CT-ISG: Modeling, Estimation, and Defense against Network Attacks

CT-ISG：建模、估计和网络攻击防御

• 批准号: 0524323
• 负责人: Donald Towsley
• 金额: $ 25万
• 依托单位: University of Massachusetts Amherst
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2005
• 资助国家: 美国
• 起止时间: 2005-10-01 至 2009-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0524323&HistoricalAwards=false
• 关键词: CT; ISG; Modeling; Estimation; Defense

The easy access and wide usage of the Internet makes it a prime target and conduit for malicious activities. It constitutes a critical infrastructure in the economic and social fabric of, not only our nation, but the developed and, increasingly, the developing world. Recently, the Internet has become a powerful mechanism for propagating malicious software programs. These have been designed to annoy (e.g., deface web pages), spread misinformation (e.g., false news reports or stock quotes), deny service (e.g., corrupt hard disks), steal financial information (e.g., VISA card numbers), enable remote login (e.g., Trojan horses), etc. Moreover, they have been used to disrupt normal operations within the Internet itself. Furthermore, the potential for significant network disruptions is extremely high. It is well known that a single misconfigured BGP router on April 25th, 1997 effectively shut down most of the major Internet backbones for up to two hours, unleashing a sequence of cascading failures. If an accidentally misconfigured router can wreak such havoc, one can only imagine what a carefully orchestrated attack can produce in the way of disruptions.Although malicious activities have appeared on many occasions, to date there appears to be no well-defined methodology for predicting their behavior and the damage that they can cause. This proposal describes research aimed at developing sound mathematically-based methodologies that can be used to better understand the characteristics of different network attacks, and to detect and estimate their parameters. More specifically, the proposed research will focus on the following areas.o Mathematical models of network attacks. The researcher will develop a modelling methodology based on fluid models and networked Markov chains (NMCs). These models will be used to answer questions such as: how does network topology affect the spread of an Internet worm? What conditions must an attack meet to be considered virulent (severe)?o Detection and parameter estimation. The researchers will develop detection and parameter estimation techniques for different types of monitors, based on the exponential growth trend in the early stage of the network attacks, with fluid models and point process models, respectively. They will also develop "hypothesis testing" based detection methods and study the performance and the impact in the defense strategies.Furthermore, the analysis methodology produced by this research will have broad applicability in the design and analysis of failure and attack scenarios in large complex man made systems such as the power grid.Intellectual Merit: This project will generate new techniques for studying and detecting different network attacks (e.g., worms, email viruses, BGP infrastructure attacks). Furthermore, the project will enhance our understanding of how failures can propagate throughout a large distributed system like the Internet, and, more generally, large man-made systems.Broader Impact: The project integrates research and education of graduate and undergraduate students through the close interaction and mentoring of students by project faculty. We will also seek international involvement with Universities in Brazil in the form of joint courses/seminars.

互联网的容易进入和广泛使用使其成为恶意活动的主要目标和渠道。它不仅是我们国家，而且是发达世界和越来越多的发展中世界的经济和社会结构的重要基础设施。最近，互联网已经成为传播恶意软件程序的强大机制。这些都是为了骚扰（例如，污损网页），传播错误信息（例如，虚假新闻报道或股票报价）、拒绝服务（例如，损坏硬盘），窃取财务信息（例如，VISA卡号），启用远程登录（例如，此外，它们还被用来破坏互联网本身的正常运行。此外，发生重大网络中断的可能性极高。众所周知，1997年4月25日，一个错误配置的BGP路由器有效地关闭了大多数主要的互联网骨干长达两个小时，引发了一系列级联故障。如果一个意外配置错误的路由器可以造成如此严重的破坏，人们只能想象精心策划的攻击可以产生什么样的破坏。虽然恶意活动已经出现在许多场合，到目前为止似乎还没有定义良好的方法来预测他们的行为和他们可能造成的损害。该提案描述了旨在开发基于可靠性的方法的研究，这些方法可用于更好地了解不同网络攻击的特征，并检测和估计其参数。更具体地说，拟议的研究将集中在以下领域。o网络攻击的数学模型。研究人员将开发一种基于流体模型和网络马尔可夫链（NMC）的建模方法。这些模型将被用来回答问题，如：网络拓扑结构如何影响互联网蠕虫的传播？一次攻击必须满足什么条件才能被认为是致命的（严重的）？o检测和参数估计。研究人员将根据网络攻击早期的指数增长趋势，分别采用流体模型和点过程模型，为不同类型的监视器开发检测和参数估计技术。他们还将开发基于“假设检验”的检测方法，并研究其性能和在防御策略中的影响。此外，本研究产生的分析方法将在电网等大型复杂人造系统的故障和攻击场景的设计和分析中具有广泛的适用性。该项目将产生用于研究和检测不同网络攻击的新技术（例如，蠕虫、电子邮件病毒、BGP基础设施攻击）。此外，该项目将提高我们的理解如何故障可以在整个一个大型分布式系统，如互联网，更普遍的是，大型人造系统。更广泛的影响：该项目整合研究生和本科生的教育，通过密切的互动和指导学生的项目教师。我们还将寻求与巴西大学以联合课程/研讨会的形式进行国际参与。