SlideShare une entreprise Scribd logo

Distributed Firewall Anomaly Detection Through LTL Model Checking

•
•
Sylvain Hallé
Sylvain Hallé
Technologie
1  sur  37
Sylvain Hallé Sylvain Hallé, Éric Lunaud Ngoupé, Roger Villemaire, Omar Cherkaoui Fonds de recherche sur la nature et les technologies CRSNG NSERC Distributed Firewall Anomaly Detection Through LTL Model Checking Université du Québec à Chicoutimi CANADA Université du Québec à Montréal CANADA
Sylvain HalléSylvain Hallé Firewalls Incoming traffic Filtered traffic Source IP Port Dest. IP Port Decision 192.* 16.10.* 10.1.1.2 . . . 80 * 23 . . . 10.10.* * * . . . 80 * 23 . . . Accept Reject Accept . . .
Sylvain HalléSylvain Hallé What's wrong with this filter? FSM LTL . . . Algos Tools Rule # Interval Decision 1 2 3 4 5 Accept Deny Accept Accept Deny 50 2 3 3 9 33 92
Sylvain HalléSylvain Hallé What's wrong with this filter? FSM LTL . . . Algos Tools Rule # Interval Decision 1 2 3 4 5 Accept Deny Accept Accept Deny 50 2 3 3 9 33 92 Rule 2's packets are already handled by Rule 1: it is shadowed Rules 2 and 3 apply a different decision to some packets: they are correlated All of Rule 5's packets are applied the same decision as Rule 2: it is redundant
Sylvain Hallé ???? start 0 exact? 1 exact? 4 superset? 3 Ry ℜIM Rx 8 redundant 12 shadowed 11 general 13 correlated 14 none 15 proto y= proto x protoy ⊂ protox proto y ⊃ proto x superset? 6 srcy =srcx srcy ⊇ srcx dsty ⊆ dstx actiony =actionx actiony ≠ actionx dsty ⊆ dstx dsty ⊇ dstx srcy ⊂ srcx src y ⊃ src x subset? 2 subset? 5 srcy ⊆ srcx correlated? 7 srcy ⊃ srcx srcy ⊂ srcx dsty ⊆ dstx dsty ⊃ dstx dsty ⊃ dstx dsty ⊃ dstx dsty⊂dstx src y≠src x srcy≠srcx srcy ≠srcx dsty≠dstx dsty≠dstx dsty≠ dstx dsty ≠ dstx protoy ≠ protox Rx ℜIM Ry 9 actiony =actionx actiony ≠ actionx Rx ℜC Ry 10 actiony ≠ actionx actiony =actionx Previous results E. Al-Shaer & H. H. Hamed. Discovery of Policy Anomalies in Distributed Firewalls. INFOCOM 2004. For every pair of rules R , R ...x y
Sylvain Hallé Previous results B. Khorchani, S. Hallé, R. Villemaire. Firewall anomaly detection with a model checker for visibility logic. IM 2012. B A D t B AB A A overlaps B A ⋂ B A occludes B A ⊆ B A obstructs B A ⊇ B ◇* φ ○* φ ◻* φ some rule r', following r and such that r' * r, satisfies φ all rules r', following r and such that r' * r, satisfy φ the first rule r', following r and such that r' * r, satisfies φ a ⋀ d◇⋂( ) ⋁ d ⋀ a◇⋂( ) ◇⊇ TRUE -1 a ⋀ a◇⊇( ) ⋁ d ⋀ d◇⊇( )-1 -1 Correlation Shadowing Redundancy
Sylvain Hallé Routers Incoming traffic Outgoing traffic Source Destination Next hop 192.* 16.10.* 10.1.1.2 . . . 10.* 16.10.* 50.1.* . . . R1 R2 R3 . . .
Sylvain Hallé 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Rule 3.4 shadows Rule 1.2: packet accepted if enters from Node 1, rejected if from Node 3 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Rules 1.1 and 3.1 are spurious: a packet to 5 entering from Node 3 is routed to Node 1 where it is dropped 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? Yes if Node 1 receives traffic only from Node 3... 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? Yes if Node 1 receives traffic only from Node 3... No otherwise! 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 2.3 shadowed by Rule 3.1? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 2.3 shadowed by Rule 3.1? No since no traffic ever flows from Node 3 to Node 2 (all traffic is dropped at Node 1) 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 2.5 redundant wrt Rule 1.4? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Is Rule 2.5 redundant wrt Rule 1.4? No since packets destined to 4-5 are never routed to Node 1 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
Sylvain Hallé Issues The presence of an anomaly between rules R and R' depends on whether there is a possible path from R to R' ...and also on the field ranges of each routing rule along that path!
