Multi-layered application classification and decoding
An intrusion detection system is described that is capable of applying a plurality of stacked (layered) application-layer decoders to extract encapsulated application-layer data from a tunneled packet flow produced by multiple applications operating at the application layer, or layer seven (L7), of a network stack. In this way, the IDS is capable of performing application identification and decoding even when one or more software applications utilize other software applications as for data transport to produce packet flow from a network device. The protocol decoders may be dynamically swapped, reused and stacked (layered) when applied to a given packet or packet flow.
1. A network firewall comprising:
a processor configured to process one or more packets of a packet flow to determine, responsive to receiving and processing the packet flow, an identity of an outer application-layer communication protocol associated with the packet flow and an identity of an inner application-layer communication protocol that is using the first application-layer communication protocol to transport communications,
wherein each of the packets of the packet flow include an outer header according to the outer application-layer communication protocol and a first payload containing first application layer data, wherein the first application layer data of each of the packets encapsulates an inner packet having an inner header according to the inner application-layer communication protocol and a second payload containing second application layer data, and
wherein the processor is configured, responsive to the identity of the outer application-layer communication protocol and the inner application-layer communication protocol, to process the inner packets and execute an action in response to the processing of the inner packets.
2. The network firewall of claim 1 , wherein the processor is configured to drop the packets of the packet flow in response to identification of a security risk.
3. The network firewall of claim 1 , wherein the processor is configured to apply one or more attack definitions to the inner packets to detect a network attack.
4. The network firewall of claim 3 , wherein the processor is configured to select the one or more attack definitions in accordance with identification of the inner application-layer communication protocol.
5. The network firewall of claim 3 , wherein the processor is configured to select the one or more attack definitions in accordance with the combination of the identity of the inner application-layer communication protocol and the outer application-layer communication protocol.
6. The network firewall of claim 1 , wherein the processor is configured to analyze the inner packets to identify any protocol anomalies.
7. The network firewall of claim 1 , wherein each of the protocol decoders includes a common, universal interface to receive input data that allows the protocol decoders to be layered for application as a stack of decoders, wherein the universal interface is configured to receive input data without regard to a transport protocol for the data within the packet flow.
8. The network firewall of claim 1 , wherein each of the protocol decoders receives generic transport layer data as input so that any output from one of the protocol decoders can be seamlessly used as input to another one of the protocol decoders.
9. The network firewall of claim 1 , wherein the inner application-layer communication protocol that is using the outer application-layer communication protocol to transport communications comprises a layer seven (L7) messaging communication protocol that is using the HyperText Transfer Protocol (HTTP) to transport communications.
10. The network firewall of claim 1 ,
wherein the processor is configured to dynamically select a set of at least two application-layer decoders from a plurality of application-layer protocol decoders responsive to determination of the identity of the outer application-layer communication protocol and the identity inner application-layer communication protocol, and
wherein the processor is configured, responsive to selection of the at least two application layer decoders, to processes the packets within the packet flow and execute the action.
11. A method comprising:
processing a packet flow with a network device to dynamically determine, responsive to the packet flow, an identity of an outer application-layer communication protocol associated with the packet flow and an identity of inner application-layer communication protocol that is using the outer application-layer communication protocol to transport communications, wherein each of the packets of the packet flow include an outer header according to the outer application-layer communication protocol and a first payload containing first application layer data, wherein the first application layer data of each of the packets encapsulates an inner packet having an inner header according to the inner application-layer communication protocol and a second payload containing second application layer data; and
responsive to the identity of the outer application-layer communication protocol and the inner application-layer communication protocol, process the inner packets and execute an action in response to the processing of the inner packets.
12. The method of claim 11 , further comprising dropping packets of the packet flow responsive to determining that the inner packets fail comply with one or more firewall rules.
13. The method of claim 11 , further comprising applying one or more attack definitions to the inner packets to detect a network attack.
14. The method of claim 11 , wherein the inner application-layer communication protocol that is using the outer application-layer communication protocol to transport communications comprises a layer seven (L7) messaging communication protocol that is using the HyperText Transfer Protocol (HTTP) to transport communications.
15. The method of claim 11 , further comprising:
dynamically selecting one or more decoders from a plurality of decoders based on the identity of the outer application-layer communication protocol and the identity of inner application-layer communication protocol; and
applying the decoders to the packets to extract the inner packets and determine whether the inner packets fail to comply with one or more firewall rules.
16. The method of claim 15 , wherein applying the decoders comprises:
dynamically constructing, based on the identification, a stack comprising an ordered arrangement of two or more application-layer decoders, each of the application-layer decoders configured to extract application-layer data from packet data conforming to a respective communication protocol; and
applying, with the network device, the stack of the application-layer decoders to the packet flow in accordance with the ordered arrangement to extract first application-layer data for the first application-layer communication protocol and to extract second application-layer data that is encapsulated within the first application-layer data in accordance with the second application-layer communication protocol.
17. The method of claim 16 , wherein dynamically constructing the stack comprises constructing the stack to include a first decoder that is associated with the outer application-layer communication protocol and the outer decoder associated with the inner application-layer communication protocol.
18. The method of claim 16 , further comprising dynamically reconstructing the stack of protocol decoders in response to detecting a transition with the packet flow to a different application-layer communication protocol.
19. The method of claim 11 , further comprising:
presenting an interface to receive configuration data defining a hierarchical ordering of application-layer communications protocols that utilize other application-layer communications protocols for transport; and
selecting the application-layer decoders in accordance with the hierarchical ordering specified in configuration data.