Methods and systems for intrusion detection

• US 20040205360A1
• Filed: 03/08/2004
• Published: 10/14/2004
• Est. Priority Date: 04/14/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Roelker, Daniel J., Norton, Marc A.
• Granted Patent: US 7,305,708 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Performance of an intrusion detection system is enhanced with the addition of rule optimization, set-based rule inspection, and protocol flow analysis. During rule optimization, rule sets are created and selected in such a way that for every incoming packet only a single rule set has to be searched. Set-based rule inspection divides rules into content and non-content type rules. Only search patterns of content type rules are initially compared to a packet. Rules containing matched search patterns are validated with a parameterized search against the packet. Matches are recorded as events. Non-content rules are searched against a packet using a parameterized search. These matches are also recorded as an event. At least one event is selected per packet for logging. Protocol flow analysis determines the direction of flow of network traffic. Based on the direction of flow and the protocol, portions of packets can be eliminated from rule inspection.

Claims

1. A method for optimizing rules in an intrusion detection system, comprising:

creating a plurality of rule sets from a plurality of intrusion detection system rules;

determining at least one rule set for each packet by comparing parameters of the packet to parameters of the at least one rule set; and

inspecting the packet with the at least one rule set.

2. The method of claim 1, further comprising creating the plurality of rule sets during initialization of the intrusion detection system.

3. The method of claim 1, further comprising updating the plurality of rule sets while the intrusion detection system is executing when a new rule is added to the intrusion detection system.

4. The method of claim 1, further comprising creating the plurality of rule sets based on parameters unique to at least one network protocol.

5. The method of claim 1, further comprising defining a list of defined unique conflict rule sets, wherein each defined unique conflict rule set on the list is created by combining at least two unique rule sets defined by a user as rule sets capable of having a unique conflict from the plurality of rule sets.

6. The method of claim 1, further comprising selecting only one rule set for each said packet.

7. The method of claim 1, further comprising selecting two rule sets for each said packet.

8. A method for resolving unique conflicts between at least two rule sets that match parameters of a packet during rule set selection in an intrusion detection system, comprising:

creating defined unique conflict rule sets, wherein each defined unique conflict rule set is created by combining at least two unique rule sets defined by a user as rule sets capable of having a unique conflict;

comparing at the parameters of the packet to each defined unique conflict rule set of the defined unique conflict rule sets;

selecting for inspection a defined unique conflict rule set from the list of defined unique conflict rule sets if the parameters of the packet match the defined unique conflict rule set; and

selecting for inspection each of the at least two rule sets that match parameters of the packet if the parameters of the packet do not match a defined unique conflict rule set of the defined unique conflict rule sets.

9. The method of claim 8, wherein the defined unique conflict rule sets are created after initialization of the rule sets.

10. The method of claim 8, wherein the parameters of the packet are compared to each defined unique conflict rule set of the defined unique conflict rule sets at run time.

11. The method of claim 8, further comprising inspecting each of the at least two rule sets that match parameters of the packet if the parameters of the packet do not match a defined unique conflict rule set of the defined unique conflict rule sets.

12. The method of claim 8, further comprising inspecting each of the at least two rule sets that match parameters of the packet if the parameters of the packet do not match a defined unique conflict rule set of the defined unique conflict rule sets, until a rule set generates an intrusion detection event.

13. A method for resolving unique conflicts between at least two rule sets that match parameters of a packet during rule set selection in an intrusion detection system, comprising:

creating defined unique conflict rule sets, wherein each defined unique conflict rule set is created by combining at least two unique rule sets defined by a user as rule sets capable of having a unique conflict;

comparing the parameters of the packet to each defined unique conflict rule set of the defined unique conflict rule sets;

selecting for inspection a defined unique conflict rule set from the defined unique conflict rule sets if the parameters of the packet match the defined unique conflict rule set; and

selecting randomly for inspection one of the at least two rule sets that matches parameters of the packet if the parameters of the packet do not match a defined unique conflict rule set of the defined unique conflict rule sets.

14. A system for intrusion detection, the system comprising:

a packet acquisition system, wherein the packet acquisition system intercepts a packet transmitted across a computer network and wherein the packet acquisition system decodes the packet;

a preprocessor, wherein the preprocessor receives decoded packet information from the packet acquisition system and wherein the preprocessor preprocesses the packet;

a detection engine, wherein the detection engine receives preprocessed packet information from the preprocessor and wherein the detection engine inspects the packet for intrusions;

a logging system, wherein the logging system receives and stores detected intrusion information from the detection engine; and

a rule optimizer, wherein the rule optimizer creates a plurality of rule sets from a plurality of intrusion detection rules and provides the plurality of rules sets to the detection engine, wherein the detection engine selects at least one rule set from the plurality of rule sets for inspection for each packet that the detection engine processes.

15. The system of claim 14, wherein the detection engine selects one a rule set from the plurality rule sets for inspection for each packet that the detection engine processes.

16. The system of claim 14, wherein the detection engine selects two rule sets from the plurality rule sets for inspection for each packet that the detection engine processes.

17. A method for detecting rule matches during packet processing in an intrusion detection system, comprising:

identifying each rule as one of a content rule and a non-content rule;

scanning a search pattern parameter of a rule identified as a content rule against a packet;

adding a match of the search pattern parameter and the packet to a list of content match events;

comparing remaining rule parameters of each rule associated with each item on the list of content match events with packet parameters of the packet;

adding a match of all the remaining rule parameters with the packet parameters to a list of intrusion events;

comparing non-content rule parameters of each rule identified as a non-content rule with the packet parameters;

adding a match of all the non-content rule parameters with the packet parameters to the list of intrusion events; and

selecting at least one intrusion event from the list of intrusion events for the packet for logging.

