TWC: TTP Option: Small: Collaborative: SRN: On Establishing Secure and Resilient Networking Services

TWC：TTP 选项：小型：协作：SRN：关于建立安全和弹性的网络服务

• 批准号: 1523994
• 负责人: Kishor Trivedi
• 金额: $ 23.7万
• 依托单位: Duke University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2015
• 资助国家: 美国
• 起止时间: 2015-09-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1523994&HistoricalAwards=false
• 关键词: TWC; TTP; Option; Small; Collaborative

Almost every organization depends on cloud-based services. The backend of cloud-based services are designed for multiple tenants and reside in data centers spread across multiple physical locations. Network security and security management are major hurdles in such a complex, shared environment. This research investigates mitigating the security challenges by taking a moving target defense (MTD) approach. Continually adjusting the system resources such as the topology of the data center, bandwidth allocation and traffic flow policies makes it difficult for attackers to compromise the system. New evaluations methods will be developed to ensure that these MTD mechanisms work properly in practice. The outcome of this research is to have cloud services that are more secure and resilient to attacks. This research is a collaborative effort conducted by researchers from three different universities, Arizona State University, Duke University, and the University of Missouri-Kansas City. Graduate students will be trained to serve the growing need for educating professionals in cyber security. The results of the proposed research will be incorporated into several courses taught at the respective institutions. The MTD approach in a multi-location, multi-tenant data center environment requires a complex level of coordination. This research investigates defense mechanisms in the data center's virtual networking environment based on programmable networking solutions so that proactive attack countermeasures can be deployed with considerations of the system resource consumption, software bugs/vulnerabilities, effectiveness of countermeasures, and impact on consumers running applications. The research outcomes can be employed for applications that require security situation-awareness variables accurately predicted at a very fine grain resolution, from a few milliseconds to a few seconds. This introduces additional challenges, namely, developing new performance models for networking, data collection, big data-enabled security processing, and control. To address these challenges, this project has two interdependent fundamental research thrusts: (a) investigate a dynamic and adaptive defensive framework at both networking and software levels; and (b) deploy an adaptive security-enabled traffic engineering approach to select optimal countermeasures by considering the effectiveness of countermeasures and network bandwidth allocations while minimizing the intrusiveness to the applications and the cost of deploying the countermeasures. The outcomes of this project will include a set of software APIs and tools to integrate the measurement system and analytical models in a transition to practice effort.

几乎每个组织都取决于基于云的服务。基于云的服务的后端设计用于多个租户，并居住在分布在多个物理位置的数据中心中。在如此复杂，共享的环境中，网络安全和安全管理是主要障碍。这项研究调查了通过采用移动目标防御方法（MTD）方法来减轻安全挑战。不断调整系统资源，例如数据中心的拓扑，带宽分配和流量流策略，使攻击者难以妥协系统。将开发新的评估方法，以确保这些MTD机制在实践中正常工作。这项研究的结果是拥有对攻击更加安全和韧性的云服务。这项研究是由三所不同大学，亚利桑那州立大学，杜克大学和密苏里 - 堪萨斯大学的研究人员进行的合作努力。研究生将接受培训，以满足对网络安全教育专业人员的日益增长的需求。拟议研究的结果将纳入各个机构教授的几门课程中。在多站点多租户数据中心环境中，MTD方法需要复杂的协调水平。这项研究根据可编程网络解决方案研究了数据中心虚拟网络环境中的防御机制，因此可以考虑系统消耗系统消耗，软件错误/漏洞，对策的有效性以及对运行应用程序的消费者的影响，从而部署积极的攻击对策。研究结果可以用于需要在非常精细的谷物分辨率上准确预测的安全状况意识变量的应用，从几毫秒到几秒钟。这引入了其他挑战，即开发用于网络，数据收集，支持大数据的安全处理和控制的新绩效模型。为了应对这些挑战，该项目有两个相互依存的基础研究强烈推动力：（a）在网络和软件水平上研究一个动态和适应性的防御框架； （b）通过考虑对策和网络带宽分配的有效性，同时最大程度地减少对应用程序的侵入性以及部署对策的成本来最大程度地减少对策的有效性，以选择自适应的交通工程方法来选择最佳对策。该项目的结果将包括一组软件API和工具，以在过渡到实践工作中整合测量系统和分析模型。