DPI based forensic analysis of network traffic using grid infrastructure

Abstract

Security threats have evolved from simple attacks such as virus in-fections to more sophisticated ones like the Application-layer buffer overflow, DDoS, Phishing and many zero-day variants. Such threats have significantly altered the requirements for modern network security architecture. To detect and prevent these threats, a completely new kind of security system is required which is highly proactive as well as reactive. To protect a network from complex, sophisticated attacks, the security system should have the ability to learn from the behaviour of the past attacks and get prepared to thwart similar attacks or at- tacks from similar sources in the future. A quick response time for such a detection, analysis and learning system is the key to a strong and reliable security system. Intrusion Detection systems(IDS) and Intrusion Prevention Systems (IPS) monitor network and/or host activities for anomalous behaviour and react in real-time to block or prevent them. Traditional IDS/IPS use signature matching or anomaly detection techniques which work fine for known attacks but fail to detect new attacks. Another draw- back is the generation of too many false positive alerts in which the IDS mistakes legitimate traffic for an attack. An Intrusion Detection System based on Deep Packet Inspection (DPI) technology, where the appliance has the mechanism to look within the application payload of the traffic by inspecting every byte of every packet, has the ability to detect intrusions which are more difficult to detect as compared to the detection of simple attacks. The real-time monitoring of the payload at any level requires signifi- cant human and hardware resources, and does not scale to networks larger than a single workgroup. It is more practical to archive all traffic and analyze subsets as necessary. The process, also known as recon- structive traffic analysis, or network forensics, can enhance the security of the network and also be useful for the investigation of the attacks.