International Conference on Security and Management (SAM ’03) Similarity Searches in Compu

Similarity Searches in Computer SecurityScott F. SmithDepartment of Electrical and Computer EngineeringBoise State UniversityBoise, Idaho, U.S.A.AbstractThe reuse of algorithms and hardware developed for searches of large molecular biologic databases is examined for detecting new variants of computer attacks before they can inflict damage. New attacks are viewed as evolutions of previous attacks, with associated mutations, insertions, and deletions from either machine code or text script sequences. Similarity searches are done between previous attacks and internet packet contents in real time. Single integrated circuits capable of comparing five-hundred-byte query sequences to nearly two million bytes of internet traffic per second are discussed.1. IntroductionBioinformatics is the study of using computers to process biological information. It is a rapidly developing field that has recently been driven by the need to make sense of the huge and exponentially growing amount of data in biologic databases, particularly genome and protein databases [3]. The requirements for biological database search and internet traffic monitoring for computer security are strikingly similar, as will be demonstrated below. It is therefore reasonable to see if bioinformatics has anything to offer the field of computer security in terms or algorithms developed and hardware designed for such searches. The answer is clearly yes.Both problems involve the timely processing of huge amounts of data. Biological databases may contain billions of characters of data that need to be searched for content similar to a given query string. Searches are often performed interactively with many slightly changed queries based on the results of the previous query. For this process to be efficient, searches should ideally take in the tens of seconds and at worst in the ones of minutes. As a result, very efficient algorithms and carefully designed matching hardware are required. The computer security problem is a continuous rather than a batch problem, but has processing rate requirements near the same order of magnitude.Both problems also require more intelligence than a simple exact pattern match. The biological query string is not expected to exactly match the database locations of interest due to mutation, insertion, and deletion of DNA bases or protein amino acids from one subject to the next. It is also almost impossible to get a noise-free database since laboratory errors cause the database to not exactly match the analyzed specimen. With computer security, it is not enough to recognize repeats of previously detected attacks. Attackers dream up new schemes all the time. The best that can be hoped for is that new attacks will have some similarity to previous attacks.When searching large amounts of data, it is also necessary to be able to analyze the false alarm rate. It does no good to process millions of bytes of data every second if the result is hundreds of potential matches. Even though only a small fraction of the original data is deemed potentially interesting, there are still way to many hits to respond to. The search algorithm should have well defined statistical properties that allow parameters to be set such that analysts are not overwhelmed. Bioinformatics has developed some of these, but they tend to be very computationally demanding. To deal with this computational burden, special hardware is being developed.2. Similarity searchingFigure 1 shows an example where an attacker has obtained new information about the identity of a user of a computer system. The attacker wishes to reuse assembly language code already written, but places new user information into the code. On a previous attack attempt (which was discovered), the attacker was using an identity which required placing the string ‘John Doe’ into memory on an x86 processor. On the new attempt, the string ‘MattSmith’ is substituted. Notice that the new string not only contains different characters, but also is a different length than the original. A simple matching algorithm, which tries to find an identical copy of the original code in internet traffic will not find the new attempt.It could be argued that a simple matching algorithm would work in this case as long as one tries to match only the code before the string or only the code after the string. The difficulty in this is that it requires the machine code to be disassembled and analyzed for locations where potential insertions, deletions, or changes might be made. The subsequences which are expected to be unchanged are then