bh user interface guide
TRANSCRIPT
BOTHUNTER SRI International www.bothunter.net
UUSSEERR IINNTTEERRFFAACCEE GGUUIIDDEE
VVEERRSSIIOONN 11..55
Document Revision Number: 13-1-0001
®
S R I I N T E R N A T I O N A L C O M P U T E R S C I E N C E L A B O R A T O R Y
BotHunter ®
User Interface Guide
BotHunter Development Team www.bothunter.net
Phillip Porras (Lead), Martin Fong, Keith Skinner, Steven Dawson, Rukman Senanayake, Leigh Moulder
Special Acknowledgments
The BotHunter team gratefully acknowledges those increasingly fewer U.S. funding agencies that are actively supporting new research in information security. We especially thank Cliff Wang at ARO for his
support of the Cyber-TA project and BotHunter.
2010 SRI International
333 Ravenswood Avenue Menlo Park CA 94025
Phone 650.859.3232 Fax 650.859.2844
Table of Contents
TABLE OF CONTENTS ............................................................................................................................................................ I
WELCOME ................................................................................................................................................................................. 1
HOW TO USE THIS GUIDE ........................................................................................................................................................... 1 AUDIENCE ................................................................................................................................................................................. 1 WHAT IS BOTHUNTER? ............................................................................................................................................................. 1 GETTING RELATED INFORMATION ............................................................................................................................................. 2
GETTING TECHNICAL SUPPORT ........................................................................................................................................ 3
CONTACT INFORMATION ........................................................................................................................................................... 3
STARTING BH-GUI .................................................................................................................................................................. 4
STARTING THE GUI ................................................................................................................................................................... 4 GUI SHUTDOWN ........................................................................................................................................................................ 5
RUNTIME MONITORING ....................................................................................................................................................... 6
THE STATUS PANEL ............................................................................................................................................................... 7
REVIEWING PRIOR RUNS ..................................................................................................................................................... 9
THE MENU BAR ..................................................................................................................................................................... 10
SETTING PREFERENCES ..................................................................................................................................................... 12
B O T H U N T E R U S E R G U I D E
1
Welcome
How to use this guide
The BotHunter Graphical User Interface (BH-GUI) is a Java-based user interface for displaying BotHunter infection profiles and managing BotHunter's runtime operation. BH-GUI allows you to start, shut down, and monitor the runtime operation of BotHunter, view BotHunter infec-tion profiles, update the BotHunter ruleset, and receive malware- defense-related announce-ments from SRI. BH-GUI is part of the standard BotHunter installation. This application requires Sun's Java Runtime Environment (JRE) Release 1.5 or later. For the Windows XP release, Sun's JRE is in-stalled (if necessary) as part of the standard BotHunter installation.
Audience
The document is for BotHunter end users who wish to use this interface to review BotHunter analy-sis results.
What is BotHunter?
Welcome to the BotHunter User Interface Guide. This living document describes how to operate BotHunter’s User Interface (BH-GUI) on Linux, FreeBSD, MacOS, Windows, and our Live-CD Release (ISO CD image). Please send us feedback as you find mistakes and material that is unclear or incom-plete, and we will endeavor to improve this online document so all may benefit.
When you register to download BotHunter, you must indicate which version of BotHunter you wish to use: Windows, Unix, or Live CD. We will then send you an email with a link to the appropriate release.
BotHunter is a new network defensive system designed to help everyone from network administra-tors to individual Internet-connected PC users detect whether their systems are running coordina-
Chapter
1
B O T H U N T E R U S E R I N T E R F A C E G U I D E
2
tion-centric malware (such as botnets, spambots, spyware, Trojan exfiltrators, worms, adware). It is based on an algorithm called network dialog correlation, developed under the Cyber-TA research program, in the Computer Science Laboratory at SRI International. BotHunter is NOT an intrusion detection system, firewall, spam blocker, or antivirus tool. These tools generally don't work in help-ing you rid your network of malware infections. BotHunter takes a different approach.
BotHunter monitors the two-way communication flows between hosts within your internal network and the Internet. It aggressively classifies data exchanges that cross your network boundary as po-tential dialog steps in the life cycle of an ongoing malware infection. BotHunter employs Snort as a dialog event generator, and Snort is heavily modified and customized to conduct this dialog classifi-cation process. Dialog events are then fed directly into a separate dialog correlation engine, where BotHunter maps each host's dialog production patterns against an abstract malware infection life cycle model. When enough evidence is acquired to declare a host infected, BotHunter produces an infection profile to summarize all evidence it has gathered regarding the infection.
