Automatic Signature Extraction (ASE) is a new feature in IOS release 12.4(15)T1 that is designed to find and stop worms and viruses on the network, day zero. To quote from one of the ASE developers Tin Yen, “the ASE feature is configured in the network to extract content specific signatures (often referred to as “patterns”) to help identify fast spreading worms and viruses by leveraging advanced deep packet inspection techniques”. ASE identifies the new worm and dynamically extracts a high fidelity signature pattern from the worm traffic. It then can start to enforce this signature with drop actions, not only just on itself but on all other IOS routers in the enterprise. Picture this… the router automatically detects attacks in the wild, auto learns how to defend the network against them and then shares its signature definition with all of the other routers. It finds the viruses and worms by analyzing network traffic for anomalies. Quoting from the IOS documentation, ASE uses the following characteristics to identify new worms/viruses:
- Content invariance identifies that all worms have some code that remains unchanged through the infection.
- Content prevalence identifies if packet payloads were observed frequently in the network. Because worms are designed to spread, the unchanged portion of a worm’s content appears frequently on a network as it spreads or attempts to spread.
- Address dispersion identifies whether the same payload is sent to and from a large number of source and destination IP address pairs.
There are essentially two parts to the solution; you have a ASE collector and multiple ASE sensors (i.e. routers). The collector runs on a linux based PC. All the sensors send their alerts and new signatures they’ve created to the collector using the new secure Threat Information Distribution Protocol (TIDP). The ASE sensor is activated on a per routed interface basis. Additionally, the type of traffic that the ASE sensor should inspect can be defined on the router. According to the IOS documentation the ASE collector performs the following:
- Processes signatures it receives from the ASE sensor.
- Initiates the mitigation of signatures.
- Coordinates detection between multiple ASE sensors.
- Manages and distributes entry information and files on the network.
- Collects signatures and packets sent by the sensor.
- Analyzes extracted signatures to determine what the best signature is for a malicious packet to correctly identify a threat.
- Performs post processing of signatures to reduce false alarms.
- Maintains a signature database.
- Reduces false positives in signatures through classification.
- Manages sensor configuration such as thresholds, scanning criteria, and other parameters.
- Generates a report or reports on collected signatures.
Turning on the ASE sensor feature in IOS is straight forward. Here are the commands to enable ASE sensing on an IOS router: Define the TIDP group number: ase group {number} Define the IP address of the ASE collector PC: ase collector {ip address} Turn on the ASE feature globally: ase signature extraction Enable it on interfaces of your choice: Interface fa0/0 ase enable That’s it! Here is an example of the show ase command: Router1# show ase ASE Information: Collector IP: 10.10.10.3 TIDP Group : 10 Status : Online Packets inspected: 1105071 Address Dispersion Threshold: 20 Prevalence Threshold: 10 Sampling set to: 1 in 64 Address Dispersion Inactivity Timer: 3600s Prevalence Table Refresh Time: 60s For more information about ASE see Cisco’s documentation at http://www.cisco.com/univercd/cc/td/doc/product/software/ios124/124newft/124t/124t15/htautosg.htm#wp1049437
and here for TIDP http://www.cisco.com/en/US/products/ps6441/products_feature_guide09186a00805e2380.html The ASE collector software is currently in limited release, so contact your Cisco account team to get a copy!
