The Bro Network Security Monitor

The Bro Network Security Monitor
Broverview
Outline
Outline
Philosophy and Architecture

A framework for network traffic analysis.
Outline

History
From research to operations.
Outline

History
From research to operations.
Architecture
Components, logs, scripts, cluster.
What is Bro?
What is Bro?
Packet Capture
What is Bro?
Packet Capture
Traffic Inspection
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
NetFlow
Log Recording
syslog
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
NetFlow
Log Recording
syslog
Flexibility
Abstraction
Data Structures
3
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
NetFlow
Log Recording
syslog
Flexibility
Abstraction
Data Structures
3
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
NetFlow
Log Recording
syslog
Flexibility
Flexibility
Abstraction
Abstraction
Data Structures
Structures
Data
3
What is Bro?
Packet Capture
Traffic Inspection
Attack Detection
Domain-specific Python
NetFlow
Log Recording
syslog
Flexibility
Flexibility
Abstraction
Abstraction
Data Structures
Structures
Data
3
What is Bro?
Packet Capture
Sum is mo
re than the
pieces
Traffic Inspection
Attack Detection
Domain-specific Python
NetFlow
Log Recording
syslog
Flexibility
Flexibility
Abstraction
Abstraction
Data Structures
Structures
Data
3
Philosophy
Philosophy
Fundamentally different from other IDS.
Reset your idea of an IDS before starting to use Bro.
Philosophy
Real-time network analysis framework.

Primarily an IDS, but many use it for general traffic analysis.
Philosophy

Policy-neutral at the core.

Can accommodate a range of detection approaches.
Philosophy


Highly stateful.
Tracks extensive application-layer network state.
Philosophy


Highly stateful.
Tracks extensive application-layer network state.
Supports forensics.
Extensively logs what it sees.
Target Audience
Target Audience
Network-savvy users.
Requires understanding of your network.
Target Audience
Unixy mindset.
Command-line based, fully customizable.
Target Audience
Unixy mindset.
Command-line based, fully customizable.
Large-scale environments.
Effective also with liberal security policies.
Bro History
1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
Vern writes 1st

line of code
Bro History
1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
Vern writes 1st

line of code
v0.2
1st CHANGES
entry
LBNL starts
using Bro
operationally
v0.6
RegExps
Login analysis
v0.7a90
Profiling
State Mgmt
v0.4
HTTP analysis
Scan detector
IP fragments
Linux support
v0.8aX/0.9aX
SSL/SMB
STABLE releases
BroLite
v0.7a175/0.8aX
Signatures
SMTP
IPv6 support
User manual
v0.7a48
Consistent
CHANGES
v1.0
BinPAC
IRC/RPC analyzers
64-bit support
Sane version numbers
0.8a37
Communication
Persistence
Namespaces
Log Rotation
v1.5
BroControl
v1.1/v1.2
when Stmt
Resource tuning
Broccoli
DPD
v2.0
New Scripts
Bro SDCI
v2.2 (beta)
File Analysis
Summary Stat.
v2.1
IPv6
Input Framew.
v1.4
DHCP/BitTorrent
HTTP entities
NetFlow
Bro Lite Deprecated
v1.3
Ctor expressions
GeoIP
Conn Compressor
Bro History
Host Context
Time Machine
Enterprise Traffic
Academic
Publications
TRW
State Mgmt.
Independ. State
USENIX Paper
Anonymizer
Active Mapping
Context Signat.
Stepping Stone
Detector
Bro Cluster
Shunt
BinPAC
DPD
2nd Path
Parallel Prototype
Input Framework
Autotuning
1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
Vern writes 1st

line of code
v0.2
1st CHANGES
entry
LBNL starts
using Bro
operationally
v0.6
RegExps
Login analysis
v0.7a90
Profiling
State Mgmt
v0.4
HTTP analysis
Scan detector
IP fragments
Linux support
v0.8aX/0.9aX
SSL/SMB
STABLE releases
BroLite
v0.7a175/0.8aX
Signatures
SMTP
IPv6 support
User manual
v0.7a48
Consistent
CHANGES
v1.0
BinPAC
IRC/RPC analyzers
64-bit support
Sane version numbers
0.8a37
Communication
Persistence
Namespaces
Log Rotation
v1.5
BroControl
v1.1/v1.2
when Stmt
Resource tuning
Broccoli
DPD
v2.0
New Scripts
Bro SDCI
v2.2 (beta)
File Analysis
Summary Stat.
v2.1
IPv6
Input Framew.
v1.4
DHCP/BitTorrent
HTTP entities
NetFlow
Bro Lite Deprecated
v1.3
Ctor expressions
GeoIP
Conn Compressor
Whos Using It?