supplied to an exact matching algorithm. This requires lots of work on the part of analysts and also requires them to second guess what the attacker might do. It also requires considerable turn-around time to do the analysis. One would like to simply take the binary code from an attack and have the system monitor for additional similar binary strings.Known attack attempt:< Instruction A >MOV BYTE PTR [DI], ‘J’MOV BYTE PTR [DI], ‘o’MOV BYTE PTR [DI], ‘h’MOV BYTE PTR [DI], ‘n’MOV BYTE PTR [DI], ‘ ’MOV BYTE PTR [DI], ‘D’MOV BYTE PTR [DI], ‘o’MOV BYTE PTR [DI], ‘e’< Instruction B >New attack attempt:< Instruction A >MOV BYTE PTR [DI], ‘M’MOV BYTE PTR [DI], ‘a’MOV BYTE PTR [DI], ‘t’MOV BYTE PTR [DI], ‘t’MOV BYTE PTR [DI], ‘ ’MOV BYTE PTR [DI], ‘S’MOV BYTE PTR [DI], ‘m’MOV BYTE PTR [DI], ‘i’MOV BYTE PTR [DI], ‘tMOV BYTE PTR [DI], ‘h’< Instruction B >Figure 1 Two pieces of x86 assembly code Figure 2 shows the assembled versions of the two pieces of code from Figure 1. The strings ‘XXYYZZ’ and ‘QQ’ simply represent the unchanged code surrounding the changed portion. The underlined places are where a mutation or insertion has taken place. This looks very familiar to those in the bioinformatics field. Searching large databases of DNA or protein sequences is the exact same problem. The only real difference is that DNA searches have an alphabet of four bases and protein searches have an alphabet of twenty amino acids. Machine code searches are most easily performed using an alphabet of 256 possible bytes. Since protein searches require at least five bits to represent the protein alphabet and standard processors are designed to handle eight bit quantities more efficiently, bioinformatic searches are normally done using bytes to store either the DNA or protein characters anyway.Known attempt (query string):XXYYZZC6054A C6056F C60568C6056E C60520C6 0544C6056F C60565QQNew attempt:XXYYZZC6054D C60561C60574C60574C60520C6 0553C6056D C60569C60574C60568QQFigure 2 Machine codes corresponding to Fig. 1Figure 3 shows a typical search for a similar sequence in a biologic database. In this case, the query string happens to be the first 50 amino acids in the Serum Albumin protein, which has a total of 585 amino acids. The amino acids are coded using a single upper case letter for each of the possible twenty amino acids. For example, the capital D at the start of the sequence is the code for aspartic acid. The amino acid character string can be viewed as just a special case of a string of bytes where it just happens that only twenty out of the 256 possible bit combinations are used (actually twenty-two since there is usually an end of sequence and end of database marker). The sequence was taken from the Protein Data Bank which is described in [2].When doing protein similarity searches one does not normally treat all mutations equally. Substitution of certain amino acids for others is quite common and other substitutions are improbable. A weight matrix is supplied which generates a larger penalty for improbable substitutions than for probable substitutions. For DNA searches, this weight matrix is normally just set to a constant times the identity matrix such that all mutations are treatedequally. For machine code or script searching, some substitutions are bound to be more probable than others. For example, if one location is the ASCII code for an upper case letter (41H through 5AH), then one may want to assign a higher probability thatit mutates to another upper case letter.Query string: (first 50 characters of 585 charactersfor Serum Albumin) DAHKSEVAHRFKDLGEENFKALVLIAFAQYLQQCP FEDHVKLVNEVTEFAFigure 3 A Typical Search of A Protein SequenceAn algorithm for searching DNA and protein databases which allows for mutation (with weights), insertion, and deletion has been developed by Smith and Waterman [10]. This algorithm has well understood statistical properties that allow calculation of false alarm and miss rates. It is not used as often as heuristic search methods because it is considered to be too computationally intensive. However, it is considered to be technically superior to the heuristic methods. Hardware to implement the Smith-Waterman algorithm is discussed below. Using the described hardware, real-time monitoring of internet traffic into a facility with the Smith-Waterman algorithm is feasible. The alternative heuristic methods include BLAST [1] and FASTA [7].The Smith-Waterman algorithm implements the following set of equations:I i,j = D i,j = M i,j = 0,for all i and j such that i = 0 or j = 0I i,j = max{I i-1,j - c, M i-1,j - g}D i,j = max{D i,j-1 - c, M i,j-1 - g}M i,j = max{I i-1,j-1 + d(a i,b j), D i-1,j-1 +d(a i,b j), M