Hands-On Encrypted Traffic Analytics
•
1 recomendación•587 vistas
The document discusses Cisco's Encrypted Traffic Analytics (ETA) solution. ETA uses machine learning techniques to analyze metadata from encrypted network traffic and detect malware without decrypting traffic. It can identify malware signatures and anomalous behavior in encrypted web, cloud, and internal traffic. ETA extracts features from packet lengths, times, and byte distributions to build detectors that can find known malware in encrypted traffic with high accuracy. The solution provides visibility, compliance monitoring, and threat detection across an organization's entire network, including campus, branch offices, and the cloud.
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Hands-On Encrypted Traffic Analytics
Similar a Hands-On Encrypted Traffic Analytics (20)
Más de Robb Boyd
Más de Robb Boyd (20)
Último
Último (20)
Hands-On Encrypted Traffic Analytics
- 1. Hands on Encrypted Traffic Analytics January 17,2018
- 2. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Networks are becoming more and more opaque
- 3. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential New threat landscape 38% 62% Organizations are at risk Decrypt Do not decrypt New attack vectors • Employees browsing over HTTPS: Malware infection, covert channel with command and control server, data exfiltration • Employees on internal network connecting to DMZ servers: Lateral propagation of encrypted threats cannot detect malicious content in encrypted traffic of attackers used encryption to evade detection of organizations have been victims of a cyber attack 41%81% 64% Source: Ponemon Report, 2016
- 4. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Web Traffic A growing problem: malware in encrypted traffic 2019 >80% encrypted >55% encrypted May 2017
- 5. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Users HQ Data Center Admin Branch RECORD every conversation Understand what is NORMAL Be alerted to CHANGE KNOW every host Respond to THREATS quickly Effective security depends on total visibility Roaming Users Cloud
- 6. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Privacy AND Security Now Available: Cisco Encrypted Traffic Analytics Industry’s first network with the ability to find threats in encrypted traffic without decryption Avoid, stop, or mitigate threats faster then ever before | Real-time flow analysis for better visibility Encrypted traffic Non-encrypted traffic
- 7. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Malware Detection Known Malware Traffic Known Benign Traffic Extract Observable Features in the Data Employ Machine Learning techniques to build detectors Known Malware sessions detected in encrypted traffic with high accuracy “Identifying Encrypted Malware Traffic with Contextual Flow Data” AISec ’16 | Blake Anderson, David McGrew (Cisco Fellow ) Cisco Research
- 8. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Finding malicious activity in encrypted traffic Cisco Stealthwatch® Machine Learning M alware de tection and cryptographi c compliance Telemetry Exporter* Ne tFlow Enhanced Ne tFlow Te lemetry for e ncrypted malware detection and cryptographic compliance * Catalyst, ISR, ASR, CSR are supported Enhanced analytics and machine learning Global-to-local knowledge correlation Enhanced NetFlow from Cisco’s newest switches and routers Continuous Enterprise-wide compliance Leveraged network Faster investigation Higher precision Stronger protection M etadata
- 9. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Make the most of the unencrypted fields Identify the content type through the size and timing of packets Initial data packet Sequence of packet lengths and times How can we inspect encrypted traffic? Self-Signed certificate Data exfiltration C2 message Who’s who of the Internet’s dark side Global Risk Map Broad behavioral information about the servers on the Internet.
- 10. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Threat discrimination thru correlation Global Risk MapInitial Data Packet Sequence of Packet Lengths and Times Multi-layer Machine Learning
- 11. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Campu s Branch Cloud Extended Enterprise Network Visibility News: ETA expands into the cloud and branch office ISR & ASR NEW CSR 1000V NEW Catalyst 9000
- 12. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Encrypted Traffic Analytics Telemetry
- 13. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 Encrypted Traffic Analytics Overview ETA Data Features Outcomes Routers/Switches Packet Capture Devices Other Exporters Exporters of Netflow SPLT BD*IDP ETA Enhanced Analytics Cryptographic Compliance Malware Detection Analytics srcIP, dstIP, srcPort, dstPort, prot, startTime, stopTime, numBytes, numPackets, IDP, SPLT, BD Sequence of Packet Lengths and Times The SPLT field gives us visibility beyond the first packet of the encrypted flows. Byte Distribution The BD keeps a count for each byte value encountered in the payloads of the packets of the flow being analyzed Initial Data Packet The first packets of any connection contain valuable data about the content. *BD in fast follow release
- 14. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential • HTTPS header contains several information-rich fields • Server name provides domain information • Crypto information educates us on client and server behavior and application identity • Certificate information is similar to whois information for a domain • And much more can be understood when we combine the information with global data Initial Data Packet
- 15. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential SPLT shows TLS Metadata differences Client Server Sent Packets Received Packets Google search Page Download Exfiltration & Keylogging Initiate Command & Control Model Packet lengths, arrival times and durations tend to be inherently different for malware than benign traffic.
- 16. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Behavioral Patterns w.r.t. SPLT (Packet Lengths/Times) BestaferaFirefoxSelf-RepairGoogle Search Self-Signed Certificate Data Exfiltration Red = Unencrypted Handshake Messages C2 Message Initial Page Load FirefoxReal- Time Feedback Page Refresh Autocomplete
- 17. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Anomaly detection Trust modeling Event classification Entity modeling Relationship modeling Global risk map Threat correlation Internet scrapers Encrypted Traffic Analytics Threat Grid Anomalous Requests Processed NetFlow + Proxy (weblog) Threat Incidents (aggregated events) Malicious Events (telemetry sequences) Power of multi-layer machine learning Threat Analytics at Scale 50,000 incidents per day 10B requests per day Incidents Threat context Telemetry Features Layer 1 Layer 2 Layer 3
- 18. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Cryptographic Compliance 1000111010011101 110000 0100001100001 1100 0111010011101 0001110 1001 1101 1110011 011 Encryption TLS/SSL Version TLS 1.2 Encryption Key Exchange RSA Encryption Algorithm and Key Length RSA_128 1000111010011101 110000 0100001100001 1100 0111010011101 0001110 1001 1101 1110011 011 89cZ 274eb60f9547 c22c302ae 2ae85 89c22ae 858922c302ae C9996 fbb9 e2d291fcc 22ae85e 89cZ 274eb60f9547 c22c302ae 2ae85 89c22ae 858922c302ae C9996 fbb9 e2d291fcc 22ae85e Encryption TLS/SSL Version NONE Encryption Key Exchange RSA Encryption Algorithm and Key Length RSA_128
- 19. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Demonstration
- 20. © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Confidential What do you buy? Licensing, packaging… Solution element Software version License Enterprise switches (Cisco® Catalyst® 9000 Series)* Cisco IOS® XE 16.6.1+ Included in Cisco DNA™ Advantage license/ Cisco ONE™ Advanced Branch routers (ASR 1000 Series, 4000 Series ISR, CSR, ISRv, 1100 Series ISR)** Cisco IOS XE 16.6.2+ Included in SEC/k9 license Cisco ONE foundation Stealthwatch Enterprise v6.9.2+ Management Console, Flow Collector, Flow Rate License *C9300 series with 16.6.1, C9400 series available with 16.6.2 **Available for Proof of Concept (PoC) with 16.6.1, General availability in 16.6.2
- 21. C97-739122-01 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Next Steps Learn more about ETA http://www.cisco.com/go/eta
- 22. Thank you for watching!