Installations across the US
Universities
Research Labs
Supercomputer Centers
Fortune 50 Industry
Examples
Lawrence Berkeley National Lab
Indiana University
National Center for Supercomputing Applications
National Center for Atmospheric Research
... and many more sites
Fully integrated into Security Onion

Popular security-oriented Linux distribution
Recent User Meetings

Bro Workshop 2011 at NCSA
Bro Exchange 2012 at NCAR
Bro Exchange 2013 at NCSA
Each attended by about 50-90 operators
from
from 30-50 organizations
7
Deployment
Internet
Internal
Network
Deployment
Tap
Internet
Internal
Network
Bro
Deployment
Tap
Internet
Internal
Network
Bro
Runs on commodity platforms.

! Standard PCs & NICs.
Supports FreeBSD/Linux/OS X.
Creating Visibility with Bro

> bro -i en0
[ ... wait ...]
> cat conn.log

> bro -i en0
[ ... wait ...]
> cat conn.log
#fields ts
id.orig_h
id.orig_p
id.resp_h
id.resp_p proto
service
1144876741.1198
1144876612.6063
1144876596.5597
1144876606.7789
1144876741.4693
1144876745.6102
1144876605.6847
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
53115
53090
53051
53082
53116
53117
53075
82.94.237.218
198.189.255.82
193.203.227.129
198.189.255.73
82.94.237.218
66.102.7.99
207.151.118.143
80
80
80
80
80
80
80
http
http
http
http
http
http
http
tcp
tcp
tcp
tcp
tcp
tcp
tcp
duration
16.14929
4.437460
0.372440
0.597711
16.02667
1.004346
0.029663

> bro -i en0
[ ... wait ...]
> cat conn.log
#fields ts
id.orig_h
id.orig_p
id.resp_h
id.resp_p proto
service
1144876741.1198
1144876612.6063
1144876596.5597
1144876606.7789
1144876741.4693
1144876745.6102
1144876605.6847
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
53115
53090
53051
53082
53116
53117
53075
82.94.237.218
198.189.255.82
193.203.227.129
198.189.255.73
82.94.237.218
66.102.7.99
207.151.118.143
80
80
80
80
80
80
80
http
http
http
http
http
http
http
tcp
tcp
tcp
tcp
tcp
tcp
tcp
duration
16.14929
4.437460
0.372440
0.597711
16.02667
1.004346
0.029663
> cat http.log

> bro -i en0
[ ... wait ...]
> cat conn.log
#fields ts
id.orig_h
id.orig_p
id.resp_h
id.resp_p proto
service
1144876741.1198
1144876612.6063
1144876596.5597
1144876606.7789
1144876741.4693
1144876745.6102
1144876605.6847
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
53115
53090
53051
53082
53116
53117
53075
82.94.237.218
198.189.255.82
193.203.227.129
198.189.255.73
82.94.237.218
66.102.7.99
207.151.118.143
80
80
80
80
80
80
80
http
http
http
http
http
http
http
tcp
tcp
tcp
tcp
tcp
tcp
tcp
duration
16.14929
4.437460
0.372440
0.597711
16.02667
1.004346
0.029663
> cat http.log

#fields ts
1144876741.6335
1144876742.1687
1144876741.2838
1144876742.3337
1144876742.3337
1144876742.3337
1144876742.3337
1144876742.3338
1144876745.6144
id.orig_h
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
192.150.186.169
id.orig_p [...] host

