Quantitative Network Security Analysis

点击翻译按钮获取中文摘要

Proposal number: CCR-0311690Title: Quantitative Network Security AnalysisPIs: David Moore, Geoffrey M. Voelker, Stefan SavageThe research investigates the following questions: how does the nature oflarge-scale Internet security threats change over time, how effectiveare attackers at compromising services, and how well do existingsecurity countermeasures provide a meaningful defense against thesethreats in practice?This requires the development of a combination of network analysistechniques and network measurement infrastructure to analyze thesethreats. In particular, this project has three specific goals. First,our prototype measurement infrastructure will be re-engineered toprovide real-time analysis about current Internet-wide securityanomalies. This will allow for active measurements to characterize theimpact of attacks, the presence and effectiveness of securitycountermeasures and patches, and to better correlate this data withother sources of network measurement data. Second, tracking theseevents on a long-term basis allows extraction of trends in theprevalence, make-up, and staging of large-scale Internet attacks.Creating this kind of longitudinal dataset is essential forunderstanding the evolution of the threats and vulnerabilities beingexploited. Finally, while there has been initial validation of resultsconcerning large-scale homogenous attacks, it is an open question howwell these techniques can be used for also observing smaller or highlyskewed attack distributions. This research will evaluate the resolutionof techniques by comparing with smaller scale monitors and directmeasurements on individual networks. Together these efforts willproduce the first meaningful datasets about large-scale network attackson the Internet. It is hoped that this data will ultimately have impactbeyond the individual results of this research, and will change the waynetwork security decisions are made.