CT-ISG: Collaborative Research: Massive-Dataset Algorithmics for Network Security

CT-ISG：协作研究：网络安全的海量数据集算法

• 批准号: 0716223
• 负责人: Joan Feigenbaum
• 金额: --
• 依托单位: Yale University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-10-01 至 2010-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0716223&HistoricalAwards=false
• 关键词: CT; ISG; Collaborative; Research; Massive

As malicious attacks on computer systems increase in severity and sophistication, developing effective methods for protecting the Internet is among the most important challenges facing computer science today.Network-based security mechanisms offer both good coverage and the possibility of early threat detection, but they often conflict with the performance requirements of network elements because of the vast amounts of traffic data that must be analyzed. This project will apply massive-dataset (MDS) algorithmics to network security, bringing together two previously unconnected research areas. The objective is to achieve a qualitative improvement in network security by developing efficient, yet theoretically rigorous, algorithmic defenses that can be deployed at scale in modern networks.The project addresses both fundamental algorithm-design problems and practical applications. MDS algorithmics provides a set of basic techniques for highly efficient (e.g., one-pass, small-space,polylog-time) analysis of large amounts of data. This project will investigate how these methods can be used for (1) online classification and property testing of packet streams, including efficient inference of streams generated by a mixture of stochastic sources, (2) detection of changes and anomalies in traffic patterns, and (3) development of computationally tractable models of traffic sources that support reasoning about a wide variety of adversarial behaviors and incorporate prior knowledge such as conventional intrusion-detection rules.The algorithmic toolkit developed in the course of the project will be applied to practical network-security problems such as recognizing denial of service activity, worm fingerprinting, and detecting botnets.

随着对计算机系统的恶意攻击的严重性和复杂性的增加，开发保护互联网的有效方法是当今计算机科学面临的最重要挑战之一。基于网络的安全机制提供了良好的覆盖范围，又提供了早期威胁检测的可能性，但是由于必须分析了大量的流量数据，因此它们通常与网络元素的性能相抵触。 该项目将应用大量数据（MDS）算法对网络安全性，将两个以前未连接的研究领域汇总在一起。 目的是通过开发有效但严格的算法防御措施来实现网络安全性的质量改进，这些防御能力可以在现代网络中大规模部署。该项目既解决基本算法设计问题又解决实际应用。 MDS算法提供了一组基本技术，可用于高效（例如，一通，小空间，小数时间）分析大量数据。 该项目将调查如何将这些方法用于（1）数据包流的在线分类和属性测试，包括通过随机来源混合而产生的流的有效推断，（（2）检测交通模式中的变化和异常情况，以及（3）构成范围的交通范围的流量源，并构成了范围的知识，并构成了范围的知识，并构成了范围的范围，并构成了范围的范围。在项目过程中开发的算法工具包将应用于实用的网络安全问题，例如识别拒绝服务活动，蠕虫指纹和检测僵尸网络。