ATD: Collaborative Research: Extremal Dependence and Change-Point Detection Methods for High-Dimensional Data Streams with Applications to Network Cybersecurity
ATD:协作研究:高维数据流的极端依赖性和变点检测方法及其在网络网络安全中的应用
基本信息
- 批准号:1830175
- 负责人:
- 金额:$ 8.8万
- 依托单位:
- 依托单位国家:美国
- 项目类别:Continuing Grant
- 财政年份:2018
- 资助国家:美国
- 起止时间:2018-08-01 至 2021-07-31
- 项目状态:已结题
- 来源:
- 关键词:
项目摘要
The project is motivated by the need to develop advanced network monitoring tools coupled with automated statistical methods for the quick detection of Internet traffic anomalies due to ongoing attacks or impending cybersecurity threats. Emphasis is placed on detecting cybersecurity threats such as highly distributed malware infections, which can launch coordinated and crippling distributed denial of service attacks on the nation's Internet infrastructure. This will be achieved through a study of the so-called darknet traffic data. Malicious actors in the network systematically probe the Internet space for vulnerable or misconfigured devices. In doing so, they automatically send data to the entire Internet address space, which includes the space of unused Internet addresses. This destined-to-nowhere traffic is indicative of malware infection attempts or stealthy vulnerability scanning. The investigators aim to develop and deploy specialized tools that allow cyber-security analysts to efficiently analyze darknet traffic data. The research involves a team of computer engineers and statisticians, who will work closely together to implement a prototype system for detecting as well as mapping and identifying world-wide malicious activity in the Internet. The project will create and communicate to the public a set of simple-to-interpret risk indices that summarize the current darknet threat activity. This effort will potentially enable the prevention and mitigation of cybersecurity network traffic threats.Understanding Internet threats, which continue to evolve due to the dynamic nature of Internet actors and the rapid expansion of the Internet of Things ecosystem, requires adequate data at fine-grained spatial and temporal scales. The project team has access to unique cyber-security data collected at Merit Network, Inc. that capture Internet-wide activity including network scanning, malware propagation, denial of service attacks, and network outages. This data consists of unsolicited Internet traffic destined to a routed but unused Internet address space, referred to as a darknet. This project will develop algorithmic and software infrastructure to collect and organize darknet data into high-dimensional, multivariate data streams, and will study statistical methods based on (i) extremal dependence, (ii) change-point detection, and/or (iii) high-dimensional sparse signal detection and recovery to inform the construction of Internet threat indices that quantify the risk of malicious scanning, degree of network vulnerability, risk of denial of service attacks, etc. Statistics of extremes in high-dimensional setting is a challenging problem since it requires the modeling/estimation of an infinite-dimensional parameter---the spectral measure. Using multivariate regular variation, this project will study novel hyper-graphical models that quantify and provide interpretable abstractions for the simultaneous occurrence of extremes in high-dimensions. Using limit theory for maxima of dependent variables, the project team will address open theoretical problems on the characterization of extremal dependence hyper-graphs and sparse signal detection in high-dimension. This analysis will lead to the development of novel threat indices that exhibit spatial dependence that will be analyzed with fast, scalable change-point detection algorithms. The new change-point methodology is designed to achieve large computational gains vis-a-vis standard approaches without compromising statistical accuracy and would be a significant contribution to the analysis of large data streams.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.