Getting related information
For additional information on using BotHunter
The BotHunter User Guide, SRI International, 2010.
http://www.bothunter.net/
BotHunter Online Frequently Asked Questions, SRI International, 2010.
http://www.emerald-ids.com/NetIDS/FAQ/index.html
BotHunter Release Notes and Addenda, SRI International, 2010.
http://www.bothunter.net/releasenotes.html
B O T H U N T E R U S E R I N T E R F A C E G U I D E
3
Getting Technical Support
Contact Information
Technical support for BotHunter and BH-GUI is available via email and online resources. In addition to this User Interface Guide, we provide additional online resources to address questions and technical inquiries.
Frequently Asked Questions: We provide a summary of commonly asked questions and answers: http://www.bothunter.net/faq.html
User Community Forum: We provide an online user forum for users to post questions and
receive technical support: http://forum.bothunter.net
Mailing List and Submitting Technical Questions: You may submit email questions to the SRI Development group and you may sign up for our email list via our BotHunter website: http://www.bothunter.net/feedback.html
Business Inquiries: For business development questions (NOT technical support), you may contact: Phillip Porras, Project Leader, 650-859-3232.
Chapter
2
B O T H U N T E R U S E R I N T E R F A C E G U I D E
4
Starting BH-GUI
BH-GUI and the BotHunter analysis system are independent processes. Starting and exit-ing BH-GUI will not automatically start or shut down BotHunter. Furthermore, BH-GUI can be shut down and restarted as needed and will automatically determine the operational status of the currently running BotHunter.
Starting the GUI
BH-GUI is started automatically when running the Windows XP and Ubunto self-booting CD versions of BotHunter. BotHunter's Unix release starts in console mode by default, and can initiate BH-GUI via command line argument:
Figure 1: Initial Display Prior to Starting BotHunter
Chapter
3
B O T H U N T E R U S E R I N T E R F A C E G U I D E
5
cta-bh% BotHunter gui
When BH-GUI is started while there is no running BotHunter process, you will see a display window similar to that shown in Figure 1. The Status panel (left), shows the full set of fields that are used to track BotHunter operational status when it is started. The gray Profiles panel to the right will display summary entries for each infection profile that BotHunter may pro-duce during its operation. The white panel below the Profile panel will display the currently selected infection profile. Below the top menu bar to the left is the Run button, which starts BotHunter.
GUI Shutdown
BH-GUI is shut down using the Quit option under the File Menu. Note that BH-GUI is an inde-pendent application, and shutting down the BH-GUI does not shut down BotHunter. When you can restart BH-GUI, it will automatically detect whether a BotHunter process is currently operating and if so will display its current state. If you wish to shut down BotHunter, you can use the Shutdown button on the main display (above the Status panel).
B O T H U N T E R U S E R I N T E R F A C E G U I D E
6
Runtime Monitoring
Once BotHunter is started, the Shutdown and Update Status buttons are enabled, and a sub-set of currently available status attributes will be shown in the status panel (see Section Status Panel for more details on each status field).
Figure 2 illustrates an example runtime display of BotHunter. The BotHunter Profiles panel is blank during normal operations and will be populated when only BotHunter finds and reports an infected machine inside your network. To view the infection profile in the panel below, select the entry by clicking on it. Double clicking on the entry will spawn a popup window containing the profile, which is useful for comparing multiple profiles side by side.
Figure 2: An Example BotHunter Runtime Display
Chapter
4
B O T H U N T E R U S E R I N T E R F A C E G U I D E
7
The Status Panel
The BH-GUI Status panel is used to monitor the status of the BotHunter systems. The full set of status fields is shown in Figure 3 (left panel). Prior to starting BotHunter, all fields are blank. Once BotHunter is started, the subset of status fields with values to report are shown (right panel). Status panel updates may be performed manually, by clicking on the Update Status button above the status panel. You may also set the automatic status panel update interval by adjusting the time units to the right of the Update Status button.
Figure 3: Status Panel Fields: (left) before starting BotHunter, (right) after starting BotHunter
Chapter
5
B O T H U N T E R U S E R I N T E R F A C E G U I D E
8
The following is a brief description of the status panel fields:
Last status Time of the last status update
Started BotHunter process start time
Elapsed Time elapsed since BotHunter process started
Memory usage Current BotHunter process memory usage
Command retries Snort retry count due to failures
Command restarts Snort restart count due to updates
Last restart Time of last Snort retry due to failure. The last restart count is distinct from the last entry count. Restarts are due to updates and are not caused by er-rors.
