NR: Network Security Vulnerability Analysis via Large Scale Simulation

NR：通过大规模模拟进行网络安全漏洞分析

• 批准号: 0240477
• 负责人: George Riley
• 金额: --
• 依托单位: Georgia Tech Research Corporation
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-09-15 至 2009-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0240477&HistoricalAwards=false
• 关键词: NR; Network; Security; Vulnerability; Analysis

This research is developing simulation models that are used to simulate and analyze the affect of large-scale network attacks and assist in the development and understanding of potential defensive mechanisms. The work includes the creation of computer models for a number of network behaviors that are commonly exploited to maliciously degrade or inhibit access to computer networks and systems. These models are used to analyze "what happened", "what might have happened", and "what will happen next time" for common network attacks and failures. By analyzing past behavior, network researchers and network operators are able to better design and implement defenses that mitigate the affect of malicious activities. Recreating the original attach scenario in a simulation environment allows operators to demonstrate what will happen in the future under a similar attack.The methodology used to accomplish these goals is to extend the functionality of the existing ns2 and GTNetS simulation environments to allow for simulation analysis of DDOS attacks. These additions allow researchers to include end--system resource limitations for memory, CPU, and kernel resources into the simulation scenarios, and give a realistic picture of the affect of various attack scenarios on more than just network traffic load.Finally, using these models, interfaces to existing security analysis tools, such as tcpreplay, allow for detailed study of actual systems behavior while under attack scenarios defined and modeled by the simulators. Thus, any live system can be subjected to a variety of attacks in a controlled, but highly realistic environment.

该研究正在开发用于模拟和分析大规模网络攻击影响的模拟模型，并协助开发和理解潜在的防御机制。 这项工作包括为许多网络行为创建计算机模型，这些网络行为通常被用来恶意降低或禁止访问计算机网络和系统。 这些模型用于分析常见网络攻击和故障的“发生了什么”、“可能发生了什么”和“下次会发生什么”。 通过分析过去的行为，网络研究人员和网络运营商能够更好地设计和实施防御措施，减轻恶意活动的影响。 在模拟环境中重现原始攻击场景，使运营商能够演示未来在类似攻击下会发生什么。用于实现这些目标的方法是扩展现有ns2和GTNetS模拟环境的功能，以允许模拟分析DDOS攻击。 这些增加允许研究人员将内存，CPU和内核资源的端系统资源限制纳入模拟场景，并给出各种攻击场景对网络流量负载的影响的真实画面。最后，使用这些模型，现有安全分析工具的接口，如tcpreplay，允许在模拟器定义和建模的攻击场景下详细研究实际系统行为。 因此，任何实时系统都可能在受控但高度逼真的环境中受到各种攻击。