The document discusses HP's threat analytics and visualization solutions for analyzing big DNS security data. It describes the large volume and scale of DNS data, challenges in analyzing it with traditional tools, and HP's solution to capture, store, filter, analyze and visualize DNS events in real-time and historically. The solution includes pilots with HP to detect bad devices, domain names and threats through techniques like anomaly detection and connection graphing.

1. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.
Threat Analytics and
Visualization Solutions
for Big Data Security
Marco Casassa Mont, Yolanta Beres, Shane Sullivan & HPL BD4S
team
Security and Cloud Lab, HP Labs

2. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.2
Outline
1.Motivation and Opportunity for HP
2.Use Case with DNS
3.The scale of the Problem
4.Our Solution
5.Demonstration
6.Conclusions

3. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.3
Motivation
Identify Security Threats from Big Security
Data
Use Case: DNS Data
• Big Volume of Security Events …
• Gold mine for Security Information
• Hard to collect and analyze

4. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.4
DNS is an important vector of attack

5. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.5
What is DNS?
Local
DNS Server
Root
DNS Server
.com
DNS Server
company.com
DNS Server
Check for Zone
Check Cache
DNS Traffic Generated by:
- Users (e.g. browsing web)
- Applications, Servers, etc.
Endpoints
8. REPLY: 58.25.88.90 5. REPLY: ask “company.com”
4. QUERY: service.company.com?1. QUERY: service.company.com?

6. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.6
1
10
100
1000
10000
100000
1000000
Routers VPN McAfee ePO Active Directory Web Proxy DNS
Eventspersecond(logarithmicscale)
The Scale of DNS Data
0
20000
40000
60000
80000
100000
120000
140000
Routers VPN McAfee ePO Active Directory Web Proxy DNS
Eventspersecond(linearscale)
HP IT Pilot: 120,000 DNS events/second

7. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.7
What is the Problem?
Scale
• DNS is one of
the most
voluminous
sources of
events in the
enterprise
Information
Granularity
• Traditional
DNS servers
do not log
enough detail
to detect
many kinds
of attacks
Analysis
• Limited
analysis tools
on top of
event
collection for
DNS

8. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.9
End to end handling of DNS events
Our Solution
Collection Storage Analysis Visualization
Filtering out
90-95%
DNS traffic
- Real-Time
- Near-Time/
Historical
- Dashboards
- Graphs
- Timelines …

9. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.10
DNS Event Processing: Architecture
DNS Server(s)
DNS
Packet
Capture
Whitelist
Network tapDNS queries
and responses
ArcSight
Logger
ArcSight
ESM
Blacklist
HPL Analytical and
Visualization
Solution
Event
Logging
Correlation &
Alerting
Blacklist
&
Whitelist
Manager
Real-Time Processing
Near-time/
Historical Analysis
DNS events:
Queries & Replies

10. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.11
DNS
Packet
Capturer
Security Event Logs
Scheduler & Workflows
Vertica
Anomaly
Detectio
n
Threat
Indicators
Threat Analytics &
Visualization
Library
HPL Security Analytical &
Visualization
Network Systems
Visual
Processin
g
ArcSight
ESM
Filtered
DNS events
Event
Downloader
&
Processor
ArcSight
Logger
Events
ESM Alerts
Whitelist,
RepSM Blacklist
Generator
Real-time Analysis Near-time/Historical Analysis
Hadoop,
Autonomy, R
Web Server
Threat
Intelligenc
e
Anomalies,
Threat Findings
Anomalies, Threats, Graphs
Syslog
Server
Alerts Introspection

11. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.12
Analytic Approaches
Detection of Bad Devices and Domain Names:
– Large #Queries to Black-listed Domain Names
– Anomalous Traffic Patterns
– Usage of Machine-generated Domain Names
– Timeseries Analysis
Success Cases:
CryptoLockers, Zeus-Variant, C&C, etc.

12. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.13
Analytic Approaches
• Mechanisms
• ArcSight ESM rules
• Vertica SQL Queries
• Algorithms & Code
• Pipeline/Distribution of Queries and Code
• Pilots with HP Labs IT and HP Cybersecurity
Defence Center (CDC)

13. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.14
Data Visualization Approaches
Connected graphs
Time series
Raw data exploration

14. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.
Demo …

15. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.16

16. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.17
Current Status and Next Steps
• 2 Pilots: HP Labs IT, HP IT
• Lot of HP customers’ interest: 1 pilot to be
finalized
• Collaborations:
HP ESP, TippingPoint/DVLabs, HP ESS, HP IT,
HPL IT

17. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.
Thank you

18. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.19
HP HAVEn – Big Data platform
HAVEn
Social media IT/OT ImagesAudioVideo
Transactional
dataMobile Search engineEmail Texts
Catalog massive
volumes of
distributed data
Hadoop/
HDFS
Process and
index all
information
Autonomy
IDOL
Analyze at
extreme scale
in real-time
Vertica
Collect & unify
machine data
Enterprise
Security
Powering
HP Software
+ your apps
nApps
Documents
hp.com/haven

19. © Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. HP Confidential.20
Competitive Landscape
Main HP Competitors in the
Security Market already making
claims about the following features:
• Network Packet Capture
capabilities, inclusive of DNS
traffic
• Back-end advanced Analytics on
large amounts of (security)
events, complementing real-time
event/alert processing