18. The method of claim 17, wherein the search pattern parameter comprises at least one of a string defined by rule content keyword and a string defined by a rule uricontent keyword.

19. The method of claim 17, further comprising scanning, in parallel, search pattern parameters of at least two rules identified as content rules against the packet.

20. The method of claim 19, wherein scanning search pattern parameters of at least two rules identified as content rules against the packet is performed using a Wu-Manber search algorithm.

21. The method of claim 19, wherein scanning search pattern parameters of at least two rules identified as content rules against the packet is performed using an Aho-Corasick search algorithm.

22. The method of claim 19, wherein scanning search pattern parameters of at least two rules identified as content rules against the packet is performed using a naive set-based Boyer-Moore search algorithm.

23. The method of claim 17, further comprising halting the scanning of the search pattern parameter against the packet, if the search pattern parameter has previously matched the packet.

24. A system for intrusion detection, the system comprising:

a packet acquisition system, wherein the packet acquisition system intercepts a packet transmitted across a computer network and wherein the packet acquisition system decodes the packet;

a preprocessor, wherein the preprocessor receives decoded packet information from the packet acquisition system and wherein the preprocessor preprocesses the packet;

a detection engine, wherein the detection engine receives preprocessed packet information from the preprocessor, wherein the detection engine inspects the packet for intrusions, and wherein the detection engine identifies each rule as one of a content rule and a non-content rule, scans a search pattern parameter of a rule identified as a content rule against a packet, adds a match of the search pattern parameter and the packet to a list of content match events, compares remaining rule parameters of each rule associated with each item on the list of content match events with packet parameters of the packet, adds each match of all the remaining rule parameters with the packet parameters to a list of intrusion events, compares non-content rule parameters of each rule identified as a non-content rule with the packet parameters, adds each match of all the non-content rule parameters with the packet parameters to the list of intrusion events, and selects for the packet at least one intrusion event from the list of queued intrusion events for logging; and

a logging system, wherein the logging system receives and stores detected intrusion information from the detection engine.

25. A method for analyzing data flow in a computer network using an intrusion detection system, comprising:

intercepting a packet transmitted on the computer network;

determining a protocol associated with the packet;

determining a type of data flow associated with the protocol; and

processing the packet in accordance with the determined type of data flow.

26. The method of claim 25, wherein the protocol comprises HTTP.

27. The method of claim 25, wherein the type of data flow comprises one of client-to-server data flow and server-to-client data flow.

28. The method of claim 25, wherein the determined type of data flow comprises HTTP response data traffic, which accordingly, is not processed by the intrusion detection system.

29. A method for determining the portions of HTTP data flow in a computer network that should not be processed by an intrusion detection system, comprising:

intercepting a packet on the computer network;

determining if a transport protocol of the packet comprises a TCP portion;

determining if a source port in a header portion of the TCP portion comprises a Web server port, if the transport protocol comprises the TCP portion;

determining if a destination port of the header portion comprises a Web server port, if the source port comprises a Web server port;

decoding a data portion of the TCP portion, if the destination port does not comprise a Web server port;

determining if the data portion comprises an HTTP response header;

processing the data portion only up to an HTTP maximum response bytes limit and ignoring the remainder of the data portion, if the data portion comprises the HTTP response header; and

ignoring the data portion, if the data portion does not comprise the HTTP response header.

30. The method of claim 29, wherein it is determined if the source port comprises port 80.

31. The method of claim 29, wherein it is determined if the destination port comprises port 80.

32. A system for intrusion detection, the system comprising:

a packet acquisition system, wherein the packet acquisition system intercepts a packet transmitted across a computer network and wherein the packet acquisition system decodes the packet;

a preprocessor, wherein the preprocessor receives decoded packet information from the packet acquisition system and wherein the preprocessor preprocesses the packet;

a detection engine, wherein the detection engine receives preprocessed packet information from the preprocessor, wherein the detection engine inspects the packet for intrusions, and wherein the detection engine determines a protocol associated with the packet, determines a type of data flow associated with the protocol, and processes the packet in accordance with the determined type of data flow; and

a logging system, wherein the logging system receives and stores detected intrusion information from the detection engine.

33. A system for intrusion detection, the system comprising:

a packet acquisition system, wherein the packet acquisition system intercepts a packet transmitted across a computer network and wherein the packet acquisition system decodes the packet;

a preprocessor, wherein the preprocessor receives decoded packet information from the packet acquisition system and wherein the preprocessor preprocesses the packet;

a detection engine,

wherein the detection engine receives preprocessed packet information from the preprocessor,

wherein the detection engine inspects the packet for intrusions, and

wherein the detection engine determines a protocol associated with the packet, determines a type of data flow associated with the protocol, and processes the packet in accordance with the determined type of data flow,

wherein the detection engine inspects the packet for intrusions, and wherein the detection engine identifies each rule as one of a content rule and a non-content rule, scans a search pattern parameter of a rule identified as a content rule against a packet, adds a match of the search pattern parameter and the packet to a list of content match events, compares remaining rule parameters of each rule associated with each item on the list of content match events with packet parameters of the packet, adds each match of all the remaining rule parameters with the packet parameters to a list of intrusion events, compares non-content rule parameters of each rule identified as a non-content rule with the packet parameters, adds each match of all the non-content rule parameters with the packet parameters to the list of intrusion events, and selects for the packet at least one intrusion event from the list of queued intrusion events for logging;

a logging system, wherein the logging system receives and stores detected intrusion information from the detection engine; and

a rule optimizer, wherein the rule optimizer creates a plurality of rule sets from a plurality of intrusion detection rules and provides the plurality of rules sets to the detection engine, wherein the detection engine selects at least one rule set from the plurality of rule sets for inspection for each packet that the detection engine processes.