Four questions to Erik Hjelmvik of Netresec
We recently sat down with Erik Hjelmvik of Netresec, the person behind the open source project SPID, which has recently been integrated with the Qosmos ixEngine SDK.
1. Qosmos: What is SPID?
Erik Hjelmvik: SPID stands for Statistical Protocol IDentification (SPID). I designed this algorithm to identify the application layer protocol in TCP sessions without relying on port numbers. The SPID algorithm performs protocol identification based on simple statistical measurements of various protocol attributes. These attributes can be defined by all sorts of packet and flow data, ranging from traditional statistical flow features to application level data measurements, such as byte frequencies and offsets for common byte-values.
2. So SPID is a behavioral detection library for protocols, where do you see SPID useful for cyber security?
SPID has been great at identifying protocols that are encrypted, without having to decrypt them. This is really interesting for classifying traffic that you probably won't spot easily any other way (BitTorrent, various SSL tunnels, Hamachi). The more unique the protocol, the more likely it can be spotted through SPID. For example, a firewall or an IPS which might have an explicit policy to block unauthorized outbound VPN connections can now find those connections on non-standard ports and block them, even if they are encrypted. Another approach is to look at the fingerprinted encrypted protocols as weights or white lists for what should be expected to be seen, and exceptions to that could raise a flag for someone to investigate the traffic.
3. That’s great; how are the protocols kept up to date, how can one add new protocols?
We've already included some sample classifications in the SPID library, but it’s quite easy to add new protocols. In most cases, SPID requires about 100 packets in order to come up with a fingerprint. This functionality can be handy in tools that are constantly looking at live streams of traffic. As the streams come in, it can even classify new protocols before it understands them, and next time the protocol shows up again on the network, it is identified based on the created fingerprint.
4. What's next for SPID?
SPID adds a valuable capability to the Qosmos ixEngine especially for encrypted traffic. I have another open source project called NetworkMiner which is a network forensics tool for Windows. I've created a commercial version called NetworkMiner Professional, which will now include SPID to identify encrypted protocols.