Sylvain Hallé How to detect an anomaly Keep track of an interval I of values and a decision D, called a frozen interval and a frozen decision In the beginning, set I to the full range of possible values, and D to "undefined" ? Frozen interval Frozen decision ①
Sylvain Hallé How to detect an anomaly Pick some ingress node as a starting point② 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥
Sylvain Hallé In every node visited, go through the firewall rules one by one in order 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ ③ How to detect an anomaly ...
Sylvain Hallé Once done scanning through the rules, pick one routing entry... Intersect the freeze interval with the entry chosen ...and move on to the destination node ④ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 0 10 4 8 ⋂ = 4 8 How to detect an anomaly
Sylvain Hallé At some point in the walk (only once!), pick the current firewall rule Intersect the freeze interval with the rule chosen Record the rule's decision in the freeze decision ⑤ 7 8 ⋂ = 3 [7,8] : ⊥ 4 8 7 8 ? ⊥ How to detect an anomaly
Sylvain Hallé How to detect an anomaly From this point on, compare the frozen interval/ decision with the interval/decision of every firewall rule "visited" ⑥ 5 [5,9] : ⊤ 7 8 ⊥ 5 9 ⊤ Frozen Spuriousness anomaly vs.
Sylvain Hallé Solution #1 Repeat this process... for every start point and every path by alternatively freezing every firewall rule Σk! k=1 n non-cyclic paths between n nodes
Sylvain Hallé Solution #2 For a given network, generate a Kripke structure whose traces are all the walks behaving as in steps ① to ⑥ Send the problem to a model checker Express anomalies as temporal logic properties on these traces (reachability problem)
Sylvain Hallé Variables in the Kripke structure Each state of the Kripke structure is a unique assignment of values to 7 state variables ιL ιR ⊥ ιD 3 [7,8] : ⊥ ρL ρR ρDχ Bounds of frozen interval Frozen decision Unique rule number Bounds of current firewall rule interval Current rule decision
Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD 3 [7,8] : ⊥ 4 [9,9] : ⊤ ρL ρR ρD χ Moving to the next rule in the current firewall ιL = a = b = d = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = a = b = d = 3 = 9 = 9 = ⊤
Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD 3 [7,8] : ⊥ ρL ρR ρD χ Freezing the current firewall rule ιL = a = b = ? = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = max(a, 7) = min(b, 8) = ⊥ = 3 = 7 = 8 = ⊥
Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD [4,8]: Device 2 ρL ρR ρD χ Select an applicable routing table entry and move to destination (first firewall rule) ιL = a = b = d = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = max(a, 4) = min(b, 8) = d = 1 = 5 = 6 = ⊤ 1 [5,6] : ⊤
Sylvain Hallé LTL properties Anomalies become properties on traces expressed in Linear Temporal Logic (LTL) Ex.: shadowing ιR ιDρL ρR ρDιL =⊥≤ ∧ ≥ =⊤ ∧∧G ( )
Sylvain Hallé Anomaly detector Firewall rules Routing table Encoder Decoder Kripke structure NuSMV Counter-example trace Anomaly explanation Node 1 Firewall rules Routing table Node n . . . Anomalies expressed as LTL formulæ Analysis tool
Sylvain Hallé Sample input file Node name: 0 0: 0, 0 : 0, 6, 7 : 0, deny 1: 0, 0 : 0, 0, 0 : 0, accept 2: 0, 0 : 0, 12, 13 : 0, accept ... Routing table: 12, 14, 12 8, 9, 1 5, 7, 3 ...
Sylvain Hallé - Starting at Node 1 - Considering firewall rule 2 on Node 1: [1-5] accept - Going to Node 2 through routing rule 2: Node 1 -> [2-6] -> Node 2 - The considered interval becomes restricted to [2-5] - Going to Node 3 through routing rule 1: Node 2 -> [2-6] -> Node 3 - Shadowing anomaly with firewall rule 2 on Node 3: [2-5] accept vs. [3-4] reject Analysis tool http://github.com/sylvainhalle/FirewallCheck java -jar NetworkChecker.jar -s -i "./*.txt"
Sylvain Hallé 0.1 10 1,000 Time(s) Total number of rules in network 50 100 150 250200 2-2-2 3-3-3 Empirical results
Sylvain Hallé 0.001 1 1,000 Time(s) Number of nodes in network 1 5 10 20 50 rules 100 rules Empirical results
Sylvain Hallé The end Thank you! Questions?