Lines read Number of lines of Snort input read
Lines parsed Number of lines of Snort input parsed into events
Local bot profiles Number of BotHunter text profiles written
NetQuery requests Number of NetQuery requests made
NetQuery responses Number of NetQuery requests received
Bot message Number of Bot Profile messages sent to repository
Messages queued Number of profiles and NetQuery messages queued for repository
Messages sent Number of profile and NetQuery messae sent to repository
Messages lost Number of profile and NetQuery messages lost
Repository status Status of sensor connection to repository
Connection failure Last respository connection failure
Author ID Most recently seen author ID
Observer ID Most recently seen observer ID
B O T H U N T E R U S E R I N T E R F A C E G U I D E
9
Reviewing Prior Runs
In addition to providing live monitoring of BotHunter, BH-GUI allows you to view infection profile logs produced from prior runs of BotHunter. You can load a prior infection profile log through the File menu under the Prior Runs option. Prior runs may be opened in parallel with monitoring the currently running BotHunter. When a prior run is selected, a new infec-tion profile display panel is created. The status panel is not displayed while prior runs are ana-lyzed, as this panel is applicable only for displaying attributes of an active BotHunter process. Figure 4 illustrates an example prior run view.
Figure 4: Reviewing a Prior Run
Each profile display panel is associated with a tab directly above the panel, and you may move across display panels by selecting the associated tab. When you have completed viewing a prior infection profile log, use the Close Tab button on the bottom right corner of the panel to close the panel.
Chapter
6
B O T H U N T E R U S E R I N T E R F A C E G U I D E
10
The Menu Bar
Four options are available from the top Menu bar of BH-GUI: File, BotHunter, Window, and Help. The File menu allows you to alter the application preferences, select prior runs or al-ternate BotHunter configurations (applicable to the Unix release), and exit BH-GUI.
The BotHunter menu is used to control interactions with the BotHunter system. You may start and shut down BotHunter, or initiate a status update directly from this menu, or through the corresponding Run, Shutdown, or Update buttons, available on the main display. The show snort stderr option allows you to view the last set of standard error messages produced from Snort (for diagnostic purposes). The remote update option, when enabled, indicates that rule and configuration updates are available for BotHunter to download and use.
The Window menu is used to control the display of the main BH-GUI and its popup display windows.
Chapter
7
B O T H U N T E R U S E R I N T E R F A C E G U I D E
11
The Help menu provides access to BH-GUI version information, and access to all BotHunter- related online documentation via your default browser. You can also connect to the Malware Threat Center for other project-related information.
B O T H U N T E R U S E R I N T E R F A C E G U I D E
12
Setting Preferences
The Preferences option under File Menu allows you to configure various BH-GUI application options. Four option panels are available for configuring BH-GUI: Profile, Toolbar, Visual Dis-play, and Misc. The Profile tab allows you to configure the field display for the infection profile panel. The prof_columns property allows you to select which columns will be displayed. The prof_sorting property allows you to select the default sorting fields when displaying infection profiles. The sorting will consider the order in which the fields are listed (e.g., the second sorting field will be used only when the values of the first sorting field are equal). The user may add or remove a new "temporary" primary sorting key by successively clicking on the field heading name at the top of the profile table. The prof_timefmt allows you to select the time display format. Note: when you modify a field, click to another field to set the change before selecting the OK button.
The Toolbar tab allows you to set properties of the toolbar buttons on the main display pan-el. The tb_status_update property allows you to display or suppress the manual update but-ton, and the tb_status_update_ival property allows you to display or suppress the update in-terval timer. The tb_snort_stderr property allows you to display the Snort stderr button (Ctrl-E), which is disabled by default. The tb_remote_update property allows you to display or sup-press the remote update button, which when enabled indicates that a new rule update pack-
Chapter
8
B O T H U N T E R U S E R I N T E R F A C E G U I D E
13
age is available for BotHunter to download. Note that BotHunter is by default configured to automatically download the latest ruleset updates, and therefore this button may be disabled, even when new updates are made available.
The Visual tab allows you to select foreground and background display colors, and display properties such as line wrap, time format, and message display count.