该项目的激励是由于需要开发高级网络监控工具以及自动统计方法,以快速检测由于持续攻击或即将发生的网络安全威胁而引起的互联网流量异常。重点是检测网络安全威胁,例如高度分布的恶意软件感染,这些威胁可能会引发对国家互联网基础架构的协调和残酷的分布拒绝服务攻击。 这将通过对所谓的暗网流量数据进行研究来实现。网络中的恶意参与者系统地探索了脆弱或错误配置的设备的Internet空间。在此过程中,他们会自动将数据发送到整个Internet地址空间,其中包括未使用的Internet地址的空间。这一注定的到处流量表明了恶意软件感染的尝试或隐身脆弱性扫描。 研究人员旨在开发和部署专业工具,以使网络安全分析师有效地分析DarkNet交通数据。这项研究涉及一个计算机工程师和统计学家团队,他们将紧密合作,以实施一个原型系统来检测以及在互联网中绘制和识别全球恶意活动。该项目将与公众建立并沟通一组简单截止的风险指数,以总结当前的DarkNet威胁活动。 这项工作将有可能使网络安全网络交通威胁的预防和缓解。理解互联网威胁,由于互联网参与者的动态性质以及物联网生态系统的快速扩展,这种威胁将继续发展,需要在细粒度的空间和时间尺度上充分数据。该项目团队可以访问在Merit Network,Inc。收集的独特网络安全数据,该数据捕获了网络范围的活动,包括网络扫描,恶意软件传播,拒绝服务攻击和网络中断。该数据由原定于路由但未使用的Internet地址空间(称为DarkNet)的未经请求的Internet流量组成。 This project will develop algorithmic and software infrastructure to collect and organize darknet data into high-dimensional, multivariate data streams, and will study statistical methods based on (i) extremal dependence, (ii) change-point detection, and/or (iii) high-dimensional sparse signal detection and recovery to inform the construction of Internet threat indices that quantify the risk of malicious scanning, degree of network vulnerability, risk of denial服务攻击等。高维环境中极端的统计数据是一个具有挑战性的问题,因为它需要对无限维度参数进行建模/估计 - 光谱度量。使用多元规则变化,该项目将研究新型的超图模型,这些模型可以量化并为高度极端发生的同时出现可解释的抽象。使用限制理论,对于因变量的最大值,项目团队将解决有关极端依赖性超图表和高维度中稀疏信号检测的开放理论问题。该分析将导致新的威胁指数的发展,这些威胁指标表现出空间依赖性,这些依赖性将通过快速,可扩展的更改点检测算法进行分析。新的更改点方法旨在实现相对于标准方法的大量计算收益,而不会损害统计准确性,这将是对大型数据流的分析的重要贡献。该奖项反映了NSF的法定任务,并被认为是值得通过基金会的知识分子和更广泛影响的评估来通过评估来获得支持的。
项目成果
期刊论文数量(9)
专著数量(0)
科研奖励数量(0)
会议论文数量(0)
专利数量(0)
Broader impacts of network monitoring: Its role in government, industry, technology, and beyond
- DOI:10.1080/08982112.2021.1974036
- 发表时间:2021-10
- 期刊:
- 影响因子:2
- 作者:Nathaniel T. Stevens;James D. Wilson;Anne R. Driscoll;I. Mcculloh;G. Michailidis;Cécile Paris;K. Paynabar;M. Perry;Mostafa Reisi-Gahrooei;Srijan Sengupta;Ross Sparks
- 通讯作者:Nathaniel T. Stevens;James D. Wilson;Anne R. Driscoll;I. Mcculloh;G. Michailidis;Cécile Paris;K. Paynabar;M. Perry;Mostafa Reisi-Gahrooei;Srijan Sengupta;Ross Sparks
Change Point Estimation in a Dynamic Stochastic Block Model
- DOI:
- 发表时间:2018-12
- 期刊:
- 影响因子:0
- 作者:M. Bhattacharjee;M. Banerjee;G. Michailidis
- 通讯作者:M. Bhattacharjee;M. Banerjee;G. Michailidis
The interdisciplinary nature of network monitoring: Advantages and disadvantages
网络监控的跨学科性质:优点和缺点
- DOI:10.1080/08982112.2021.1974034
- 发表时间:2021
- 期刊:
- 影响因子:2
- 作者:Stevens, Nathaniel T.;Wilson, James D.;Driscoll, Anne R.;McCulloh, Ian;Michailidis, George;Paris, Cecile;Parker, Peter;Paynabar, Kamran;Perry, Marcus B.;Reisi-Gahrooei, Mostafa
- 通讯作者:Reisi-Gahrooei, Mostafa
Detection of False Data Injection Attacks in Smart Grids Based on Forecasts
- DOI:10.1109/smartgridcomm.2018.8587473
- 发表时间:2018-10
- 期刊:
- 影响因子:0
- 作者:M. Kallitsis;Shrijita Bhattacharya;G. Michailidis
- 通讯作者:M. Kallitsis;Shrijita Bhattacharya;G. Michailidis
Foundations of network monitoring: Definitions and applications
- DOI:10.1080/08982112.2021.1974033
- 发表时间:2021-10
- 期刊:
- 影响因子:2
- 作者:Nathaniel T. Stevens;James D. Wilson;Anne R. Driscoll;I. Mcculloh;G. Michailidis;Cécile Paris;K. Paynabar;M. Perry;Mostafa Reisi-Gahrooei;Srijan Sengupta;Ross Sparks
- 通讯作者:Nathaniel T. Stevens;James D. Wilson;Anne R. Driscoll;I. Mcculloh;G. Michailidis;Cécile Paris;K. Paynabar;M. Perry;Mostafa Reisi-Gahrooei;Srijan Sengupta;Ross Sparks
共 9 条
- 1
- 2
George Michailidis其他文献
Asymptotics for <math xmlns:mml="http://www.w3.org/1998/Math/MathML" altimg="si4.gif" display="inline" overflow="scroll" class="math"><mi>p</mi></math>-value based threshold estimation under repeated measurements
- DOI:10.1016/j.jspi.2016.01.00910.1016/j.jspi.2016.01.009
- 发表时间:2016-07-012016-07-01
- 期刊:
- 影响因子:
- 作者:Atul Mallik;Bodhisattva Sen;Moulinath Banerjee;George MichailidisAtul Mallik;Bodhisattva Sen;Moulinath Banerjee;George Michailidis
