VERN PAXSON ON FIGHTING HACKERS IN REAL-TIME

November 9, 2000

transcribed & edited by Tim Staub, associate editor LIVEwire

Dallas, Texas — The SC2000/Lawrence Berkley National Laboratory HPC Speaker was Vern Paxson, who discussed “BRO – Detecting and Shutting Down Internet Attackers in Real Time”. Following are edited selections from that talk:

The intrusion detection system running operationally.

Its role in the laboratory is to detect attackers, and shut them down, either automatically or with manual intervention. It was concieved five years ago. The basic model is going to watch our sites traffic, extract traffic of interest, piece it into activity and then analize that activity for attacks. One of the goals was to learn about attacks in real time; people want to know about attacks in real time. As soon as the attack occurs, we wanted to catch it. That greatly expands our ability to stop the attacks.

We very much wanted an extensible system, and one in which the mechanism for the basic detection of activity is very separate of what to do about the activity, what constitutes an attack. Since events are quite generic what we do about the events is specific to our site, we tailor that for the specific site. Each environment is different, so the notions of what to do are different according to the site.

Another important goal was that we don’t make stupid mistakes when we make our policies. This led to the development of a specialized policy language thats very heavy on language elements for analizing network traffic and attacks. BRO is unique, in regard to various commercial offerings, it was a design assumption the monitor would be under attack. Not the actual monitor under attack but the attacker would know the monitor is there and be trying to avoid detection. Users can spit out a real time notification, they can record logs to disk and they can envoke programs.

So, some examples of what the event engine does; now, its role is to do generic analysis, it is not an engine that says, now, the following constitutes an attack, here’s what to do. The levels about; what is the activity, if it’s fairly low level, for example their connection may be an attempted connection or a connection finished, and these are just connections regardless of the protocol. Then there’s application level events, that are specific for type of use of the network, so there’s FTP requests, a retrieve or authentification. There’s specific ones, say, someone asks a port mapper to get to a port. For example, someone doing a log in session,has typed a line – here’s the line. These are particular to specific protocols. BRO allows you to allocate resources acording to what you have available. Say, you don’t want to analize FTP’s, you don’t have to use resources for that. You can concentrate on higher level attempts. BRO detects many ways of trying to fly under the monitors radar that are built into the system.

There are a number of analizers associated with the system. For all TCP connections we can get a lot of information just from the start, stop packets. This is cheap, because they only happen at the beginning and the end, it doesn’t matter how much volume there was. So from these we know about the connection; when it started, what was the presumed service, because it uses a particular well known port, what host was involved, how much data moved in either direction. From that then we can detect port and address scanning. Just by keeping track up how many different ports the host connects to or how many different addresses. The natural way to express this in BRO, which is in tables, which we through in the different ports or addresses that get connected to. This means we pick up stealth scans for free.

There are a bunch of different analizers for FTP. TELNET and RLOGIN are better; one of our main ways of detecting attacks. Keystroke and pause differences are very important because we look for strings, patterns, that reflect common commands attackers issue and the output that they see. For example: one of the common lines is the format that one of the common sniffer programs uses. Then they list the connection thats just been sniffed looks at the output commands. The sniffer will trigger this pattern. In running TELNET and RLOGIN analizers, nothing else, at UC Berkley we found out 120 break-ins in five months, a little under one a day. These are not attempted break-ins, these are successful break-ins. About sixty of those were successful root compromises. This is very powerful and, very sobering. The attack rate at a large university is really high.

The monitor can also take action, and again this is according to whatever your policy happens to be. There are different ways that it can react; one is that it can envoke a program called “reset”, which will reset a TCP connection and it will forge a series of packets that will be interpreted by one end of the connection as the other end as having told it to abruptly shut down. The more powerful thing that BRO does is envoke a program called “drop connectivity”. This talks to our border router and says any traffic from this address we don’t want; throw it away. Basically what this does is turn BRO into a reactive particle. We can decide what’s hostile, and turn them off. If we’re scanned, they touch a few of the addresses and are thrown away.

The next issue is; at some point hackers can fake us out and get us to drop connectivity to someone that we don’t really want dropped. Someone that you need to talk with. That is an on going issue, how to deal with that. Right now, we have lists of hosts and networks that we will not drop. And I expect that this will evolve when attackers start to launch denial of service using this mechanism.

BRO is running full time on the Laurence Berkley DMZ, the Joint Genome Initiative, NERSC and ICSI in addition to about ten other sites. So we can deploy these boxes with a furvor and get a lot of coverage. Access at UC Berkley is about 30,000 packets per second, and we’re running here at SC2000.