Recommandé

Runtime monitoring de propriétés temporelles par (streaming) XML
Runtime monitoring de propriétés temporelles par (streaming) XMLRuntime monitoring de propriétés temporelles par (streaming) XML
Runtime monitoring de propriétés temporelles par (streaming) XMLSylvain Hallé
 
Activity Recognition Through Complex Event Processing: First Findings
Activity Recognition Through Complex Event Processing: First Findings Activity Recognition Through Complex Event Processing: First Findings
Activity Recognition Through Complex Event Processing: First Findings Sylvain Hallé
 
A Case for "Piggyback" Runtime Monitoring
A Case for "Piggyback" Runtime MonitoringA Case for "Piggyback" Runtime Monitoring
A Case for "Piggyback" Runtime MonitoringSylvain Hallé
 
Solving Equations on Words with Morphisms and Antimorphisms
Solving Equations on Words with Morphisms and AntimorphismsSolving Equations on Words with Morphisms and Antimorphisms
Solving Equations on Words with Morphisms and AntimorphismsSylvain Hallé
 
Decentralized Enforcement of Artifact Lifecycles
Decentralized Enforcement of Artifact LifecyclesDecentralized Enforcement of Artifact Lifecycles
Decentralized Enforcement of Artifact LifecyclesSylvain Hallé
 
Chasing Bugs with the BeepBeep Event Stream Processor
Chasing Bugs with the BeepBeep Event Stream ProcessorChasing Bugs with the BeepBeep Event Stream Processor
Chasing Bugs with the BeepBeep Event Stream ProcessorSylvain Hallé
 
A formalization of complex event stream processing
A formalization of complex event stream processingA formalization of complex event stream processing
A formalization of complex event stream processingSylvain Hallé
 
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"Sylvain Hallé
 

Recommandé

Runtime monitoring de propriétés temporelles par (streaming) XML
Runtime monitoring de propriétés temporelles par (streaming) XMLRuntime monitoring de propriétés temporelles par (streaming) XML
Runtime monitoring de propriétés temporelles par (streaming) XMLSylvain Hallé
 
Activity Recognition Through Complex Event Processing: First Findings
Activity Recognition Through Complex Event Processing: First Findings Activity Recognition Through Complex Event Processing: First Findings
Activity Recognition Through Complex Event Processing: First Findings Sylvain Hallé
 
A Case for "Piggyback" Runtime Monitoring
A Case for "Piggyback" Runtime MonitoringA Case for "Piggyback" Runtime Monitoring
A Case for "Piggyback" Runtime MonitoringSylvain Hallé
 
Solving Equations on Words with Morphisms and Antimorphisms
Solving Equations on Words with Morphisms and AntimorphismsSolving Equations on Words with Morphisms and Antimorphisms
Solving Equations on Words with Morphisms and AntimorphismsSylvain Hallé
 
Decentralized Enforcement of Artifact Lifecycles
Decentralized Enforcement of Artifact LifecyclesDecentralized Enforcement of Artifact Lifecycles
Decentralized Enforcement of Artifact LifecyclesSylvain Hallé
 
Chasing Bugs with the BeepBeep Event Stream Processor
Chasing Bugs with the BeepBeep Event Stream ProcessorChasing Bugs with the BeepBeep Event Stream Processor
Chasing Bugs with the BeepBeep Event Stream ProcessorSylvain Hallé
 
A formalization of complex event stream processing
A formalization of complex event stream processingA formalization of complex event stream processing
A formalization of complex event stream processingSylvain Hallé
 
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"
Causality in Message-Based Interface Contracts: A Temporal Logic "Whodunit"Sylvain Hallé
 
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)Sylvain Hallé
 
A Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive ArgumentsA Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive ArgumentsSylvain Hallé
 
Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...Sylvain Hallé
 
BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)Sylvain Hallé
 
MapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL PropertiesMapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL PropertiesSylvain Hallé
 
When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)Sylvain Hallé
 
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)Sylvain Hallé
 
À la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelleÀ la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelleSylvain Hallé
 
Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)Sylvain Hallé
 
Inside Winnyp
Inside WinnypInside Winnyp
Inside WinnypFFRI, Inc.
 
第二回CTF勉強会資料
第二回CTF勉強会資料第二回CTF勉強会資料
第二回CTF勉強会資料Asuka Nakajima
 
Threat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my HoneypotsThreat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my HoneypotsAPNIC
 
Certification
CertificationCertification
Certificationsubhransu mishra
 
Lab 1 reference manual
Lab 1 reference manualLab 1 reference manual
Lab 1 reference manualtrayyoo
 
Verilog HDL
Verilog HDLVerilog HDL
Verilog HDLMantra VLSI
 
Mining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine LearningMining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine LearningLionel Briand
 
A guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol softwareA guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol softwarebinish_hyunseok
 
Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017Manich Koomsusi
 
Reducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial EvaluationReducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial EvaluationMojdeh Golagha
 
presentation
presentationpresentation
presentationErik Thorsell
 
voip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danardvoip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danardVOIP2DAY
 
reductio [ad absurdum]
reductio [ad absurdum]reductio [ad absurdum]
reductio [ad absurdum]Shakacon
 

Contenu connexe

En vedette

Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)Sylvain Hallé
 
A Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive ArgumentsA Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive ArgumentsSylvain Hallé
 
Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...Sylvain Hallé
 
BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)Sylvain Hallé
 
MapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL PropertiesMapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL PropertiesSylvain Hallé
 
When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)Sylvain Hallé
 
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)Sylvain Hallé
 
À la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelleÀ la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelleSylvain Hallé
 
Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)Sylvain Hallé
 

En vedette (9)

Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
Runtime Monitoring of Stream Logic Formulae (Talk @ FPS 2015)
 
A Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive ArgumentsA Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
A Runtime Monitoring Framework for Event Streams with Non-Primitive Arguments
 
Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...Graph Methods for Generating Test Cases with Universal and Existential Constr...
Graph Methods for Generating Test Cases with Universal and Existential Constr...
 
BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)BeepBeep 3: A declarative event stream query engine (EDOC 2015)
BeepBeep 3: A declarative event stream query engine (EDOC 2015)
 
MapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL PropertiesMapReduce for Parallel Trace Validation of LTL Properties
MapReduce for Parallel Trace Validation of LTL Properties
 
When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)When RV Meets CEP (RV 2016 Tutorial)
When RV Meets CEP (RV 2016 Tutorial)
 
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
Testing Web Applications Through User Interface Constraints (CASCON 2015 Talk)
 
À la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelleÀ la chasse aux bugs avec la Laboratoire d'informatique formelle
À la chasse aux bugs avec la Laboratoire d'informatique formelle
 
Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)Qui gardera les gardiens? (Présentation FUQAC 2012)
Qui gardera les gardiens? (Présentation FUQAC 2012)
 

Similaire à Distributed Firewall Anomaly Detection Through LTL Model Checking

第二回CTF勉強会資料
第二回CTF勉強会資料第二回CTF勉強会資料
第二回CTF勉強会資料Asuka Nakajima
 
Threat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my HoneypotsThreat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my HoneypotsAPNIC
 
Lab 1 reference manual
Lab 1 reference manualLab 1 reference manual
Lab 1 reference manualtrayyoo
 
Mining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine LearningMining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine LearningLionel Briand
 
A guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol softwareA guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol softwarebinish_hyunseok
 
Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017Manich Koomsusi
 
Reducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial EvaluationReducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial EvaluationMojdeh Golagha
 
voip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danardvoip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danardVOIP2DAY
 
reductio [ad absurdum]
reductio [ad absurdum]reductio [ad absurdum]
reductio [ad absurdum]Shakacon
 
EXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
EXTENT 2019: Exactpro Quality Assurance for Financial Market InfrastructuresEXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
EXTENT 2019: Exactpro Quality Assurance for Financial Market InfrastructuresIosif Itkin
 
running stable diffusion on android
running stable diffusion on androidrunning stable diffusion on android
running stable diffusion on androidKoan-Sin Tan
 
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...Hao Jin
 
Essentials of jitter part 1 The Time Interval Error: TIE
Essentials of jitter part 1 The Time Interval Error: TIEEssentials of jitter part 1 The Time Interval Error: TIE
Essentials of jitter part 1 The Time Interval Error: TIEteledynelecroy
 

Similaire à Distributed Firewall Anomaly Detection Through LTL Model Checking (20)

Inside Winnyp
Inside WinnypInside Winnyp
Inside Winnyp
 
第二回CTF勉強会資料
第二回CTF勉強会資料第二回CTF勉強会資料
第二回CTF勉強会資料
 
Threat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my HoneypotsThreat Con 2021: What's Hitting my Honeypots
Threat Con 2021: What's Hitting my Honeypots
 
Certification
CertificationCertification
Certification
 
Lab 1 reference manual
Lab 1 reference manualLab 1 reference manual
Lab 1 reference manual
 
Verilog HDL
Verilog HDLVerilog HDL
Verilog HDL
 
Mining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine LearningMining Assumptions for Software Components using Machine Learning
Mining Assumptions for Software Components using Machine Learning
 
A guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol softwareA guided fuzzing approach for security testing of network protocol software
A guided fuzzing approach for security testing of network protocol software
 
Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017Awesome_fuzzing_for _pentester_red-pill_2017
Awesome_fuzzing_for _pentester_red-pill_2017
 
Reducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial EvaluationReducing Failure Analysis Time: An Industrial Evaluation
Reducing Failure Analysis Time: An Industrial Evaluation
 
presentation
presentationpresentation
presentation
 
voip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danardvoip2day 2012 - Elastix en hoteles, es posible by franck danard
voip2day 2012 - Elastix en hoteles, es posible by franck danard
 
reductio [ad absurdum]
reductio [ad absurdum]reductio [ad absurdum]
reductio [ad absurdum]
 
Le langage rust
Le langage rustLe langage rust
Le langage rust
 
EXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
EXTENT 2019: Exactpro Quality Assurance for Financial Market InfrastructuresEXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
EXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
 
running stable diffusion on android
running stable diffusion on androidrunning stable diffusion on android
running stable diffusion on android
 
LoRaWAN Real Life Issues
LoRaWAN Real Life IssuesLoRaWAN Real Life Issues
LoRaWAN Real Life Issues
 
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...
(SAC2020 SVT-2) Constrained Detecting Arrays for Fault Localization in Combin...
 
