting a hypertext transport protocol evasion on a network using an intrusion detection system, comprising:

intercepting a packet transmitted on the network;

parsing the packet;

identifying an Internet protocol address of the packet;

determining a Web server hypertext transport protocol intrusion detection policy for a network device located at the Internet protocol address, so as to determine if the packet is moving to or from a Web server;

locating at least one universal resource identifier within the packet based on the Web server hypertext transport protocol intrusion detection policy only if the Web server hypertext transport protocol intrusion detection policy is determined to be associated with the network device located at the Internet protocol address;

comparing at least one pattern from a rule of the intrusion detection system to the at least one universal resource identifier which was located, to determine if there is a match between the at least one pattern from the rule of the intrusion detection system to the at least one universal resource identifier; and

identifying the match as the hypertext transport protocol evasion.

13. The method of claim 12, the packet comprising one of an unassembled packet and a reassembled packet.

14. The method of claim 12, the determining a Web server hypertext transport protocol intrusion detection policy for a network device comprising using the Internet protocol address as a key to a keyword trie associating Internet protocol addresses with Web server hypertext transport protocol intrusion detection policies.

15. The method of claim 12, the network device comprising one of a Web client and a Web server.

16. The method of claim 12, the Web server hypertext transport protocol intrusion detection policy comprising one or more of universal resource identifier parsing instructions and universal resource identifier decoding instructions.

17. The method of claim 12, further comprising decoding at least one universal resource identifier from the packet by reading through the hypertext transport protocol application data one time.

19. The method of claim 12, further comprising:

decoding, after the locating, an obfuscation within the at least one universal resource identifier based on the Web server hypertext transport protocol intrusion detection policy;

comparing, after the decoding, the at least one pattern from the rule of the intrusion detection system to the obfuscation which was decoded; and

identifying, after the decoding, a match between the at least one pattern from the rule of the intrusion detection system and the obfuscation which was decoded as the hypertext transport protocol evasion.

20. The method of claim 19, the obfuscation comprising an encoding of a universal resource locator field recognized by a Web server of the network device.

21. The method of claim 19, the decoding an obfuscation within the at least one universal resource identifier based on the Web server hypertext transport protocol intrusion detection policy comprising one or more of hex decoding, double percent hex decoding, double nibble hex decoding, first nibble hex decoding, second nibble hex decoding, eight bit unicode transformation format decoding, eight bit unicode transformation format bare byte decoding, Microsoft™

%U decoding, and mismatch decoding.

22. The method of claim 19, the decoding an obfuscation within the at least one universal resource identifier based on the Web server hypertext transport protocol intrusion detection policy comprising reading through the hypertext transport protocol application data one time.

23. The method of claim 22, the reading through the hypertext transport protocol application data one time comprising using a state machine.

24. The method of claim 12, further comprising:

identifying one or more additional universal resource identifiers embedded in the packet;

comparing at least one pattern from a rule of the intrusion detection system to the one or more additional universal resource identifiers; and

identifying one or more matches between the at least one pattern from a rule of the intrusion detection system and the one or more additional universal resource identifiers as one or more hypertext transport protocol evasions.

25. The method of claim 12, further comprising recording the match.

18. The method of claim 18, the reading through the hypertext transport protocol application data one time comprising using a state machine.

26. An intrusion detection system, comprising:

a packet acquisition system that intercepts a packet transmitted across a network and parses the packet;

a network protocol reassembly module that parses network protocols from the packet;

a transport protocol reassembly module that parses transport protocols from the packet;

a hypertext transport protocol inspection engine that parses hypertext transport protocol from the packet determines a Web server hypertext transport protocol intrusion detection policy for the packet so as to determine if the packet is moving to or from a Web server, locates at least one universal resource identifier from the packet based on the Web server hypertext transport protocol intrusion detection policy only if the Web server hypertext transport protocol intrusion detection policy is determined to be associated with the packet and decodes an obfuscation within the at least one universal resource identifier based on the Web server hypertext transport protocol intrusion detection policy after the universal resource identifier is located;

a detection engine that receives hypertext transport protocol inspected packet information from the hypertext transport protocol inspection engine and inspects the hypertext transport protocol inspected packet information for intrusions; and

a logging system that receives and stores information about the intrusions from the detection engine.