CICI: TCR: IRIS: Instrumentation for Research and Inter-institutional SOC

CICI：TCR：IRIS：研究仪器和机构间 SOC

• 批准号: 2319793
• 负责人: Kevin Hayes
• 金额: $ 119.96万
• 依托单位: Merit Network, Inc.
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-09-01 至 2026-08-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2319793&HistoricalAwards=false
• 关键词: CICI; TCR; IRIS; Instrumentation; Research

This project addresses the problems of designing, engineering and maintaining an effective and scalable networking and cybersecurity infrastructure that would enable unique research opportunities that span the areas of Internet freedom, networking monitoring, threat intelligence and security and privacy, while at the same empowering the protection of member institutions within Merit Network (Michigan’s research and education network) from cyber threats. There are significant barriers to effective cybersecurity, including constrained cybersecurity budgets, inadequate staffing, and the need for continuous infrastructure maintenance. Small, low-resourced institutions within Merit’s membership are especially challenged by these barriers, finding it difficult to remain competitive and relevant in today’s Internet in which cyber-attacks are growing both in frequency and sophistication. Under these considerations, the project creates a Merit-managed, shared infrastructure that allows these entities to focus on their missions and be confident that they have a baseline level of cybersecurity defense. This project develops situational awareness infrastructure to efficiently monitor Internet traffic entering and leaving Merit’s network border, and to detect and help mitigate cyber-threats destined to Merit’s member institutions (i.e., universities, K12 schools, etc.). The so-called IRIS (Instrumentation of Research and Inter-institutional Security Operations Center (SOC)) infrastructure has the capability of monitoring ultra high speeds of network traffic in a streaming manner in a centralized, configurable, and sustainable manner. This high-speed network monitoring infrastructure is deployed on the Merit backbone network at key peering locations and provides a constant feed of rich network research data as well as distilled cyber-security threats (e.g., malware downloads, denial of service attacks, etc.). The SOC platform gleans such threats via state-of-the-art cybersecurity solutions (including open source ones) and passes them to a data pipeline for further analysis, enrichment and research. These analysis products provide to security analysts and researchers up-to-date insights with regards to the current malware ecosystem, actionable threat intelligence regarding compromised computer systems and malicious Internet sites, and exploitable vulnerabilities which require remediation.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目解决了设计、工程和维护有效且可扩展的网络和网络安全基础设施的问题，该基础设施将为跨越互联网自由、网络监控、威胁情报以及安全和隐私领域的独特研究机会提供机会，同时增强保护能力。 Merit Network（密歇根州的研究和教育网络）内的成员机构面临网络威胁，有效的网络安全面临着重大障碍，包括网络安全预算有限、人员配备不足以及需要持续维护 Merit 成员内的小型、资源匮乏的机构。是特别是受到这些障碍的挑战，发现很难在当今的互联网中保持竞争力和相关性，网络攻击的频率和复杂性都在增长。在这些考虑下，该项目创建了一个由绩效管理的共享基础设施，使这些实体能够集中精力。该项目开发态势感知基础设施，以有效监控进出 Merit 网络边界的互联网流量，并检测和帮助减轻针对 Merit 成员机构的网络威胁。 （即大学、K12 学校等）所谓的 IRIS（研究仪器和机构间安全运营中心 (SOC)）基础设施具有以流式传输方式监控超高速网络流量的能力。这种高速网络监控基础设施以集中、可配置和可持续的方式部署在关键对等位置的 Merit 主干网络上，并提供丰富的网络研究数据以及提炼的网络安全威胁的持续反馈。 （例如，恶意软件下载、拒绝服务攻击等）SOC 平台通过最先进的网络安全解决方案（包括开源解决方案）收集此类威胁，并将其传递到数据管道以进行进一步分析、丰富和处理。这些分析产品为安全分析师和研究人员提供有关当前恶意软件生态系统的最新见解、有关受感染计算机系统和恶意互联网站点的可操作威胁情报以及需要修复的可利用漏洞。该奖项反映了 NSF 的法定使命。通过使用基金会的智力优点和更广泛的影响审查标准进行评估，并被认为值得支持。