ICACT20210179 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We plan to learn various data with AI, including highlighted raw data derived as result of the proposed system.
Through this, we will research on improved security system.
Thank you!
|
|
ICACT20210179 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Length field of ZAPHP means that payload size is 74bytes.
Packet Offset field means that Full Packet filed begins at the 44th byte. Also, it can be checked that raw data matched with rule begins at the 42th byte and ends at the 43th byte by Start Byte field and End Byte field.
Lastly, ZAPHP includes raw data matched with rule and full packet data.
Packet Highlight System displays full packet by highlighting data that matches with rule.
Users can check information about rule, zero-day packet and raw data that matches with rule though output of Packet Highlight System.
In a flow-based PCA, the values displayed on the output are transferred in the form of Json and displayed from the web UI
|
|
ICACT20210179 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The value of TimeStamp fields means that it was received between ‘August 24, 2020 00:00:00’ and ‘August 24, 2020 00:00:01’ (‘2020-08-24 00:00:01 ‘2020-08-24 00:00:00’)
Zero-Day Attack Packet Detection System which is received ZAPDP searches zero-day attack packet in flow-based PCA using TimeStamp and rule full set that sid is '255’.
In Detection Result, raw data matched with rule begins at the 42th byte and ends at the 43th byte.
After Zero-Day Attack Packet Detection System makes detection result into ZAPHP format, it sends ZAPHP to Packet Highlight System.
|
|
ICACT20210179 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We presuppose that target packet is zero-day attack packet
Updated new rule can be detected when a target packet is received
This rule is to detect if proposed system has received the packet in the past
|
|
ICACT20210179 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
There is format of Zero-Day Attack Packet Highlight Protocol.
ZAPHP is communication protocol for extracting raw data judged as security threat of zero-day packet and displaying the information to users.
ZAPHP consists of header which has fixed size of 40bytes and payload of unfixed size.
SID and TimeStamp field of ZAPHP mean same as those of ZAPDP.
Length field indicates payload size of ZAPHP and value is in bytes.
Packet Offset field indicates where Full Packet field begins.
Start Byte field indicates first location of raw data which matched with updated new rule.
Similarly, End Byte field indicates last location of raw data which matched with updated new rule.
Reserved field reserved for future use and it should be zero.
Matching Data field indicates raw data that matched with updated new rule in payload of full packet. Also, it must be hexadecimal value which can convert to ASCII.
Full Packet field indicates full packet that matched with updated new rule and must be hexadecimal value which can convert to ASCII.
|
|
ICACT20210179 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
There is format of Zero-Day Attack Packet Detection Protocol.
ZAPDP is communication protocol for detecting zero-day attack packet within flow that includes it and ZAPDP has fixed size of 20 bytes.
SID field is 4 bytes size and indicates assigned ID each rule of NIDPS.
TimeStamp field has time value that packet is received. It is 16bytes size and consists of TimeStamp(seconds) of 8bytes and TimeStamp(nanoseconds) of 8bytes.
TimeStamp(seconds) field indicates value from year to second (year, month, day, hour, minute, second).
TimeStamp(nanoseconds) field indicates value in units of nanoseconds less than the second unit.
|
|
ICACT20210179 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Packet Highlight System displays zero-day attack packet information and raw data of the packet matched with new rule for users to check.
ZAPHP Parsing Part parses ZAPDP after receives it.
After then, ZAPHP Parsing Part sends information for matching raw data detected in zero-day attack from full packet matched with new rule to Data Matching Part. Also, it sends sid, timestamp to Output Part.
Data Matching Part sends matched result to Output Part after it compares payload of full packet and received information.
Output Part displays information which is received from ZAPHP Parsing Part and Data Matching Part.
So, users can conform information about zero-day packet, rule and matched raw data.
|
|
ICACT20210179 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Zero-Day Attack Packet Detection System performs deep packet inspection on packets in flow.
ZAPDP Parsing Part parses ZAPDP after receives it.
When parsing is done, ZAPDP Parsing Part sends sid value to Rule DB and timestamp value to Pcap File Parsing Part.
Rule DB searches rule full set matched received sid value and sends it to Packet Matching Part.