AEO Training - 2023.pdf
AEO Training - 2023.pdfAEO Training - 2023.pdf
AEO Training - 2023.pdf
 
Essentials of jitter part 1 The Time Interval Error: TIE
Essentials of jitter part 1 The Time Interval Error: TIEEssentials of jitter part 1 The Time Interval Error: TIE
Essentials of jitter part 1 The Time Interval Error: TIE
 

Plus de Sylvain Hallé

Monitoring Business Process Compliance Across Multiple Executions with Stream...
Monitoring Business Process Compliance Across Multiple Executions with Stream...Monitoring Business Process Compliance Across Multiple Executions with Stream...
Monitoring Business Process Compliance Across Multiple Executions with Stream...Sylvain Hallé
 
A Stream-Based Approach to Intrusion Detection
A Stream-Based Approach to Intrusion DetectionA Stream-Based Approach to Intrusion Detection
A Stream-Based Approach to Intrusion DetectionSylvain Hallé
 
Event Stream Processing with BeepBeep 3
Event Stream Processing with BeepBeep 3Event Stream Processing with BeepBeep 3
Event Stream Processing with BeepBeep 3Sylvain Hallé
 
Smart Contracts-Enabled Simulation for Hyperconnected Logistics
Smart Contracts-Enabled Simulation for Hyperconnected LogisticsSmart Contracts-Enabled Simulation for Hyperconnected Logistics
Smart Contracts-Enabled Simulation for Hyperconnected LogisticsSylvain Hallé
 
Test Suite Generation for Boolean Conditions with Equivalence Class Partitioning
Test Suite Generation for Boolean Conditions with Equivalence Class PartitioningTest Suite Generation for Boolean Conditions with Equivalence Class Partitioning
Test Suite Generation for Boolean Conditions with Equivalence Class PartitioningSylvain Hallé
 
Synthia: a Generic and Flexible Data Structure Generator (Long Version)
Synthia: a Generic and Flexible Data Structure Generator (Long Version)Synthia: a Generic and Flexible Data Structure Generator (Long Version)
Synthia: a Generic and Flexible Data Structure Generator (Long Version)Sylvain Hallé
 
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)Sylvain Hallé
 
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)Sylvain Hallé
 
A Generic Explainability Framework for Function Circuits
A Generic Explainability Framework for Function CircuitsA Generic Explainability Framework for Function Circuits
A Generic Explainability Framework for Function CircuitsSylvain Hallé
 
Detecting Responsive Web Design Bugs with Declarative Specifications
Detecting Responsive Web Design Bugs with Declarative SpecificationsDetecting Responsive Web Design Bugs with Declarative Specifications
Detecting Responsive Web Design Bugs with Declarative SpecificationsSylvain Hallé
 
Streamlining the Inclusion of Computer Experiments in Research Papers
Streamlining the Inclusion of Computer Experiments in Research PapersStreamlining the Inclusion of Computer Experiments in Research Papers
Streamlining the Inclusion of Computer Experiments in Research PapersSylvain Hallé
 
Writing Domain-Specific Languages for BeepBeep
Writing Domain-Specific Languages for BeepBeepWriting Domain-Specific Languages for BeepBeep
Writing Domain-Specific Languages for BeepBeepSylvain Hallé
 
Real-Time Data Mining for Event Streams
Real-Time Data Mining for Event StreamsReal-Time Data Mining for Event Streams
Real-Time Data Mining for Event StreamsSylvain Hallé
 
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)Sylvain Hallé
 
Mining event streams with BeepBeep 3
Mining event streams with BeepBeep 3Mining event streams with BeepBeep 3
Mining event streams with BeepBeep 3Sylvain Hallé
 
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)Sylvain Hallé
 
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)Sylvain Hallé
 
Event Stream Processing with Multiple Threads
Event Stream Processing with Multiple ThreadsEvent Stream Processing with Multiple Threads
Event Stream Processing with Multiple ThreadsSylvain Hallé
 
A Few Things We Heard About RV Tools (Position Paper)
A Few Things We Heard About RV Tools (Position Paper)A Few Things We Heard About RV Tools (Position Paper)
A Few Things We Heard About RV Tools (Position Paper)Sylvain Hallé
 
La quantification du premier ordre en logique temporelle
La quantification du premier ordre en logique temporelleLa quantification du premier ordre en logique temporelle
La quantification du premier ordre en logique temporelleSylvain Hallé
 

Plus de Sylvain Hallé (20)

Monitoring Business Process Compliance Across Multiple Executions with Stream...
Monitoring Business Process Compliance Across Multiple Executions with Stream...Monitoring Business Process Compliance Across Multiple Executions with Stream...
Monitoring Business Process Compliance Across Multiple Executions with Stream...
 
