Subject: Re: [IMRG] Measurement TCPs

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Wed, 4 Dec 2002 02:24:48 -0600

thought will be useful to IMRG

>   Remco van de Meent spake unto us the following wisdom: 
> > One of the issues with releasing raw data is privacy of users. 
> > 
> > I'm wondering if people out there have standard tools or 
> algorithms for 
> > anonymization of packet traces? Preferably while keeping 
> the tcpdump 
> > file format? 
>    
>   I can't claim it's standard, or even that anyone but a few 
> people at 
>   Ohio University use it, but I have a simple tool at 
>   http://irg.cs.ohiou.edu/~eblanton/tcpurify/ that is intended to do 
>   just this.

<snip>

> don't forget jun/jinliang et al gatech/sprintlabs paper 
> 
> 
> http://citeseer.nj.nec.com/xu01design.html 
> code at 
> http://www.cc.gatech.edu/fac/Mostafa.Ammar/#research 
> i think mostafa's group is still doing work in this area. 

I found an interesting work-in-progress report in USENIX security '02 
session

Semantics-aware Transformation and Anonymization of Network Traces
Ruoming Pang (Joint work with Vern Paxson)
" Network intrusion detection research suffers from a dearth of publicly available 
traces of real attacks buried within much larger, real non-attacks. Such traces are 
invaluable for assessing the operational utility of new detection methods, but 
traces of actual traffic are almost never made available due to the problem of needing 
to remove sensitive data in the trace while still preserving non-sensitive packet 
contents. We observe a key problem is that such trace transformation requires knowledge 
of the semantics for each data element in the trace; for example, changing "root" when 
it's a username, but not when it's a filename.

We have developed a "trace rewriter", based on Bro, an intrusion detection system 
capable of analyzing the semantic structure of a tcpdump trace by converting various 
protocols into structured data elements. With the semantic structure of a trace exposed, we 
can then use a script written in Bro's high-level scripting language to transform each data 
element in a semantics-aware way according to desired policies. The trace rewriter then maps 
the transformed data back into a new tcpdump trace file, keeping the original packet structure 
whenever possible. Our experience with a few network protocols suggests that it provides a 
convenient framework for users to write concise yet powerful trace transformation scripts 
according to their policies. Because the user scripts deal with structured data fields 
instead of raw byte streams as input, they needn't worry about the syntax of protocols. 
The framework also enables other kinds of trace transformations in addition to anonymization. 
I will also talk about the issues that have come up and design decisions we made, particularly 
on how we map transformed data fields back to the trace, and offer preliminary thoughts on how 
to verify the transformation."

Vern,

 Does it works for all protocols ( as bro works for finger,ident,http, ftp etc)? I dont 
think  current bro release (0.8) has the trace writer feature. I like to
know the features which were considered for testing ( like IP address 
relationships etc.)

You should have atleast sent a note to the bro list ;)

  - Senthil.

_______________________________________________
IMRG mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/imrg

---

From: Vern Paxson <[email-masked]>
Date: Sun, 08 Dec 2002 23:07:57 -0800

> ...
> Does it works for all protocols ( as bro works for finger,ident,http, ftp
> etc)?

Ruoming has now implemented it for SMTP, Ident, HTTP, FTP, and Finger.

> I dont think  current bro release (0.8) has the trace writer feature.

It does, but it's not documented, as it's still under development.

> I like to know the features which were considered for testing ( like IP
> address relationships etc.)

I'm not sure what you mean by address relationships.  Ruoming has recently
implemented an address anonymization framework.

> You should have atleast sent a note to the bro list ;)

I did, it was included in the notification of the 0.7a175 release
(look for "bro -A").

		Vern