Grant: Alliance Grants

Network Intrusion Detection System (NIDS) is a vital component of the network security of any enterprise. The main function of an NIDS is to monitor network traffic against signatures of known threats. The signatures form a ruleset. In a regular NIDS, the local network security personnel creates the ruleset and administers placement of the network sensor, analysis server, and the management console. In this project, we aim to design and build an Oblivious NIDS (O-NIDS), where the ruleset is created and encrypted by a trusted personnel, while the network sensor and analysis server operate at a remote, insecure environment hosted and administrated by an adversary who is honest-but-curious observer (HCB). The analysis server operates on the encrypted ruleset to generate encrypted alerts, which are communicated back in a secure way to the trusted personnel on a trusted management console. Such technology allows providing NIDS as a cloud services and enables cybersecurity protection at remote hostile locations without revealing the secret rulesets which can be classified or the trade secret of cybersecurity research companies. Homomorphic encryption (HE) is a cryptographic technology that allows performing computations on encrypted data without accessing the secret key. While the available HE libraries can provide a working prototype to the core problem, there is no efficient solution that can support a modern NIDS design with thousands of rules against many Gbits/s of network traffic. The project will tackle many engineering design research problems associated with building a flexible and efficient O-NIDS, including: reducing traffic to trusted personnel to a match/no match result while keeping encrypted metadata for further analysis, supporting different matching schemes (direct matching, ranges, wild-cards, and regex), supporting modularity in matching the 5 tuple (source/destination IP address, source/destination port and protocol) since the same values could be used across many rules, preprocessing of HE-values whenever possible, full utilization of the analysis server (multi-cores, multi-processors, multi-GPUs, and specialized FPGA hardware), and others.