A Stream-Based Approach to Intrusion Detection
A Stream-Based Approach to Intrusion DetectionA Stream-Based Approach to Intrusion Detection
A Stream-Based Approach to Intrusion Detection
 
Event Stream Processing with BeepBeep 3
Event Stream Processing with BeepBeep 3Event Stream Processing with BeepBeep 3
Event Stream Processing with BeepBeep 3
 
Smart Contracts-Enabled Simulation for Hyperconnected Logistics
Smart Contracts-Enabled Simulation for Hyperconnected LogisticsSmart Contracts-Enabled Simulation for Hyperconnected Logistics
Smart Contracts-Enabled Simulation for Hyperconnected Logistics
 
Test Suite Generation for Boolean Conditions with Equivalence Class Partitioning
Test Suite Generation for Boolean Conditions with Equivalence Class PartitioningTest Suite Generation for Boolean Conditions with Equivalence Class Partitioning
Test Suite Generation for Boolean Conditions with Equivalence Class Partitioning
 
Synthia: a Generic and Flexible Data Structure Generator (Long Version)
Synthia: a Generic and Flexible Data Structure Generator (Long Version)Synthia: a Generic and Flexible Data Structure Generator (Long Version)
Synthia: a Generic and Flexible Data Structure Generator (Long Version)
 
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)
Test Sequence Generation with Cayley Graphs (Talk @ A-MOST 2021)
 
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)
Efficient Offline Monitoring of LTL with Bit Vectors (Talk at SAC 2021)
 
A Generic Explainability Framework for Function Circuits
A Generic Explainability Framework for Function CircuitsA Generic Explainability Framework for Function Circuits
A Generic Explainability Framework for Function Circuits
 
Detecting Responsive Web Design Bugs with Declarative Specifications
Detecting Responsive Web Design Bugs with Declarative SpecificationsDetecting Responsive Web Design Bugs with Declarative Specifications
Detecting Responsive Web Design Bugs with Declarative Specifications
 
Streamlining the Inclusion of Computer Experiments in Research Papers
Streamlining the Inclusion of Computer Experiments in Research PapersStreamlining the Inclusion of Computer Experiments in Research Papers
Streamlining the Inclusion of Computer Experiments in Research Papers
 
Writing Domain-Specific Languages for BeepBeep
Writing Domain-Specific Languages for BeepBeepWriting Domain-Specific Languages for BeepBeep
Writing Domain-Specific Languages for BeepBeep
 
Real-Time Data Mining for Event Streams
Real-Time Data Mining for Event StreamsReal-Time Data Mining for Event Streams
Real-Time Data Mining for Event Streams
 
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)
Technologies intelligentes d'aide au développement d'applications web (WAQ 2018)
 
Mining event streams with BeepBeep 3
Mining event streams with BeepBeep 3Mining event streams with BeepBeep 3
Mining event streams with BeepBeep 3
 
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)
LabPal: Repeatable Computer Experiments Made Easy (ACM Workshop Talk)
 
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)
A "Do-It-Yourself" Specification Language with BeepBeep 3 (Talk @ Dagstuhl 2017)
 
Event Stream Processing with Multiple Threads
Event Stream Processing with Multiple ThreadsEvent Stream Processing with Multiple Threads
Event Stream Processing with Multiple Threads
 
A Few Things We Heard About RV Tools (Position Paper)
A Few Things We Heard About RV Tools (Position Paper)A Few Things We Heard About RV Tools (Position Paper)
A Few Things We Heard About RV Tools (Position Paper)
 
La quantification du premier ordre en logique temporelle
La quantification du premier ordre en logique temporelleLa quantification du premier ordre en logique temporelle
La quantification du premier ordre en logique temporelle
 

Dernier

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Google AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAGGoogle AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAGSujit Pal
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 

Dernier (20)

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptx
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Google AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAGGoogle AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAG
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 

