International audienceSoftware-defined networking may serve as a support for the elaboration of security chains capable of protecting end-userdevices. These chains may be composed of different security functions, such as firewalls and intrusion detection systems.This demonstration showcases a tool suite for automating such a generation, from the learning of the behavior of applications, to the factoring and instanciation of security chains

Badonnel, Rémi

Lahmadi, Abdelkader

Merz, Stephan

Schnepf, Nicolas

INRIA a CCSD electronic archive server

HAL Id: hal-02111658https://hal.inria.fr/hal-02111658Submitted on 26 Apr 2019HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.A Tool Suite for the Automated Synthesis of SecurityFunction ChainsNicolas Schnepf, Rémi Badonnel, Abdelkader Lahmadi, Stephan MerzTo cite this version:Nicolas Schnepf, Rémi Badonnel, Abdelkader Lahmadi, Stephan Merz. A Tool Suite for the AutomatedSynthesis of Security Function Chains. IFIP/IEEE IM 2019 - IFIP/IEEE International Symposiumon Integrated Network Management, Apr 2019, Washington, United States. ￿hal-02111658￿A Tool Suite for the Automated Synthesisof Security Function ChainsNicolas Schnepf, Rémi Badonnel, Abdelkader Lahmadi, and Stephan MerzUniversité de Lorraine, CNRS, INRIA, LORIA, F-54000 Nancy, France{schnepf, badonnel, lahmadi, merz}@inria.frABSTRACTSoftware-defined networking may serve as a support for theelaboration of security chains capable of protecting end-userdevices. These chains may be composed of different securityfunctions, such as firewalls and intrusion detection systems.This demonstration showcases a tool suite for automating sucha generation, from the learning of the behavior of applications,to the factoring and instanciation of security chains.I. BACKGROUNDThe programmability that characterizes software-definednetworking (SDN) [1] simplifies the definition and enforce-ment of network policies by decoupling the control and thedata planes. In particular, end users can be protected by meansof chains of security functions, as described in [2]. Thesechains are built up by combining (in sequence or in paral-lel) elementary security functions such as intrusion detectionsystems, firewalls or data leakage prevention mechanisms.The chains can conveniently be described using high levelprogramming languages such as Pyretic [3]. This language,part of the Frenetic family of languages [4], is embeddedin Python and provides support for compiling the specifiedpolicies into low-level OpenFlow rules.However, the complexity of such security chains inducesthe risk of introducing misconfigurations and security holes inthe network. Several authors proposed the use of formal meth-ods [5], [6], and Pyretic also supports such methods through itsextension Kinetic [7] that integrates model checking supportfor the verification of the control plane. Unfortunately, ap-plying such verification mechanisms at runtime is prohibitivebecause of the excessive execution time they require. Wetherefore propose a framework for the automated synthesis ofchains based on specifications of generic network policies andthe observed behavior of applications. The chains generatedin this way are guaranteed to satisfy certain properties such asshadowing freedom and coherence with the network policies,as well as the absence of routing cycles and black holes. Wedeveloped the framework with the objective of protecting An-droid applications, although it could in principle be instantiatedfor other applicative contexts.II. THE SYNAPTIC PLATFORMOur system, called Synaptic, mainly relies on an orches-trator that integrates several functionalities for automatingthe generation of security chains, as illustrated in Fig. 2. Itfirst supports process learning for building Markov models ofthe applications to be protected [2]. These models are builtby aggregating application flows collected through a networkprobe [8]. States of our Markov models represent organizationsthat own IP addresses contacted by the application, andstate transitions are obtained by computing the probability ofmoving from one state to another. Figure 1 presents a simpleautomaton computed in this way, each state corresponding toa collection of network flows to destinations owned by theorganization labelling the state.These automata, together with generic specifications ofnetwork policies provided by the network administrator andthe set of permissions requested by the application, serve asan input for classifying flows as either safe or representingpotential attacks such as denial of service, port scanning,worms or botnets [10]. The classification is performed throughdeclarative logic programming rules and results in predicatesin first-order logic that identify potential attacks. From there,another set of rules generates a high-level representationof a chain of security functions specific to the consideredapplication that is finally compiled to a Pyretic program.Although the chains