So at the Berkley Lab we see about 250 million packets per day. We do about 1.5 million connections per day. We’re dropping 40 scans a day, about half of those are Web crawlers and we can put in exceptions to let them clawl us. So there’s twenty guys a day that would like to break into us. And we’re most prowd of our felon, facing sentencing next January, Max Butler, a perported security “white hat” who did attacks we detected a couple years ago, basically the first attacker who exploited “bind overflow attacks”. He broke into a large number of machines, including some Air Force machines; which was not a good idea. He was nailed, in large part because we had very good logs as he transited across our DMZ.

============================================================

Subscribe to HPCwire's Weekly Update!

Be the most informed person in the room! Stay ahead of the tech trends with industry updates delivered to you every week!

Q&A with Nvidia’s Chief of DGX Systems on the DGX-GB200 Rack-scale System

March 27, 2024

Pictures of Nvidia's new flagship mega-server, the DGX GB200, on the GTC show floor got favorable reactions on social media for the sheer amount of computing power it brings to artificial intelligence.  Nvidia's DGX Read more…

Call for Participation in Workshop on Potential NSF CISE Quantum Initiative

March 26, 2024

Editor’s Note: Next month there will be a workshop to discuss what a quantum initiative led by NSF’s Computer, Information Science and Engineering (CISE) directorate could entail. The details are posted below in a Ca Read more…

Waseda U. Researchers Reports New Quantum Algorithm for Speeding Optimization

March 25, 2024

Optimization problems cover a wide range of applications and are often cited as good candidates for quantum computing. However, the execution time for constrained combinatorial optimization applications on quantum device Read more…

NVLink: Faster Interconnects and Switches to Help Relieve Data Bottlenecks

March 25, 2024

Nvidia’s new Blackwell architecture may have stolen the show this week at the GPU Technology Conference in San Jose, California. But an emerging bottleneck at the network layer threatens to make bigger and brawnier pro Read more…

Who is David Blackwell?

March 22, 2024

During GTC24, co-founder and president of NVIDIA Jensen Huang unveiled the Blackwell GPU. This GPU itself is heavily optimized for AI work, boasting 192GB of HBM3E memory as well as the the ability to train 1 trillion pa Read more…

Nvidia Appoints Andy Grant as EMEA Director of Supercomputing, Higher Education, and AI

March 22, 2024

Nvidia recently appointed Andy Grant as Director, Supercomputing, Higher Education, and AI for Europe, the Middle East, and Africa (EMEA). With over 25 years of high-performance computing (HPC) experience, Grant brings a Read more…

Q&A with Nvidia’s Chief of DGX Systems on the DGX-GB200 Rack-scale System

March 27, 2024

Pictures of Nvidia's new flagship mega-server, the DGX GB200, on the GTC show floor got favorable reactions on social media for the sheer amount of computing po Read more…

NVLink: Faster Interconnects and Switches to Help Relieve Data Bottlenecks

March 25, 2024

Nvidia’s new Blackwell architecture may have stolen the show this week at the GPU Technology Conference in San Jose, California. But an emerging bottleneck at Read more…

Who is David Blackwell?

March 22, 2024

During GTC24, co-founder and president of NVIDIA Jensen Huang unveiled the Blackwell GPU. This GPU itself is heavily optimized for AI work, boasting 192GB of HB Read more…

Nvidia Looks to Accelerate GenAI Adoption with NIM

March 19, 2024

Today at the GPU Technology Conference, Nvidia launched a new offering aimed at helping customers quickly deploy their generative AI applications in a secure, s Read more…

The Generative AI Future Is Now, Nvidia’s Huang Says

March 19, 2024

We are in the early days of a transformative shift in how business gets done thanks to the advent of generative AI, according to Nvidia CEO and cofounder Jensen Read more…

Nvidia’s New Blackwell GPU Can Train AI Models with Trillions of Parameters

March 18, 2024

Nvidia's latest and fastest GPU, codenamed Blackwell, is here and will underpin the company's AI plans this year. The chip offers performance improvements from Read more…

Nvidia Showcases Quantum Cloud, Expanding Quantum Portfolio at GTC24

March 18, 2024

Nvidia’s barrage of quantum news at GTC24 this week includes new products, signature collaborations, and a new Nvidia Quantum Cloud for quantum developers. Wh Read more…

Houston We Have a Solution: Addressing the HPC and Tech Talent Gap

March 15, 2024

Generations of Houstonian teachers, counselors, and parents have either worked in the aerospace industry or know people who do - the prospect of entering the fi Read more…

Alibaba Shuts Down its Quantum Computing Effort

November 30, 2023

In case you missed it, China’s e-commerce giant Alibaba has shut down its quantum computing research effort. It’s not entirely clear what drove the change. Read more…

Nvidia H100: Are 550,000 GPUs Enough for This Year?

