Collaborative ITR/CSE: Modular Strategies for Internetwork Monitoring

协作 ITR/CSE：互联网监控的模块化策略

• 批准号: 0325390
• 负责人: Robert Nowak
• 金额: $ 31.98万
• 依托单位: William Marsh Rice University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-09-01 至 2004-03-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0325390&HistoricalAwards=false
• 关键词: Collaborative; ITR; CSE; Modular; Strategies

ABSTRACT0325390Robert NowakWilliam Marsh Rice UniversityThis project addresses the longstanding and difficult problem of detecting and classifying spatially distributed network anomalies from multiple monitoring sites. To characterize baseline vs. anomalous behavior of the Internet requires deployment of collaborative data collection, anomaly detection and pattern recognition for complex largescale systems. The project combines the forces of leading researchers in three complementary disciplines: (i) networking and data collection; (ii) statistical data analysis and signal processing; (iii) decentralized decision-making. The research goes well beyond the state-of-the art anomaly detection for centrally administered networks. In particular tools and practical data sharing algorithms are being developed for detecting coordinated intrusions, distributed denial of service attacks, and quality-of-service degradations in decentralized networks such as the Internet. The project also includes activities with broader impact including: creation of a public network anomaly database, K-12 educational outreach, and university-industry collaborations.The research approach is based on a modular and distributed monitoring paradigm that is organized into a three level hierarchy: local level measurement of data from servers, routers and switches; intermediate level data analysis and processing of end-to-end traffic measurements, summary statistics and alarms transmitted from the local level; and upper level decision-making and processing of information transmitted from the intermediate level. This modular structure is scalable to large networks of monitoring sites. However, this structure also imposes constraints on data analysis, which requires development of new approaches. Three approaches are being pursued: distributed spatio-temporal data analysis using wavelets over graphs; event detection and classification using distributed pattern analysis and learning; and multi-site event correlation using discrete event dynamical systems and decentralized stochastic systems.

摘要0325390罗伯特·诺瓦克威廉·马什·赖斯大学该项目解决了从多个监测站点检测和分类空间分布网络异常的长期存在的难题。 为了表征互联网的基线与异常行为，需要为复杂的大型系统部署协作数据收集、异常检测和模式识别。该项目结合了三个互补学科的领先研究人员的力量：（i）网络和数据收集； (ii) 统计数据分析和信号处理； (iii) 分散决策。该研究远远超出了集中管理网络的最先进的异常检测范围。特别是，正在开发一些工具和实用的数据共享算法，用于检测互联网等分散网络中的协调入侵、分布式拒绝服务攻击和服务质量下降。 该项目还包括具有更广泛影响的活动，包括：创建公共网络异常数据库、K-12 教育推广以及大学与行业合作。该研究方法基于模块化和分布式监控范式，该范式被组织成三级层次结构：来自服务器、路由器和交换机的数据的本地级测量；对本地层传输的端到端流量测量、汇总统计和警报进行中间层数据分析和处理；上层对中层传来的信息进行决策和处理。 这种模块化结构可扩展到大型监控站点网络。然而，这种结构也对数据分析施加了限制，需要开发新的方法。正在寻求三种方法：使用图上的小波进行分布式时空数据分析；使用分布式模式分析和学习进行事件检测和分类；以及使用离散事件动力系统和分散随机系统的多站点事件关联。