Automatic Signature Extraction

The Automatic Signature Extraction feature is used to identify and define potential worms and viruses found in network traffic based on the following characteristics:

• Content invariance identifies that all worms have some code that remains unchanged through the infection.
• Content prevalence identifies if packet payloads were observed frequently in the network. Because worms are designed to spread, the unchanged portion of a worm’s content appears frequently on a network as it spreads or attempts to spread.
• Address dispersion identifies whether the same payload is sent to and from a large number of source and destination IP address pairs.

Note	The ASE feature can detect e-mail viruses but is disabled by default. This feature can be enabled on the ASE collector. Contact your Cisco representative for more information.

When the ASE sensor extracts a malware signature, the ASE sensor sends the signature to the collector using the TIDP Threat Mitigation Service (TMS) to contain and mitigate the malware outbreak among TMS consumers spread across the network. The TMS framework rapidly and efficiently distributes threat information to devices on the network and generates actions to TMS consumers to either drop or redirect the packets containing the malware signature.

Note	See the "Automatic Signature Extraction Sensor Operation" for more information on this feature.

The ASE feature has two main components: a sensor and collector. The ASE sensor sifts through the contents of network traffic to reduce the number of different source and destination addresses seen in packets. To minimize the impact on the device, sensing can be enabled or disabled on a per-interface basis and traffic designated as ASE traffic can be specified. The ASE sensor observes the same traffic as the router can observe after an access list is applied.

Note	The sensor is unable to extract signatures from within encrypted traffic passing through a router.

The figure below shows that devices A and C are infected with the same worm. As traffic crosses the Cisco IOS router running the ASE sensor, the router extracts the worm’s signature based on its address dispersion and content prevalence. Then the router sends this information to the ASE collector for further processing.

The ASE collector, which runs on a Linux-based PC, performs the following functions:

• Processes signatures it receives from the ASE sensor.
• Initiates the mitigation of signatures.
• Coordinates detection between multiple ASE sensors.
• Manages and distributes entry information and files on the network.
• Collects signatures and packets sent by the sensor.
• Analyzes extracted signatures to determine what the best signature is for a malicious packet to correctly identify a threat.
• Performs post processing of signatures to reduce false alarms.
• Maintains a signature database.
• Reduces false positives in signatures through classification.
• Manages sensor configuration such as thresholds, scanning criteria, and other parameters.
• Generates a report or reports on collected signatures.

Note	Contact your Cisco representative for more information about installing the ASE collector functionality on your network.

Self-propagating worms continue to grow and affect the security of hosts and networks. These malicious malware attacks often target specific victims or subnets within an enterprise organization. Specifically, a worm can affect and saturate the local network (including all hosts), the branch router, and the local WAN connection or both. The optimal location to detect, contain, and mitigate these worms is on the gateway network connection to prevent the worms from spreading to the entire network, including all connected branches.

• Using the WAN Aggregation Model to Contain Malware
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ase group TIDP-group-number

4.    ase collector ip-address

5.    ase signature extraction

6.    interface interface-type number

7.    ase enable

8.    end

9.    show ase

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ase group TIDP-group-number Example: Router(config)# ase group 10	The group number range is between 1 and 65535, which identifies the TIDP group number used for exchange between the ASE sensor and ASE collector.
Step 4	ase collector ip-address Example: Router(config)# ase collector 10.10.10.3	Enters the destination IP address of the ASE collector server so that the ASE sensor has IP connectivity to the ASE collector.
Step 5	ase signature extraction Example: Router(config)# ase signature extraction	Enables the ASE feature globally on the router.
Step 6	interface interface-type number Example: Router(config)# interface GigabitEthernet0/1	Enters the interface for the ASE feature, and enters interface configuration mode.
Step 7	ase enable Example: Router(config-if)# ase enable	Enables the ASE feature on this interface.
Step 8	end Example: Router(config-if)# end	Returns to privileged EXEC mode.
Step 9	show ase Example: Router# show ase	Displays the ASE run-time status. The four states are: Not Enabled --(Not displayed) The ASE feature is not enabled in global configuration mode. Enabled --The ASE feature is enabled in global configuration mode, but the ASE sensor has not connected with the ASE collector. Connected --The ASE sensor has connected with the ASE collector, but it has not completed initialization. Online --The ASE is ready for inspecting traffic.

• What to Do Next
  

Router# show ase
ASE Information:
Collector IP: 10.10.10.3
TIDP Group  : 10
Status      : Online
Packets inspected: 1105071
Address Dispersion Threshold: 20
Prevalence Threshold: 10
Sampling set to: 1 in 64
Address Dispersion Inactivity Timer: 3600s
Prevalence Table Refresh Time: 60s