53116
docs.python.org
53116
docs.python.org
53115
docs.python.org
53116
docs.python.org
53116
docs.python.org
53116
docs.python.org
53116
docs.python.org
53116
docs.python.org
53117
www.google.com
uri
/lib/lib.css
/icons/previous.png
/lib/lib.html
/icons/up.png
/icons/next.png
/icons/contents.png
/icons/modules.png
/icons/index.png
/
status_code
200
304
200
304
304
304
304
304
200
user_agent [...]
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0

> bro -i en0
[ ... wait ...]
> cat conn.log
#fields ts
id.orig_h
id.orig_p
id.resp_h
id.resp_p proto
1144876741.1198 192.150.186.169 53115

82.94.237.218
80
tcp
1144876612.6063 192.150.186.169 53090
198.189.255.82 80
tcp
1144876596.5597 192.150.186.169 53051
193.203.227.129 80
tcp
[...]
host
uri53082
1144876606.7789
192.150.186.169
198.189.255.73 status_code
80
tcp
1144876741.4693
192.150.186.169
53116
82.94.237.218 200
80
tcp
docs.python.org
/lib/lib.css
1144876745.6102 192.150.186.169 53117
66.102.7.99
80
tcp
docs.python.org
/icons/previous.png
304
1144876605.6847
192.150.186.169
53075
207.151.118.143
80
tcp
service
duration
http
16.14929
http
4.437460
http
0.372440
user_agent
[...]
http
0.597711
http
16.02667
Mozilla/5.0
http
1.004346
Mozilla/5.0
http
0.029663
docs.python.org
> catdocs.python.org
http.log
docs.python.org
#fields ts
id.orig_h
docs.python.org
1144876741.6335 192.150.186.169
1144876742.1687 192.150.186.169
docs.python.org
1144876741.2838 192.150.186.169
1144876742.3337
192.150.186.169
docs.python.org
1144876742.3337 192.150.186.169
www.google.com
1144876742.3337
192.150.186.169
/lib/lib.html
200
/icons/up.png
304
/icons/next.png
304
id.orig_p [...] host
uri
/icons/contents.png
304
53116
docs.python.org /lib/lib.css
53116
docs.python.org /icons/previous.png
/icons/modules.png
304
53115
docs.python.org /lib/lib.html
53116
docs.python.org /icons/up.png
/icons/index.png
304
53116
docs.python.org /icons/next.png
/
200
53116
docs.python.org /icons/contents.png
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
status_code user_agent [...]
200 Mozilla/5.0
Mozilla/5.0
304
Mozilla/5.0
Mozilla/5.0
200
Mozilla/5.0
304 Mozilla/5.0
Mozilla/5.0
304
Mozilla/5.0
Mozilla/5.0
304
Mozilla/5.0
1144876742.3337
1144876742.3338
1144876745.6144
53116
53116
53117
304
304
200
192.150.186.169
192.150.186.169
192.150.186.169
docs.python.org
docs.python.org
www.google.com
/icons/modules.png
/icons/index.png
/
Mozilla/5.0
Mozilla/5.0
Mozilla/5.0
Architecture
Packets
Network
10
Architecture
Events
Protocol Decoding
Event Engine
Packets
Network
10
Architecture
Logs
Analysis Logic
Notification
Policy Script Interpreter

Events
Protocol Decoding
Event Engine
Packets
Network
10
Architecture
Logs
Analysis Logic
Notification
User Interface
Policy Script Interpreter

Events
Protocol Decoding
Event Engine
Packets
Network
10
Event Model
Web
Client
1.2.3.4/4321
Request for /index.html
Status OK plus data
Web
Server
5.6.7.8/80
11
Event Model
Web
Client
1.2.3.4/4321
SYN SYN
ACK
...
Status OK plus data
Stream of TCP packets

ACK
ACK
...
Web
Server
5.6.7.8/80
ACK FIN FIN
11
Event Model
Web
Client
1.2.3.4/4321
SYN SYN
Event
ACK
...
Status OK plus data

ACK
ACK
...
Web
Server
5.6.7.8/80
ACK FIN FIN
connection_established(1.2.3.4/4321 5.6.7.8/80)
11
Event Model
Web
Client
1.2.3.4/4321
SYN SYN
Event
ACK
...
Status OK plus data

