session 1341: case studies – network security

Copyright © 2002 OPNET Technologies, Inc. 1

Session 1540: Case Studies – New Directions in Wireless Modeling

Session 1341: Case Studies – Network Security Research & Development

Moderator: Bryan ClineOPNET Technologies, Inc.



Network Intrusion Simulation Using OPNET

Shabana Razak, Mian Zhou, Sheau-Dong Lang*

University of Central Florida

and National Center for Forensic Science*



Simulation of Network Intrusion • Identify intrusion activities

• Evaluate effectiveness of IDS (Intrusion Detection System)

• Analyze network performance degradation due to IDS overhead

• Study issues related to simulation efficiency



Our Approach to Intrusion Simulation

• Use MIT/Lincoln Lab’s TCPDUMP files

pre-process data source to extract packet inter-arrival times, duration of source data, a list of IP addresses

• Build a network model corresponding to the extracted IP addresses, and a firewall node

• Use OPNET to simulate source data, including intrusion detection using the firewall



Example: Simulation of DOSNuke Attack

• It is a denial-of-service attack which sends Out-Of-Band data (MSG_OOB) to port 139 (NetBIOS), crashing a Windows NT system

• The attack’s signature contains a NetBIOS handshake followed by NetBIOS packets with the “urg” flag set

• The packet format of our OPNET simulation contains only the IP addresses, port numbers, and the flags



DOSNuke Simulation: Network Model

The network model contains 10 virtual PCs (PC0 is hacker, PC1 is victim), and a firewall that filters packets to/from the victim



DOSNuke Simulation: Packet Generator

Node structure of the packet generator

The attribute panel of the packet generator, with scripted packet inter-arrival times calculated from pre-processing the source data



DOSNuke Simulation: Statistics of packet rates at firewall

Packet rates at the firewall that filters the DOSNuke attack packets, clearly showing initial and 3 later peaks



Example: Simulation of ProcessTable Attack

Number of distinct port connections directed at the victim, clearly showing rapid increases during 3 time intervals



Efficiency of intrusion simulation using OPNET

OPNET Simulation Time

0

2

4

6

8

10

12

30 60 70 80 90 100 114

Time duration of source data in seconds

OP

NE

T s

imu

lati

on

tim

e in

seco

nd

s

Simulation runs on a Pentium 4 PC, 1.5 GHz CPU and 256 MB RAM

Simulation time for ProcessTable attack with the durations of data file ranging from 30 to 114 seconds, and a total of 5525 packets (approx. linear growth)



Conclusion and Further Research

• Our work demonstrated several applications of intrusion simulation using OPNET:

Detecting intrusions by displaying and identifying patterns of suspicious data packets Analyzing network performance and the intrusion detection overhead Evaluating the effectiveness of the IDS

• Further challenges include improving simulation efficiency, pre-processing source data using filtering strategies

session 1341: case studies – network security

Documents