清华大学Tsinghua UniversityAntiWorm NPU-based Parallel Bloom filtersin Giga-Ethernet LANDr. Zhen ChenNetworkProcessorResearchTeamTsinghua UniversityBeijing Feb 2006
AntiWorm NPU-based Parallel Bloom filters in Giga-Ethernet LAN Dr. Zhen Chen Network Processor Research Team Tsinghua University Beijing ☼ Feb 2006
Introduction of AntiWormProjectGigabit Ethernet LANScenarios :Purpose:Detection of Worm's PropagationTechnique:Parallel Bloom Filters
Page 2 Introduction of AntiWorm Project Scenarios : Gigabit Ethernet LAN Purpose: Detection of Worm’s Propagation Technique: Parallel Bloom Filters
AntiWorm SystemPositionedin Gigabit LANGigabitOptical Link100MbpsWiredLinkAntiWormSystemGigabit EthernetSwitchServer100/1000Mbps100/1000Mbps量HubsHubsServerServerIPCPCPCPCPCPCPCPCA Gigabit Ethernet Network ScenarioB
Page 3 AntiWorm System Positioned in Gigabit LAN Gigabit Optical Link 100Mbps Wired Link AntiWorm System PC PC PC PC 100/1000Mbps Hubs Server PC PC Server PC PC 100/1000Mbps Hubs Gigabit Ethernet Switch Server A Gigabit Ethernet Network Scenario
Characteristic in the ProjectExploiting the flexibility and high performance of NetworkProcessors to filter Worm traffic from Network Traffic NPU-Based implementation can live update the worm'ssignature flexibly to keep pace with fast evolution of wormsKey Techniques Includes Signature-based Worm identifying techniquePacket Content Scanning EngineParallelBloomFilterstechniqueimplementation
Page 4 Characteristic in the Project Exploiting the flexibility and high performance of Network Processors to filter Worm traffic from Network Traffic NPU-Based implementation can live update the worm’s signature flexibly to keep pace with fast evolution of worms Key Techniques Includes: Signature-based Worm identifying technique Packet Content Scanning Engine Parallel Bloom Filters technique implementation
Worms Worm are malicious codes, which can be selfreproduced and propagate over a network, with orwithout human assistance. RTM (Robert T. Morris) worm in 1988 CodeRed worm in 2001 Blaster worm in 2003 Sasser worm in 2004SQL slammer worm京Witty worm
Page 5 Worms Worm are malicious codes, which can be selfreproduced and propagate over a network, with or without human assistance. RTM (Robert T. Morris) worm in 1988 CodeRed worm in 2001 Blaster worm in 2003 Sasser worm in 2004 SQL slammer worm Witty worm