Towards practical intrusion detection system over encrypted traffic*

Abstract

Privacy and data confidentiality are today at the heart of many discussions. But such data protection should not be done at the detriment of other security aspects. In the context of network traffic, intrusion detection system becomes totally blind when the traffic is encrypted, making clients again vulnerable to known attacks. To reconcile security and privacy, BlindBox and BlindIDS are proposed to perform Deep Packet Inspection over an encrypted traffic, based on two different cryptographic techniques. But, on one side, even if BlindBox is quite efficient to detect an anomalous encrypted traffic, it necessitates a very high setup time for clients and servers and does not protect the know‐how of Security Editors (SEs) working on detection rules. On the other side, BlindIDS does protect SE's market and does not introduce any latency during setup time, but is definitely not enough efficient for a practical use. Herein, it is shown that the design of a fully efficient and market‐compliant intrusion detection system over an encrypted traffic is possible. The system is based on only symmetric cryptography, and permits to encrypt a packet of 1500 bytes in about 6 μs and to test such packets with 3000 rules in less than 2 μs.

A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures

“…During the validation process, the client is responsible to authenticate the identity of the destination server, rejecting impostors. To circumvent this 123:21 [106] Extend the TLS protocol to support middleboxes 2015 Asghar et al [34] Trusted execution for Network Functions (NFs) in the cloud 2016 Canard et al [41] DPI on the encrypted traffic using encrypted rules 2017 Lan et al [87] Trusted execution for NFs in the cloud 2016 Yuan et al [171] DPI on the encrypted traffic using encrypted rules 2016 Fan et al [66] DPI on the encrypted traffic using encrypted rules 2017 Naylor et al [105] Secure outsourcing of middlebox NFs in untrusted infrastructures 2017 Han et al [74] Secure outsourcing of middlebox NFs in untrusted infrastructures 2017 Coughlin et al [53] Secure outsourcing of middlebox NFV in untrusted infrastructures 2017 Poddar et al [119] Secure outsourcing of middlebox NFV in untrusted infrastructures 2018 Trach et al [148] Secure outsourcing of middlebox NFs in untrusted infrastructures 2018 Goltzsche et al [71] Secure virtual private network (VPN) with middlebox NF 2018 Duan et al [61] Secure outsourcing of middlebox NFs in untrusted infrastructures 2019 Ning et al [107] DPI on the encrypted traffic using encrypted rules 2019 Guo et al [72] Privacy preserving packet header processing for middleboxes in the cloud 2020 validation process, a self-signed CA certificate is injected into the client browser's root store at the time of installation. For network middleboxes, administrators deploy the middlebox certificate to the corresponding devices (e.g., of the organization) in a similar manner.…”

“…SPABox [66] is a middlebox-based system that supports keyword-based and data analysis-based DPI functions over encrypted traffic without having to decrypt it. Canard et al [41] present BlindIDS, which is able to perform deep packet inspection directly on encrypted network packets for intrusion detection. BlindIDS does not assume knowledge over the traffic content or the patterns of detection signatures.…”

“…With searchable encryption, tools are able to search directly on encrypted data without decrypting it, and thus, without leaking information in plaintext (e.g., for privacy preserving malware detection [56]). This is achieved by encrypting the rules to be searched against the already encrypted traffic (e.g., [41]). TEEs enable the secure code execution and information processing commonly using hardware-assisted features like memory enclaves.…”

“…Intel SGX [8] is one of the most popular hardware-assisted TEEs and is frequently used to provide confidentiality and integrity guarantees to applications in environments where the OS could eventually become untrusted, like a cloud infrastructure (e.g., trusted antivirus in the cloud [57]). In [34,41,66,72,87,106,107,134,171], the authors perform network middlebox applications with core functionality the deep packet inspection using searchable encryption. In [53,61,71,74,105,119,148] the authors shield the network traffic processing using hardware enclaves that the Intel SGX technology provides.…”

“…The datasets used to evaluate the works of this section are not other than the ones used by traditional works in network traffic processing inside middleboxes. Depending on the application goal (e.g., intrusion detection or firewall), the authors utilize the relevant rules (e.g., Snort rules [22] in [41,66,107,171]) and traffic traces (e.g., DARPA [1] in [171]).…”