Pcap File Parsing Part parses pcap files and searches flow with received timestamp value.
When matching is finished, Pcap File Parsing Part sends packets in the flow to Packet Matching Part.
Packet Matching Part searches packet which is matched with the rule full set in received packets from Pcap File Parsing Part.
If Packet Matching Part finds packet that matches the rule, it transmits to Packet Highlight System the packet information into ZAPHP format.
|
|
ICACT20210179 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
There is architecture of proposed system.
Proposed system consists of Zero-Day Attack Packet Detection System and Packet Highlight System.
Also, it uses ZAPDP and ZAPHP for communication between internal systems.
First of all, Flow based PCA sends stored packets when new rules are updated.
NIDPS inspects received packets from Flow based PCA.
If there are matched packets with updated rules in inspection result, it makes the packet to format of ZAPDP and sends to Zero-Day Attack Packet Detection System.
|
|
ICACT20210179 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
There are S/W and UI architecture of porposed system.
When you click Packet or Flow on a Flow-based PCA, timestamp and sid values of flow are input value.
The called highlight program receives packet information and rule full set according to the input value.
Highlight program matches the rule full set with the packet data.
The matching results are then passed to the Json file format to highlight in UI.
|
|
ICACT20210179 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
So, author needed a way to can detect the attack packet in a way other than timestamp.
Furthermore, to analyze zero-day attack packets, we needed technique to check the raw data that matches the rule in zero-day attack packets.
To do this, the proposed system matches rule full set with the packet data.
|
|
ICACT20210179 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We found a problem with flow-based PCA using First-N.
For security and privacy issue, please understand that the photos were mosaicized.
The PCA marks packet of the closest time to suricata log's timestamp.
But, In some cases, the timestamp of suricata log and packet reception time don't match.
Packets marked in the shape of magnifiers in the figure may not be matching packets with rules.
That is, marked packets may not be attack packets.
|
|
ICACT20210179 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
PCA can be used to defend against these zero-day attacks.
It store all received packets as full packet.
When a new pattern of attacks is discovered, it checks stored packets in the PCA.
Through this process, PCA checks that newly discovered attacks have been received in the past.
It can respond to zero-day attacks to some extent through PCA.
But, PCA requires equipment with very large storage capacity. Because it has to store all packets as full packet.
Therefore, PCA is very expensive and the packet storage period is very limited.
Thus, PCA was introduced to store a few packets, not all received packets.
Flow based PCA utilize technologies such as Frist-N to store only some packets in flow.
It increase storage efficiency compared to traditional PCA by reducing the number of packet stores.
However, It isn’t sure which of the packet in flow is matched to the rule.
|
|
ICACT20210179 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
These vulnerabilities result in zero-day attacks.
Zero-day attack targets undisclosed vulnerability that hackers can be used to adversely affect computer programs.
In order to defend zero-day attack, ways to recognize and respond to the attack must be created and applied to the system.
But this process takes long time.
Thus, until new countermeasures are updated, it become highly vulnerable to damage from zero-day attack packets.
|
|
ICACT20210179 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
One of recently using security systems is NIDPS.
NIDPS is system that has both IDS and IPS functions for defending incoming attacks from external networks in real time.
IDS can detect attacks from incoming traffic.
IPS can drop as well as detect packets with risk of attack.
NIDPS is categorized signature-based NIDPS and anomaly-based NIDPS.
Anomaly-based NIDPS can detect abnormal traffic after learning about normal traffic.
So, It can detect unknown attack packets.
However, there is problem that anomaly-based NIDPS has the possibility of receiving packets which are known for attack packet
Signature-based NIDPS It defines pattern of packets in a rule and detects and blocks packets with the pattern.
So, It can drop and detect packets which are known for attack packet.
But it can't detect unknown attack packets. Therefore, there is a problem that signature-based NIDPS vulnerable to zero-day attack.
|
|
ICACT20210179 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hi, I'm Jang Hyeon Jeong. For ICACT 2021, I have cooperated with Mr. Jong Beom Kim who works researcher in Xabyss, Inc. and corresponding author, Professor Seong Gon Choi, helped. We proposed Zero-Day Attack Packet Highlighting System. Today, I introduce and explain our proposed system.
|
