Collaborative Research: Modular Strategies For Global Internetwork Monitoring

协作研究：全球互联网监控的模块化策略

• 批准号: 0325701
• 负责人: Eric Kolaczyk
• 金额: $ 61.8万
• 依托单位: Trustees of Boston University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-09-01 至 2009-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0325701&HistoricalAwards=false
• 关键词: Collaborative; Research; Modular; Strategies; Global

ABSTRACT0325701Eric D. KolaczykBoston UThis project addresses the longstanding and difficult problem of detecting and classifying spatially distributed network anomalies from multiple monitoring sites. To characterize baseline vs. anomalous behavior of the Internet requires deployment of collaborative data collection, anomaly detection and pattern recognition for complex largescale systems. The project combines the forces of leading researchers in three complementary disciplines: (i) networking and data collection; (ii) statistical data analysis and signal processing; (iii) decentralized decision-making. The research goes well beyond the state-of-the art anomaly detection for centrally administered networks. In particular tools and practical data sharing algorithms are being developed for detecting coordinated intrusions, distributed denial of service attacks, and quality-of-service degradations in decentralized networks such as the Internet. The project also includes activities with broader impact including: creation of a public network anomaly database, K-12 educational outreach, and university-industry collaborations.The research approach is based on a modular and distributed monitoring paradigm that is organized into a three level hierarchy: local level measurement of data from servers, routers and switches; intermediate level data analysis and processing of end-to-end traffic measurements, summary statistics and alarms transmitted from the local level; and upper level decision-making and processing of information transmitted from the intermediate level. This modular structure is scalable to large networks of monitoring sites. However, this structure also imposes constraints on data analysis, which requires development of new approaches. Three approaches are being pursued: distributed spatio-temporal data analysis using wavelets over graphs; event detection and classification using distributed pattern analysis and learning; and multi-site event correlation using discrete event dynamical systems and decentralized stochastic systems.

Abstract0325701。D.KolaczykbostonUTHIS项目解决了从多个监测站点检测和分类空间分布的网络异常的长期存在和困难的问题。 为了表征互联网的基线与异常行为，需要部署协作数据收集，复杂的LargesCale系统的异常检测和模式识别。该项目结合了三个互补学科的领先研究人员的力量：（i）网络和数据收集； （ii）统计数据分析和信号处理； （iii）分散的决策。该研究远远超出了中央管理网络的最新技术异常检测。在特定的工具和实际数据共享算法中，正在开发用于检测协调的入侵，分布式拒绝服务攻击以及在诸如Internet等分散网络中的服务质量退化。 该项目还包括具有更广泛影响的活动，包括：创建公共网络异常数据库，K-12教育外展和大学 - 工业合作。该研究方法基于一个模块化和分布式监视范式，该模块化和分布式监视范式被组织为三个级别的层次：来自服务器，路由器和开关的数据局部数据测量值；中级数据分析和端到端流量测量，摘要统计信息和警报从本地级别传递；以及从中间级别传播的信息的上层决策和处理。 这种模块化结构可扩展到大型监视站点网络。但是，这种结构还对数据分析施加了限制，这需要开发新方法。正在采用三种方法：分布式时空数据分析使用图上的小波；使用分布式模式分析和学习的事件检测和分类；使用离散事件动态系统和分散的随机系统的多站点事件相关性。