i-1,j-1 + d(a i,b j), 0}I i,j is the score at the current pairing of the query string location (i) and the database string location (j)if we insert the current query character into the database string. D i,j is the score at the current pairing if we delete the current database character. M i,j is the score at the current pairing if we neither insert nor delete (a match or a mutation). The penalty for the start of a new insertion or deletion series is g. The penalty for the continuation of an insertion or deletion series is c. The reward for matching two characters is d, which depends on the current query string character (a i) and the current database character (b j). For DNA searches, d normally takes on the same positive value for all a i =b j, and takes the value zero in all other cases. In protein searches, the d matrix usually still has positive diagonal elements, but may also have positive non-zero off-diagonal elements. For computer security applications, rather than searchinga database, one would search internet packets.3. Fast Hardware ImplementationA simple method of creating multiple-instruction multiple-data (MIMD) multiprocessors on single integrated circuits that are very amenable to the Smith-Waterman algorithm has been developed [8]. It is designed to be used with off-the-shelf microprocessor, memory system, and system bus intellectual property (IP). It is readily scalable as feature sizes shrink and more/faster processors can be fit on a single integrated circuit. The key to the scalability is the use of pre-designed asynchronous interfaces between local clock domains. Each processor has it’s own local clock which avoids the large amount of design effort needed to create a global clock tree allowing for a high clock rate.The system has been analyzed assuming a binary tree topology for the system bus, but this is not a firm requirement of the design methodology. The analysis has also assumed that standard 32 bit wide Advanced Microcontroller Bus Architecture (AMBA) system buses are used for the bus segments within each clock domain, but this is also not a requirement of the methodology. Each processor and memory has it’s own local clock and the lines between them are low-latency asynchronous FIFOs designed by this author to be metastability free. For processor counts less than about one thousand, the bus traffic load is small enough that delays due to bus contention are small when running the Smith-Waterman algorithm. For larger processor counts, replication of the memory system and external access port should be considered. One processor should be dedicated to watching the match scores generated by the other processors and creating an alarm when the score exceeds a threshold. This processor will have much higher memory bandwidth requirements and should be located in the sameclock domain as the memory system and have it’s own bus connection to the memory system.With current technology, a single integrated circuit can process 1.9 million characters per second when the search is for similarity to a 500 character query string. By the year 2006, the rate is expected to be 21.4 million characters per second based on predictions of the International Technology Roadmap for Semiconductors [6]. The design using current (130 nm) technology employs 227 ARM922T CPU cores [4] on a maximum sized integrated circuit (800 mm2). Query stings up to 1112 bytes long can be accommodated efficiently. Longer strings cause data cache misses that will slow the system down considerably. Performance is nearly proportional to query string length, so a 1000 character query string results in about 0.95 million character per second search. Strings longer than 1112 bytes, but shorter than 2282 bytes, can be handled efficiently by moving up to ARM920T CPU cores. However, the number of CPUs that can be placed on the integrated circuit falls by about thirty percent, resulting in about thirty percent slower string processing (for the same length query string). The ARM920T has a 16KB data cache compared to the 8KB data cache of the ARM922T which accounts for the larger efficient query sting size. 32 bit ARM code for the Smith-Waterman algorithm is available on the web at [9].The design method for the multiprocessor integrated circuits is intended to be general, so it is not necessary to use ARM processors. Other commercially available processors such as the MIPS could be employed. A special purpose processor could also be designed to specifically run the Smith-Waterman algorithm much faster. The disadvantages would be much increased design time and inability to adapt if better algorithms are developed. The hardware using a