ACK
ACK
...
Web
Server
5.6.7.8/80
ACK FIN FIN
TCP stream reassembly for originator
Event
http_request(1.2.3.4/4321 5.6.7.8/80, GET, /index.html)
11
Event Model
Web
Client
1.2.3.4/4321
SYN SYN
Event
ACK
...
Status OK plus data

ACK
ACK
...
Web
Server
5.6.7.8/80
ACK FIN FIN
Event

TCP stream reassembly for responder
Event
http_reply(1.2.3.4/4321 5.6.7.8/80, 200, OK, data)
11
Event Model
Web
Client
1.2.3.4/4321
SYN SYN
Event
ACK
...
Status OK plus data

ACK
ACK
...
Web
Server
5.6.7.8/80
ACK FIN FIN
Event

TCP stream reassembly for responder
Event
http_reply(1.2.3.4/4321 5.6.7.8/80, 200, OK, data)

Event
connection_finished(1.2.3.4/4321, 5.6.7.8/80)
11
Script Example: Matching URLs

Task: Report all Web requests for files called passwd.
12
Script Example: Matching URLs

Task: Report all Web requests for files called passwd.
event http_request(c: connection,
method: string,
original_URI: string,
unescaped_URI: string,
version: string)
{
if ( method == "GET" && unescaped_URI
NOTICE(...); # Alarm.
}
#
#
#
#
#
Connection.
HTTP method.
Requested URL.
Decoded URL.
HTTP version.
== /.*passwd/ )
12
Script Example: Scan Detector

Task: Count failed connection attempts per source address.
Bro Workshop 2011
13
Script Example: Scan Detector

Task: Count failed connection attempts per source address.
global attempts: table[addr] of count &default=0;
event connection_rejected(c: connection)
{
local source = c$id$orig_h;
#
local n = ++attempts[source];
#
if ( n == SOME_THRESHOLD )
#
NOTICE(...);
#
}
Bro Workshop 2011
Get source address.

Increase counter.
Check for threshold.
Alarm.
13
Distributed Scripts
14
Distributed Scripts
Bro comes with >10,000 lines of script code.

Prewritten functionality thats just loaded.
14
Distributed Scripts
Bro comes with >10,000 lines of script code.

Prewritten functionality thats just loaded.
Scripts generate alarms and logs.

Amendable to extensive customization and extension.
14
Bro comes with support for ...
15
Bro comes with support for ...

Extract files from HTTP, SMTP, etc.
Extract/monitor SSL certificates.
Detect malware via Team Cymru's Malware Hash Registry.
Report vulnerable software versions on the network.
Detect popular web applications.
Detect SSH brute-forcing.
Notable external scripts:
Bro module for Mandiant APT1 report
Lucky 13 detector.
ICSI SSL notary
15
Bro Ecosystem
Tap
Internet
Internal
Network
Bro
16
Bro Ecosystem
Tap
Internal
Network
Internet
Bro
Control
Output
BroControl
User Interface
16
Bro Ecosystem
Tap
Internal
Network
Internet
Contributed
Scripts
Functionality
Bro
Control
Output
BroControl
User Interface
16
Bro Ecosystem
Tap
Internal
Network
Internet
Contributed
Scripts
Functionality
Bro
Control
Events
State
Other Bros
Output
BroControl
User Interface
16
Bro Ecosystem
Tap
Internal
Network
Internet
Contributed
Scripts
Functionality
Bro
Control
Events
State
Other Bros
Output
Events
Bro Client Communication Library
BroControl
Broccoli
User Interface
16
Bro Ecosystem
Tap
Internal
Network
Internet
Contributed
Scripts
Functionality
Bro
Control
Events
State
Other Bros
Output
Events
BroControl
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
16
Bro Ecosystem
Time Machine
Tap
Internet
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
Other Bros
Output
Events
BroControl
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
16
Bro Ecosystem
Time Machine
Tap
Internet
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
Other Bros
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
16
Bro Ecosystem
Time Machine
Tap
Internet
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
Other Bros
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
http:://www.bro-ids.org/download
git://git.bro-ids.org
16
Bro Ecosystem
Time Machine
Bro Distribution
Tap
Internet
bro-2.1.tar.gz
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
Other Bros
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
http:://www.bro-ids.org/download
git://git.bro-ids.org
16
Bro Cluster Ecosystem

