Large-scale collection and sanitization of network security data: risks and challenges
Large-scale collection and sanitization of network security data: risks and challenges
复制标题
网络安全数据的大规模收集和清理：风险与挑战
DOI：
--
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
Vitaly Shmatikov
中科院分区：
文献类型：
--
作者：
Phillip A. Porras;Vitaly Shmatikov
在过去的几年中，人们对开发广域数据收集和分析中心产生了新的兴趣，以帮助识别、跟踪和制定对困扰全球计算机网络的不断增长的协同攻击和恶意软件感染的响应。随着大规模网络威胁的复杂性继续发展，并扩展到广泛部署的应用程序，我们预计对协作安全监控基础设施的兴趣将继续增长，因为此类攻击可能不容易从网络中的单个点进行诊断。这份立场文件的目的不是为了论证互联网规模的安全数据共享基础设施的必要性，因为已经有大量的研究[13，48，51，54，41，47，42]和操作实例[43，17，32，53]证明了这一点。相反，我们注意到，这些善意的活动带来了一系列独特的风险和挑战。
我们概述了全球网络安全中心面临的一些最突出的问题，概述了拟议的防御机制，并对计算机安全社区提出了几个研究挑战。我们希望这份立场文件将成为一种刺激，推动在保护和分析技术方面进行开创性的新研究，这些技术可以促进网络安全数据的协作共享，同时确保数据贡献者的安全。
Over the last several years, there has been an emerging interest in the development of wide-area data collection and analysis centers to help identify, track, and formulate responses to the ever-growing number of coordinated attacks and malware infections that plague computer networks worldwide. As large-scale network threats continue to evolve in sophistication and extend to widely deployed applications, we expect that interest in collaborative security monitoring infrastructures will continue to grow, because such attacks may not be easily diagnosed from a single point in the network. The intent of this position paper is not to argue the necessity of Internet-scale security data sharing infrastructures, as there is ample research [13, 48, 51, 54, 41, 47, 42] and operational examples [43, 17, 32, 53] that already make this case. Instead, we observe that these well-intended activities raise a unique set of risks and challenges.
We outline some of the most salient issues faced by global network security centers, survey proposed defense mechanisms, and pose several research challenges to the computer security community. We hope that this position paper will serve as a stimulus to spur groundbreaking new research in protection and analysis technologies that can facilitate the collaborative sharing of network security data while keeping data contributors safe and secure.