ICACT20230053 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Thank you!
|
|
ICACT20230053 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Finally, we come to conclusions, we develop an intelligent defense system integrating data analysis, machine learning, optimization, and firewall technology. Our system can automatically generate snort firewall rules and aim to resolve manually defined rules config errors. After the coverage test, our attack coverage rate of snort rules generated by this system can reach 98%.
|
|
ICACT20230053 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The left table is the confusion matrix of the data through the K-means algorithm. TP is the number of packets that are grouped correctly after the algorithm, FP is the number of packets that are incorrectly grouped, FN is the number of packets that cannot be grouped but can be classified into clusters, and TN is the number of packets that cannot be grouped after the algorithm judges. The right table shows the accuracy rate obtained by K-means and the coverage rate of the attack pattern by the snort ruleset. Experiments have confirmed that the coverage rate can reach 98%; it can perfectly filter all kinds of attacks collected by Cowrie. Establish a suitable defense mechanism.
|
|
ICACT20230053 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The records of the number of rules and clusters in the test are as follows, the measurement data is 68,936,206 attack packets collected through cowrie, we classify them into 31 clusters and generate 198 rules, and observed log file generated by snort to check the rule coverage of the attacks.
|
|
ICACT20230053 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Next, we will come to our attack coverage test. In order to test that the system can successfully use the snort rule to intercept the corresponding packets. we design a network structure as in this graph, there is a Windows 10 and Ubuntu VM connected in a subnet, Snort also be deployed on the Ubuntu side to sniff inbound, then we use Scapy to reproduce and sent the attack packet from Windows to Ubuntu.
Take an attack session as an example, reproduce and send every packet in the session, then we can observe whether the rules match the attack behavior in the log, which cluster it belongs to and shows the Corresponding MITER ATT&CK TTPs and what its malicious score is.
|
|
ICACT20230053 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The entire generated process will be shown in the figure below, we have packet_payload in the same cluster be input and generate regular expression base snort rule which can match all payload in a specific cluster.
|
|
ICACT20230053 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In order to match the payload in the cluster with as few rules as possible, we need to use regular expression, and the way we generate regex is based on genetic algorithm, converting the operand of regular expression as Permutation of continuous numbers. In the select method we use Roulette wheel Selection, Recombination method is doing partially Mapped Crossover with a probability 30%, mutation method is to Randomly swap two genes with a probability 5%. The population is 100 and we do 20 generations to determine the final regular expression.
|
|
ICACT20230053 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Snort is a powerful, lightweight Network Intrusion Detection system (NIDS). It can be deployed to monitor TCP/IP networks, widely used to analyze suspicious network traffic. A Snort rule will be like below graph, first, we have action, which told snort what to do when the rule match, then the rule protocol describes what the rule focus on, next followed by source IP and source Port and destination IP, destination port, to decide whether inbound packet need to be sniffed.
|
|
ICACT20230053 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The final classification result will be like the below graph, we have session_id and packet_id to recognize specific packet and what session it belongs to, and packet_payload to record raw payload extract from the cowrie honeypot log. Then also record it TTP, cluster and cluster_id.
|
|
ICACT20230053 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Now we can observe an attack session that followed Cyber Kill Chain in the cowire log, it first tries to stop the iptables service, and then downloads a malicious file, sets file permissions as executable, next will start the process running in the background, to achieve Persistence, and finally close the SSH connection.
|
|
ICACT20230053 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
To label attack behavior, we use MITER ATT&CK TTPs. MITER ATT&CK is a knowledge base that shares cyber adversary behavior and attack lifecycle. It will be updated regularly to keep track of new types of attacks, which allows it to represent classified attacks more systematically.
|
|
ICACT20230053 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In data grouping, we use K-means to classify data. K-means is an unsupervised learning algorithm. The processing flow includes the following, first, set value K, which is the number of cluster centers, second, calculate the Euclidean distance between each data to all cluster centers. Third, Find the min distance and choose it as the cluster of this data, then repeat steps 2 and 3. Finish until all data points don't change too much from the cluster center.
|
|
ICACT20230053 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Cowrie honeypot is efficient for collecting and analyzing the activities of malicious actors, especially for SSH and Telnet. So first, we extract packet information from Cowrie Log, parse data to the session dictionary and save it as a dataframe, so that we can perform data analysis and data grouping with clean data.
|
|
ICACT20230053 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Next, in the proposed method we will separate into three parts, classify attack behavior and tag with MITER ATT&CK, generate PCRE regex Snort rule for IPS filtering, and test the attack coverage of those rules.
|
|
ICACT20230053 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
first I will give a brief introduction to our intelligence defense system. Misconfiguration of firewall rules has always been considered a serious issue. Creating custom firewall rules is necessary to fit the growing system services. However, those manually defined rules are messy and buggy under the increasingly complex firewall architecture. To avoid being attacked behind an insecure firewall. We need a system that can automatically generate firewall rules, which can help us filter external network attacks and even tell us what kind of attack it captured.
|
|
ICACT20230053 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
My presentation consists of the following parts.
|
|
ICACT20230053 Slide.00
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
![[Big slide for presentation]](/upload/2023/0053/Presentation/00/PPT0.jpg){kind=link}