obtained in this way could in principlebe deployed in an SDN environment, there may be redundan-cies between chains generated for different applications. Thelast step of our orchestration process, illustrated in Fig. 3,therefore consists in factorizing the chains generated fordifferent applications. The combination of chains of securityfunctions before their deployment is non-trivial. Rather thansimply composing the different chains in parallel, our factor-ization algorithm [9] identifies and integrates common securityFigure 1. Automaton describing the behavior of an Android application.978-3-903176-15-7 c© 2019 IFIPFigure 2. Proposed system for generating and merging security chains.functions across applications. It relies on the fixed order inwhich security functions appear in the chains generated byour synthesis module for preserving correctness. Experimentalevaluation showed the potential for significant reductions inthe number of security functions to be deployed after factor-ization, while preserving the accuracy of the chains.Figure 3. Overall process for generating and merging security chains.III. THE DEMONSTRATIONIn this demo we will present the whole process of securitychain generation, from learning the behavior of applications tothe factorization of the corresponding chains. We will illustratethis process with several applications that can be either safeor contain malicious traffic that must be blocked. We willshow how these different security chains can be combined inpractice to build a larger security chain protecting every inputapplication provided to our orchestrator and how such a chaincan be compiled and deployed in the network.We will also demonstrate how we integrate logic program-ming in our overall orchestration process and how this logicbased inference model can be used with different detectionmethods by decoupling the specification of the chain from therepresentation of security requirements of end users. Finally,we will give some examples of such requirements, specifiedas first order predicates and how they are used to generatesecurity chains. We will present different approaches for thegeneration of chains of security functions, explain their advan-tages and limits and illustrate the effectiveness and efficiencyof our factorization algorithm for combining chains.REFERENCES[1] N. Feamster and H. Kim, “Software-Defined Networks: ImprovingNetwork Management with SDN,” in IEEE Communications Magazine,February 2013.[2] N. Schnepf, S. Merz, R. Badonnel, and A. Lahmadi, “Towards Gener-ation of SDN Policies for Protecting Android Environments based onAutomata Learning,” in Proceedings of the 16th Network Operationsand Management Symposium (IEEE/IFIP NOMS’18), 2018.[3] N. Foster, M. J. Freedman, A. Guha, R. Harrison, N. P. Kata, C. Mon-santo, J. Reich, M. Reitblatt, R. Jennifer, C. Schlesinger, A. Story, andD. Walker, “Languages for Software-Defined Networks,” in SoftwareTechnology Group, 2016.[4] N. Foster, M. J. Freedman, R. Harrison, C. Monsanto, and D. Walker,“Frenetic, a Network Programming Language,” in Proceedings of the16th ACM SIGPLAN International Conference on Functional Program-ming (ICFP’11), 2011.[5] E. Al-Shaer and S. Al-Haj, “FlowChecker, Configuration Analysis andVerification of Federated OpenFlow Infrastructures,” in Proceedings ofthe 3rd ACM Workshop on Assurable and Usable Security Configuration(CCS’10), 2010.[6] T. Ball, N. Bjørner, A. Gember, S. Itzhaky, A. Karbyshev, M. Sagiv,M. Schapira, and A. Valadarsky, “Vericon: Towards Verifying ControllerPrograms in Software-Defined Networks,” in Proc. 35th ACM SIGPLANIntl. Conf. Programming Language Design (PLDI’14), Edinburgh, UK,2014, pp. 282–293.[7] H. Kim, J. Reich, A. Gupta, M. Shahbaz, N. Feamster, and R. Clark,“Kinetic: Verifiable Dynamic Network Control,” in Proceedings of the12th USENIX Conference on Networked Systems Design and Implemen-tation (NSDI’15), 2015.[8] A. Lahmadi, F. Beck, E. Finickel, and O. Festor, “A platform forthe analysis and visualization of network flow data of android envi-ronments,” IFIP/IEEE International Symposium on Integrated NetworkManagement (IM), May 2015, poster.[9] N. Schnepf, S. Merz, R. Badonnel, and A. Lahmadi, “Automated factor-ization of security chains in software-defined networks,” in Proceedingsof the 16th IFIP/IEEE Symposium on Integrated Network and ServiceManagement (IM 2019), 2019.[10] ——, “Rule-Based Synthesis of Chains of Security Functions forSoftware-Defined Networks,” in Proceedings of the 18th InternationalWorkshop on Automated Verification of Critical Systems (AVOCS’18),2018.

A Tool Suite for the Automated Synthesis of Security Function Chains

Archive Ouverte en Sciences de l'Information et de la Communication

https://hal.inria.fr/hal-02111658/document

A Tool Suite for the Automated Synthesis of Security Function Chains

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server

Archive Ouverte en Sciences de l'Information et de la Communication