Distributed Firewall Anomaly Detection Through LTL Model Checking

  • 1. Sylvain Hallé Sylvain Hallé, Éric Lunaud Ngoupé, Roger Villemaire, Omar Cherkaoui Fonds de recherche sur la nature et les technologies CRSNG NSERC Distributed Firewall Anomaly Detection Through LTL Model Checking Université du Québec à Chicoutimi CANADA Université du Québec à Montréal CANADA
  • 2. Sylvain HalléSylvain Hallé Firewalls Incoming traffic Filtered traffic Source IP Port Dest. IP Port Decision 192.* 16.10.* 10.1.1.2 . . . 80 * 23 . . . 10.10.* * * . . . 80 * 23 . . . Accept Reject Accept . . .
  • 3. Sylvain HalléSylvain Hallé What's wrong with this filter? FSM LTL . . . Algos Tools Rule # Interval Decision 1 2 3 4 5 Accept Deny Accept Accept Deny 50 2 3 3 9 33 92
  • 4. Sylvain HalléSylvain Hallé What's wrong with this filter? FSM LTL . . . Algos Tools Rule # Interval Decision 1 2 3 4 5 Accept Deny Accept Accept Deny 50 2 3 3 9 33 92 Rule 2's packets are already handled by Rule 1: it is shadowed Rules 2 and 3 apply a different decision to some packets: they are correlated All of Rule 5's packets are applied the same decision as Rule 2: it is redundant
  • 5. Sylvain Hallé ???? start 0 exact? 1 exact? 4 superset? 3 Ry ℜIM Rx 8 redundant 12 shadowed 11 general 13 correlated 14 none 15 proto y= proto x protoy ⊂ protox proto y ⊃ proto x superset? 6 srcy =srcx srcy ⊇ srcx dsty ⊆ dstx actiony =actionx actiony ≠ actionx dsty ⊆ dstx dsty ⊇ dstx srcy ⊂ srcx src y ⊃ src x subset? 2 subset? 5 srcy ⊆ srcx correlated? 7 srcy ⊃ srcx srcy ⊂ srcx dsty ⊆ dstx dsty ⊃ dstx dsty ⊃ dstx dsty ⊃ dstx dsty⊂dstx src y≠src x srcy≠srcx srcy ≠srcx dsty≠dstx dsty≠dstx dsty≠ dstx dsty ≠ dstx protoy ≠ protox Rx ℜIM Ry 9 actiony =actionx actiony ≠ actionx Rx ℜC Ry 10 actiony ≠ actionx actiony =actionx Previous results E. Al-Shaer & H. H. Hamed. Discovery of Policy Anomalies in Distributed Firewalls. INFOCOM 2004. For every pair of rules R , R ...x y
  • 6. Sylvain Hallé Previous results B. Khorchani, S. Hallé, R. Villemaire. Firewall anomaly detection with a model checker for visibility logic. IM 2012. B A D t B AB A A overlaps B A ⋂ B A occludes B A ⊆ B A obstructs B A ⊇ B ◇* φ ○* φ ◻* φ some rule r', following r and such that r' * r, satisfies φ all rules r', following r and such that r' * r, satisfy φ the first rule r', following r and such that r' * r, satisfies φ a ⋀ d◇⋂( ) ⋁ d ⋀ a◇⋂( ) ◇⊇ TRUE -1 a ⋀ a◇⊇( ) ⋁ d ⋀ d◇⊇( )-1 -1 Correlation Shadowing Redundancy
  • 7. Sylvain Hallé Routers Incoming traffic Outgoing traffic Source Destination Next hop 192.* 16.10.* 10.1.1.2 . . . 10.* 16.10.* 50.1.* . . . R1 R2 R3 . . .
  • 8. Sylvain Hallé 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 9. Sylvain Hallé Rule 3.4 shadows Rule 1.2: packet accepted if enters from Node 1, rejected if from Node 3 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 10. Sylvain Hallé Rules 1.1 and 3.1 are spurious: a packet to 5 entering from Node 3 is routed to Node 1 where it is dropped 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 11. Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 12. Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? Yes if Node 1 receives traffic only from Node 3... 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 13. Sylvain Hallé Is Rule 1.5 redundant with respect to Rule 3.3? Yes if Node 1 receives traffic only from Node 3... No otherwise! 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 14. Sylvain Hallé Is Rule 2.3 shadowed by Rule 3.1? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 15. Sylvain Hallé Is Rule 2.3 shadowed by Rule 3.1? No since no traffic ever flows from Node 3 to Node 2 (all traffic is dropped at Node 1) 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 16. Sylvain Hallé Is Rule 2.5 redundant wrt Rule 1.4? 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 17. Sylvain Hallé Is Rule 2.5 redundant wrt Rule 1.4? No since packets destined to 4-5 are never routed to Node 1 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥ All together now
  • 18. Sylvain Hallé Issues The presence of an anomaly between rules R and R' depends on whether there is a possible path from R to R' ...and also on the field ranges of each routing rule along that path!
  • 19. Sylvain Hallé How to detect an anomaly Keep track of an interval I of values and a decision D, called a frozen interval and a frozen decision In the beginning, set I to the full range of possible values, and D to "undefined" ? Frozen interval Frozen decision ①
