  Writing classification rules to identify malicious network traffic is a
time-consuming and error-prone task. Learning-based classification systems
automatically extract such rules from positive and negative traffic examples.
However, due to limitations in the representation of network traffic and the
learning strategy, these systems lack both expressiveness to cover a range of
attacks and interpretability in fully describing the attack traffic's structure
at the session layer. This paper presents Sharingan system, which uses program
synthesis techniques to generate network classification programs at the session
layer. Sharingan accepts raw network traces as inputs, and reports potential
patterns of the attack traffic in NetQRE, a domain specific language designed
for specifying session-layer quantitative properties. Using Sharingan, network
operators can better analyze the attack pattern due to the following advantages
of Sharingan's learning process: (1) it requires minimal feature engineering,
(2) it is amenable to efficient implementation of the learnt classifier, and
(3) the synthesized program is easy to decipher and edit. We develop a range of
novel optimizations that reduce the synthesis time for large and complex tasks
to a matter of minutes. Our experiments show that Sharingan is able to
correctly identify attacks from a diverse set of network attack traces and
generates explainable outputs, while achieving accuracy comparable to
state-of-the-art learning-based intrusion detection systems.
