Collaborative Research: CISE-ANR: CNS Core: Small: Modeling Modern Network Traffic: From Data Representation to Automated Machine Learning

合作研究：CISE-ANR：CNS 核心：小型：现代网络流量建模：从数据表示到自动化机器学习

• 批准号: 2124393
• 负责人: Nicholas Feamster
• 金额: $ 25万
• 依托单位: University of Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-10-01 至 2024-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2124393&HistoricalAwards=false
• 关键词: Collaborative; Research; CISE; ANR; CNS

To successfully maintain and secure communications networks, operators need to monitor their behavior and investigate security, performance, and other problems as they arise. Recent advances in network protocols and applications present fundamental challenges for monitoring network traffic. Specifically, Internet traffic, from web traffic to Domain Name System (DNS) queries and responses, is becoming ubiquitously encrypted, obfuscating information that might otherwise be available for these tasks. Additionally, network traffic is increasing in volume and rate, precluding detailed logging and analyzing individual packets or streams. Finally, the Internet is becoming more centralized, and many services have also become cloud-based, making it more difficult to identify applications or services according to fixed identifiers such as IP addresses and port numbers. Answering even basic questions about Internet traffic has thus become increasingly challenging. This project seeks to develop techniques to regain visibility and insights into modern network traffic considering these trends. We address three research questions towards regaining visibility into modern network traffic. First, this project will study how to represent traffic data in ways that are amenable to modeling, and that could optimize models for both supervised and unsupervised modeling tasks. We will explore the impact of representations across four dimensions: (1) timeseries representations; (2) representations across flows; (3) representations at higher layers; and (4) operations on compressed data. Second, we will build on our work on traffic data representation to develop a set of tools to automatically explore model and traffic representations tailored for network traffic problems. Towards this goal, we will build a large-scale repository of labeled flows across several different applications and services as well as evaluate data representations that will be used to build statistical learning models about network traffic. Finally, we will use the software platforms and algorithms we build to design new techniques and tools for operators to solve the challenges that prevent them from transferring developed models from laboratory experiments to real-world deployments. We will extend automated model selection to account for systems costs and real-world limitations; address the need to be able to determine when models become inaccurate and to distinguish model inaccuracies from problems that are inherent to the network; and improve model robustness by investigating general approaches for model transfer. All software we create in this project will be publicly available and open source. Additionally, we plan to integrate the software systems into tutorials for the community, undergraduate and graduate courses, and outreach and education programs in the community, in collaboration with partners such as the University of Chicago's Office of Special Programs and Office of Civic Engagement.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

为了成功维护和保护通信网络，操作员需要监视其行为，并在出现的安全性，绩效和其他问题进行调查。网络协议和应用程序的最新进展提出了监视网络流量的基本挑战。具体来说，从网络流量到域名系统（DNS）查询和响应的互联网流量已变得无处不在，令人困惑的信息可能可用于这些任务。 此外，网络流量的数量和速率正在增加，排除了详细的日志记录和分析单个数据包或流。最后，互联网变得越来越集中，许多服务也已成为云，使根据固定标识符（例如IP地址和端口号）识别应用程序或服务变得更加困难。 因此，即使回答有关互联网流量的基本问题也变得越来越具有挑战性。考虑到这些趋势，该项目旨在开发技术，以重新获得可见性并洞悉现代网络流量。 我们解决了三个研究问题，以重新获得现代网络流量。首先，该项目将研究如何以适合建模的方式来表示流量数据，并可以优化监督和无监督的建模任务的模型。我们将探讨跨四个维度的表示的影响：（1）时间表表示； （2）跨流的表示； （3）较高层的表示； （4）对压缩数据进行操作。 其次，我们将基于流量数据表示的工作，以开发一组工具，以自动探索针对网络流量问题的模型和流量表示。为了实现这一目标，我们将在几个不同的应用程序和服务上构建一个大规模的标记流量，并评估将用于构建有关网络流量的统计学习模型的数据表示。最后，我们将使用我们构建的软件平台和算法来设计新技术和工具，以解决操作员的挑战，以防止它们从实验室实验转移到现实世界部署。我们将扩展自动化模型选择以说明系统成本和现实世界的限制；满足能够确定模型何时变得不准确的需求，并将模型不准确与网络固有的问题区分开来；并通过研究模型转移的一般方法来提高模型鲁棒性。 我们在此项目中创建的所有软件都将公开可用和开源。此外，我们计划与芝加哥大学特殊计划办公室和公民参与办公室等合作伙伴合作，将软件系统纳入社区，本科和研究生课程以及社区的外展和教育计划的教程。奖项反映了NSF的法定任务，并通过使用基金会的智力优点和更广泛的影响审查标准评估值得支持。

项目成果

LEAF: A Faster Secure Search Algorithm via Localization, Extraction, and Reconstruction

• DOI: 10.1145/3372297.3417237
• 发表时间: 2020-10
• 期刊: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
• 作者: Rui Wen;Yu Yu-Yu;Xiang Xie;Yang Zhang