- 通讯作者:George MichailidisGeorge Michailidis
Statistica Sinica Preprint No: SS-2022-0323
《统计》预印本编号:SS-2022-0323
- DOI:
- 发表时间:
- 期刊:
- 影响因子:0
- 作者:Abhishek Kaul;George Michailidis;Statistica SinicaAbhishek Kaul;George Michailidis;Statistica Sinica
- 通讯作者:Statistica SinicaStatistica Sinica
共 2 条
- 1
George Michailidis的其他基金
ATD: Spatio-Temporal Modeling for Identifying Changes in Land Use
ATD:识别土地利用变化的时空模型
- 批准号:23347352334735
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Change Point Detection for Data with Network Structure
网络结构数据变点检测
- 批准号:23486402348640
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: ATD: Geospatial Modeling and Risk Mitigation for Human Movement Dynamics under Hurricane Threats
合作研究:ATD:飓风威胁下人类运动动力学的地理空间建模和风险缓解
- 批准号:23195522319552
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: IMR: MM-1A: Scalable Statistical Methodology for Performance Monitoring, Anomaly Identification, and Mapping Network Accessibility from Active Measurements
合作研究:IMR:MM-1A:用于性能监控、异常识别和主动测量映射网络可访问性的可扩展统计方法
- 批准号:23195932319593
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Change Point Detection for Data with Network Structure
网络结构数据变点检测
- 批准号:22103582210358
- 财政年份:2022
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
ATD: Spatio-Temporal Modeling for Identifying Changes in Land Use
ATD:识别土地利用变化的时空模型
- 批准号:21245072124507
- 财政年份:2021
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
CDS&E: Statistical Methodology for Analysis and Forecasting with Large Scale Temporal Data
CDS
- 批准号:18212201821220
- 财政年份:2018
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Continuing GrantContinuing Grant
BIGDATA: Collaborative Research: IA: F: Too Interconnected to Fail? Network Analytics on Complex Economic Data Streams for Monitoring Financial Stability
BIGDATA:协作研究:IA:F:互联性太强以至于不会失败?
- 批准号:16327301632730
- 财政年份:2016
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Continuing GrantContinuing Grant
CyberSEES: Type 2: Collaborative Research: Tenable Power Distribution Networks
CyberSEES:类型 2:协作研究:可维持的配电网络
- 批准号:15400931540093
- 财政年份:2015
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: Statistical Methodology for Network based Integrative Analysis of Omics Data
合作研究:基于网络的组学数据综合分析统计方法
- 批准号:15452771545277
- 财政年份:2015
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
相似国自然基金
数智背景下的团队人力资本层级结构类型、团队协作过程与团队效能结果之间关系的研究
- 批准号:72372084
- 批准年份:2023
- 资助金额:40 万元
- 项目类别:面上项目
在线医疗团队协作模式与绩效提升策略研究
- 批准号:72371111
- 批准年份:2023
- 资助金额:41 万元
- 项目类别:面上项目
面向人机接触式协同作业的协作机器人交互控制方法研究
- 批准号:62373044
- 批准年份:2023
- 资助金额:50 万元
- 项目类别:面上项目
基于数字孪生的颅颌面人机协作智能手术机器人关键技术研究
- 批准号:82372548
- 批准年份:2023
- 资助金额:49 万元
- 项目类别:面上项目
A-型结晶抗性淀粉调控肠道细菌协作产丁酸机制研究
- 批准号:32302064
- 批准年份:2023
- 资助金额:30 万元
- 项目类别:青年科学基金项目
相似海外基金
Collaborative Research: ATD: Fast Algorithms and Novel Continuous-depth Graph Neural Networks for Threat Detection
合作研究:ATD:用于威胁检测的快速算法和新颖的连续深度图神经网络
- 批准号:22199562219956
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: ATD: a-DMIT: a novel Distributed, MultI-channel, Topology-aware online monitoring framework of massive spatiotemporal data
合作研究:ATD:a-DMIT:一种新颖的分布式、多通道、拓扑感知的海量时空数据在线监测框架
- 批准号:22204952220495
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: ATD: Rapid Structure Recovery and Outlier Detection in Multidimensional Data
合作研究:ATD:多维数据中的快速结构恢复和异常值检测
- 批准号:23193702319370
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: ATD: Geospatial Modeling and Risk Mitigation for Human Movement Dynamics under Hurricane Threats
合作研究:ATD:飓风威胁下人类运动动力学的地理空间建模和风险缓解
- 批准号:23195522319552
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant
Collaborative Research: ATD: Fast Algorithms and Novel Continuous-depth Graph Neural Networks for Threat Detection
合作研究:ATD:用于威胁检测的快速算法和新颖的连续深度图神经网络
- 批准号:22199042219904
- 财政年份:2023
- 资助金额:$ 8.8万$ 8.8万
- 项目类别:Standard GrantStandard Grant