Time Machine
Tap
Internet
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
External Bro
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
17

Time Machine
Tap
Internet
Contributed
Scripts
Functionality
Bro
Control
Internal
Network
Tap
Events
State
External Bro
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
17

Time Machine
Tap
Internal
Network
Tap
Internet
LoadBalancer
Contributed
Scripts
Functionality
Bro
Control
Events
State
External Bro
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
17

Time Machine
Tap
Internal
Network
Tap
Internet
LoadBalancer
Packets
Contributed
Scripts
Functionality
Bro
Bro
Bro
Bro
Control
Events
Bro
State
External Bro
Output
Events
bro-aux
BinPAC
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User Interface
Broccoli Ruby
(Broccoli Perl)
17

Time Machine
Tap
Internal
Network
Tap
Internet
LoadBalancer
Packets
Contributed
Scripts
Functionality
Bro
Control
bro-aux
BinPAC
Bro
Bro
Bro
Control
Output
Events
Bro
State
External Bro
Output
Events
capstats
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User
UserInterface
Interface
Broccoli Ruby
(Broccoli Perl)
17

Time Machine
Tap
Internal
Network
Tap
Internet
LoadBalancer
Packets
Contributed
Scripts
Functionality
Bro
Control
bro-aux
BinPAC
capstats
Frontend
Bro
Bro
Bro
Workers
Control
Output
Manager
Events
Bro
State
External Bro
Output
Events
BroControl
BTest
tracesummary
Broccoli Python
Broccoli
User
UserInterface
Interface
Broccoli Ruby
(Broccoli Perl)
17

The Bro Network Security Monitor

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

The Bro Network Security Monitor

Загружено:

Авторское право:

Доступные форматы

The Bro Network Security Monitor

Philosophy and Architecture

Philosophy and Architecture

Philosophy and Architecture

Real-time network analysis framework.

Real-time network analysis framework.

Policy-neutral at the core.

Real-time network analysis framework.

Policy-neutral at the core.

Real-time network analysis framework.

Policy-neutral at the core.

Vern writes 1st

Vern writes 1st

Vern writes 1st

Whos Using It?

Fully integrated into Security Onion

Recent User Meetings

Runs on commodity platforms.

Creating Visibility with Bro

Creating Visibility with Bro

Creating Visibility with Bro

Creating Visibility with Bro

> cat http.log

Creating Visibility with Bro

> cat http.log

id.orig_p [...] host

Creating Visibility with Bro

1144876741.1198 192.150.186.169 53115

Policy Script Interpreter

Policy Script Interpreter

Request for /index.html

Status OK plus data

Request for /index.html

Status OK plus data

Stream of TCP packets

ACK FIN FIN

Request for /index.html

Status OK plus data

Stream of TCP packets

ACK FIN FIN

Status OK plus data

Stream of TCP packets

ACK FIN FIN

http_request(1.2.3.4/4321 5.6.7.8/80, GET, /index.html)

Status OK plus data

Stream of TCP packets

ACK FIN FIN

http_request(1.2.3.4/4321 5.6.7.8/80, GET, /index.html)

http_reply(1.2.3.4/4321 5.6.7.8/80, 200, OK, data)

Status OK plus data

Stream of TCP packets

ACK FIN FIN

http_request(1.2.3.4/4321 5.6.7.8/80, GET, /index.html)

http_reply(1.2.3.4/4321 5.6.7.8/80, 200, OK, data)

Script Example: Matching URLs

Script Example: Matching URLs

Script Example: Scan Detector

Bro Workshop 2011

Script Example: Scan Detector

Bro Workshop 2011

Get source address.

Bro comes with >10,000 lines of script code.

Bro comes with >10,000 lines of script code.

Scripts generate alarms and logs.