general purpose processor such as an ARM or MIPS could also be used in other supercomputing applications such as finite element analysis. By designing the supercomputer integrated circuit so that multiple uses are possible, cost will be reduced due to increase in production volume.A special purpose single-instruction multiple-data (SIMD) processor which uses global clocking has been built for the Smith-Waterman algorithm. The Kestrel [5] processor can process 0.77 million characters per second with up to a 512 character query string. The processing rate does not depend on query string length for Kestrel (as long as the length is something less than or equal to 512). The Kestrel runs at 20 MHz, which is about what the ARM9 processors would run at if they were built in the same technology. So, the Kestrel is faster than the MIMD supercomputer proposed here in relative terms. The MIMD machine would process 0.15 million characters per second at a 20 MHz clock rate. This performance gap would be smaller for shorter query strings.Kestrel was built using 800 nm technology and eight integrated circuits, so it is not directly comparable to the proposed MIMD system. It could be built today in a single integrated circuit. However, since it is a custom integrated circuit, it requires redesign with each process ‘shrink’. In order to keep up with the exponentially increasing internet traffic, it will be necessary to repeatedly move the supercomputing hardware to the next available feature size. Design effort needs to be minimal if this is to happen in a timely fashion and at reasonable expense. It is also not clear that the Kestrel could be scaled in such a way as to retain it’s performance advantage due to it’s global clocking strategy.It should also be noted that Kestrel is not easy to change to allow for longer query strings. If one wants to double the length of the query string, Kestrel needs to be made twice as large (twice as many processing elements). For the MIMD processor, all that is required is a larger data cache, which causes much less than a doubling of total area. Finally, the ARM is a 32 bit processor and the Kestrel is an eight bit processor. Using eight bit processors instead of the ARM would allow considerably more processors per die and result in faster performance. The result, however, would not be as flexible for use in other applications.4. ConclusionThe common themes of needing to search large amounts of data and the need to do searches with inexact matches mean that efforts in computer security and bioinformatics have much in common. Inexpensive and scalable supercomputing is needed to handle the exponential increases in data rates seen in both fields. To achieve inexpensive supercomputing, it will be necessary to move to single-chip supercomputers. With integrated circuit technology soon reaching one billion transistors per chip, single-chip supercomputers will soon be a reality.To keep these supercomputers inexpensive requires that design effort not be too large. Elimination of the global clock tree greatly reduces design effort without sacrificing clock frequency. Using as many off-the-shelf components in the design also reduces design effort. The multi-processor design should be usable in other supercomputing applications such that production runs can be made larger and per chip cost lower. References[1] S. Altschul, W. Gish, W. Miller, E. Myers, andD. Lipman, “Basic Local Alignment Search Tool,” Journal of Molecular Biology, 215, pp. 403-410, 1990.[2] H. Berman, J. Westbrook, Z. Feng , G. Gilliland, T. Bhat, H. Weissig, I. Shindyalov, and P. Bourne, “The Protein Data Bank,” Nucleic Acids Research, 28, pp. 235-242, 2000. [3] S. Brown, Bioinformatics: A Biologist’s Guide to Biocomputing and the Internet, Eaton, 2000.[4] S. Furber, ARM System-on-Chip Architecture, Addison-Wesley, 2000.[5] L. Grate, M. Diekhans, D. Dahle, and R. Hughey, “Sequence Analysis with the Kestrel SIMD Parallel Processor,” Pacific Symposium on Biocomputing, pp. 263-274, 2001.[6] International Technology Roadmap for Semiconductors, , 2001.[7] W. Pearson, “Rapid and Sensitive Sequence Comparison with FASTP and FASTA,” Methods in Enzymology, 183, Academic Press, 1990.[8] S. Smith and J. Frenzel, “Low-latency Multiple Clock Domain Interfacing Without Alteration of Local Clocks,” Proceedings of the IEEE 15th Biennial University / Government / Industry Microelectronics Symposium, 2003.[9] S. Smith and J. Frenzel, ARM 32-bit Implementation of the Smith-Waterman Algorithm, /SSmith/SWCode.html. [10] T. Smith and M. Waterman, “Identification of Common Molecular Sequences,” Journal of Molecular Biology, 147, pp. 195-197, 1981.。