August 17, 2023

The GPU Squeeze continues to place a premium on Nvidia H100 GPUs. In a recent Financial Times article, Nvidia reports that it expects to ship 550,000 of its lat Read more…

Shutterstock 1285747942

AMD’s Horsepower-packed MI300X GPU Beats Nvidia’s Upcoming H200

December 7, 2023

AMD and Nvidia are locked in an AI performance battle – much like the gaming GPU performance clash the companies have waged for decades. AMD has claimed it Read more…

DoD Takes a Long View of Quantum Computing

December 19, 2023

Given the large sums tied to expensive weapon systems – think $100-million-plus per F-35 fighter – it’s easy to forget the U.S. Department of Defense is a Read more…

Synopsys Eats Ansys: Does HPC Get Indigestion?

February 8, 2024

Recently, it was announced that Synopsys is buying HPC tool developer Ansys. Started in Pittsburgh, Pa., in 1970 as Swanson Analysis Systems, Inc. (SASI) by John Swanson (and eventually renamed), Ansys serves the CAE (Computer Aided Engineering)/multiphysics engineering simulation market. Read more…

Choosing the Right GPU for LLM Inference and Training

December 11, 2023

Accelerating the training and inference processes of deep learning models is crucial for unleashing their true potential and NVIDIA GPUs have emerged as a game- Read more…

Intel’s Server and PC Chip Development Will Blur After 2025

January 15, 2024

Intel's dealing with much more than chip rivals breathing down its neck; it is simultaneously integrating a bevy of new technologies such as chiplets, artificia Read more…

Baidu Exits Quantum, Closely Following Alibaba’s Earlier Move

January 5, 2024

Reuters reported this week that Baidu, China’s giant e-commerce and services provider, is exiting the quantum computing development arena. Reuters reported � Read more…

Leading Solution Providers

Contributors

Comparing NVIDIA A100 and NVIDIA L40S: Which GPU is Ideal for AI and Graphics-Intensive Workloads?

October 30, 2023

With long lead times for the NVIDIA H100 and A100 GPUs, many organizations are looking at the new NVIDIA L40S GPU, which it’s a new GPU optimized for AI and g Read more…

Shutterstock 1179408610

Google Addresses the Mysteries of Its Hypercomputer 

December 28, 2023

When Google launched its Hypercomputer earlier this month (December 2023), the first reaction was, "Say what?" It turns out that the Hypercomputer is Google's t Read more…

AMD MI3000A

How AMD May Get Across the CUDA Moat

October 5, 2023

When discussing GenAI, the term "GPU" almost always enters the conversation and the topic often moves toward performance and access. Interestingly, the word "GPU" is assumed to mean "Nvidia" products. (As an aside, the popular Nvidia hardware used in GenAI are not technically... Read more…

Shutterstock 1606064203

Meta’s Zuckerberg Puts Its AI Future in the Hands of 600,000 GPUs

January 25, 2024

In under two minutes, Meta's CEO, Mark Zuckerberg, laid out the company's AI plans, which included a plan to build an artificial intelligence system with the eq Read more…

Google Introduces ‘Hypercomputer’ to Its AI Infrastructure

December 11, 2023

Google ran out of monikers to describe its new AI system released on December 7. Supercomputer perhaps wasn't an apt description, so it settled on Hypercomputer Read more…

China Is All In on a RISC-V Future

January 8, 2024

The state of RISC-V in China was discussed in a recent report released by the Jamestown Foundation, a Washington, D.C.-based think tank. The report, entitled "E Read more…

Intel Won’t Have a Xeon Max Chip with New Emerald Rapids CPU

December 14, 2023

As expected, Intel officially announced its 5th generation Xeon server chips codenamed Emerald Rapids at an event in New York City, where the focus was really o Read more…

IBM Quantum Summit: Two New QPUs, Upgraded Qiskit, 10-year Roadmap and More

December 4, 2023

IBM kicks off its annual Quantum Summit today and will announce a broad range of advances including its much-anticipated 1121-qubit Condor QPU, a smaller 133-qu Read more…

  • arrow
  • Click Here for More Headlines
  • arrow
HPCwire