  • 20. Sylvain Hallé How to detect an anomaly Pick some ingress node as a starting point② 1 [5,8] : ⊥ 2 [0,1] : ⊤ 3 [6,8]: ⊥ 4 [2,5]: ⊤ 5 [9,9]: ⊤ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ [0,3] Device 1 [4,8] # [9,9] Device 1 I Next hop [0,8] Device 1 [9,9] # I Next hop Node 1 Node 2 Node 3 1 [5,8] : ⊤ 2 [2,4] : ⊤ 3 [9,9] : ⊤ 4 [0,1]: ⊥
  • 21. Sylvain Hallé In every node visited, go through the firewall rules one by one in order 1 [5,6] : ⊤ 2 [0,4] : ⊤ 3 [7,8] : ⊥ 4 [9,9] : ⊤ 5 [3,5] : ⊤ ③ How to detect an anomaly ...
  • 22. Sylvain Hallé Once done scanning through the rules, pick one routing entry... Intersect the freeze interval with the entry chosen ...and move on to the destination node ④ [0,3] # [4,8] Device 2 [9,9] Device 3 I Next hop 0 10 4 8 ⋂ = 4 8 How to detect an anomaly
  • 23. Sylvain Hallé At some point in the walk (only once!), pick the current firewall rule Intersect the freeze interval with the rule chosen Record the rule's decision in the freeze decision ⑤ 7 8 ⋂ = 3 [7,8] : ⊥ 4 8 7 8 ? ⊥ How to detect an anomaly
  • 24. Sylvain Hallé How to detect an anomaly From this point on, compare the frozen interval/ decision with the interval/decision of every firewall rule "visited" ⑥ 5 [5,9] : ⊤ 7 8 ⊥ 5 9 ⊤ Frozen Spuriousness anomaly vs.
  • 25. Sylvain Hallé Solution #1 Repeat this process... for every start point and every path by alternatively freezing every firewall rule Σk! k=1 n non-cyclic paths between n nodes
  • 26. Sylvain Hallé Solution #2 For a given network, generate a Kripke structure whose traces are all the walks behaving as in steps ① to ⑥ Send the problem to a model checker Express anomalies as temporal logic properties on these traces (reachability problem)
  • 27. Sylvain Hallé Variables in the Kripke structure Each state of the Kripke structure is a unique assignment of values to 7 state variables ιL ιR ⊥ ιD 3 [7,8] : ⊥ ρL ρR ρDχ Bounds of frozen interval Frozen decision Unique rule number Bounds of current firewall rule interval Current rule decision
  • 28. Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD 3 [7,8] : ⊥ 4 [9,9] : ⊤ ρL ρR ρD χ Moving to the next rule in the current firewall ιL = a = b = d = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = a = b = d = 3 = 9 = 9 = ⊤
  • 29. Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD 3 [7,8] : ⊥ ρL ρR ρD χ Freezing the current firewall rule ιL = a = b = ? = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = max(a, 7) = min(b, 8) = ⊥ = 3 = 7 = 8 = ⊥
  • 30. Sylvain Hallé Transitions in the Kripke structure Each transition between two states corresponds to one of the following actions ιR ιD [4,8]: Device 2 ρL ρR ρD χ Select an applicable routing table entry and move to destination (first firewall rule) ιL = a = b = d = 3 = 7 = 8 = ⊥ ιR ιD ρL ρR ρD χ ιL = max(a, 4) = min(b, 8) = d = 1 = 5 = 6 = ⊤ 1 [5,6] : ⊤
  • 31. Sylvain Hallé LTL properties Anomalies become properties on traces expressed in Linear Temporal Logic (LTL) Ex.: shadowing ιR ιDρL ρR ρDιL =⊥≤ ∧ ≥ =⊤ ∧∧G ( )
  • 32. Sylvain Hallé Anomaly detector Firewall rules Routing table Encoder Decoder Kripke structure NuSMV Counter-example trace Anomaly explanation Node 1 Firewall rules Routing table Node n . . . Anomalies expressed as LTL formulæ Analysis tool
  • 33. Sylvain Hallé Sample input file Node name: 0 0: 0, 0 : 0, 6, 7 : 0, deny 1: 0, 0 : 0, 0, 0 : 0, accept 2: 0, 0 : 0, 12, 13 : 0, accept ... Routing table: 12, 14, 12 8, 9, 1 5, 7, 3 ...
  • 34. Sylvain Hallé - Starting at Node 1 - Considering firewall rule 2 on Node 1: [1-5] accept - Going to Node 2 through routing rule 2: Node 1 -> [2-6] -> Node 2 - The considered interval becomes restricted to [2-5] - Going to Node 3 through routing rule 1: Node 2 -> [2-6] -> Node 3 - Shadowing anomaly with firewall rule 2 on Node 3: [2-5] accept vs. [3-4] reject Analysis tool http://github.com/sylvainhalle/FirewallCheck java -jar NetworkChecker.jar -s -i "./*.txt"
  • 35. Sylvain Hallé 0.1 10 1,000 Time(s) Total number of rules in network 50 100 150 250200 2-2-2 3-3-3 Empirical results
  • 36. Sylvain Hallé 0.001 1 1,000 Time(s) Number of nodes in network 1 5 10 20 50 rules 100 rules Empirical results
  • 37. Sylvain Hallé The end Thank you! Questions?