CT-ISG: Towards Trusted Adaptation Dynamics in Computing Systems and Networks

这项建议旨在研究(并开发适当的防御措施)针对系统运行的“动态”的新兴漏洞-由部署在大多数计算系统和网络中的适应策略所产生的动态。虽然最近发现的对抗性攻击的例子很少-即PI对终端主机的准入控制器和网络中的TCP适配进行质量降低(RoQ)攻击-但人们对此类攻击的重要性、普遍性和其他非对抗性动机知之甚少，更不用说有效的防御了。智力优势：作为这项提议的一部分，将沿着三个方面开展工作：(1)脆弱性评估，(2)攻击综合，以及(3)强化和对策。在第一个维度上，为了评估系统组件的脆弱性，PI打算采用控制论方法来对常见自适应系统和网络组件--从调度器、负载平衡器和接纳控制器到网络流量工程和路由协议--的瞬时操作进行建模。这些模型将被用来分析这些组件对各种攻击的脆弱性，无论这种攻击的动机是对抗性的(例如，降低系统的保真度或有效容量)还是仅仅是不友好的(例如，导致系统优先处理特定类别的请求或流)。对于第二个维度，PI将调查确定的对手如何通过简单的观察(从外部)推断给定系统组件的漏洞，并据此设计低强度但对组件的可用性或服务质量有较高影响的利用。沿着第三个维度，PI打算开发一种机制，以加强组件对非透视者攻击的敏感性，并使其能够识别(例如，追溯)犯罪者。PI将把他们的注意力集中在两种特定类型的系统上，这两种系统特别容易受到适应性动态攻击的攻击，并且他们在这方面有相当的经验，即(A)网络管理和工程，以及(B)可扩展的Web服务、虚拟主机环境和防火墙。这些系统由于其开放的性质特别容易受到攻击，因此需要使用动态资源管理策略，这些策略可被攻击者利用。这一努力的预期结果包括：-能够量化计算系统的脆弱性以利用其动态的度量和技术的发展。-制定设计原则，阐明各种设计目标之间的权衡。例如，通过将系统的适应速度与其对利用漏洞的敏感性联系起来，系统设计人员将能够识别在选择一种适应策略与另一种适应策略时所涉及的风险和回报。-制定新的适应战略和议定书，以容忍具体的利用。虽然PIS的重点将放在互联网系统中流行的适应技术上，但他们开发的新方法和原则将适用于更广泛的系统，包括操作系统、嵌入式系统、传感器网络、临时和分布式系统等。BROADER影响：拟议的工作还将通过开发各种人工制品对教育和培训产生重要的有形贡献，包括：-创建一个储存库，作为各种自适应系统中已知漏洞和防御的知识库。仅仅是提供这样一个储存库，就能使实践者获得相当于测试其设计的基准的东西，从而非常有助于加强新开发的系统。-开发可以集成到标准系统和网络课程中的人工制品(例如，教程、实验室模块、软件工具和基于Web的演示)。此外，开展拟议工作将产生重要的无形和更广泛的影响，包括：-提高研究界对系统动力学重要性的认识，这无疑将导致基础研究的具体进展，取得科学出版物和学生培训的预期结果。-利用私人投资机构的努力，将其已证明的服务记录扩展到系统和网络研究界，并将其推广到少数群体和代表不足的群体。最后但同样重要的是，开展这项建议中概述的研究将促进信息系统的设计，这些系统值得我们的社会(并可以委托我们)设计。

This proposal aims to study (and develop appropriate defenses against) emerging exploits that target the "dynamics" of a system's operation---dynamics that result from the adaptation strategies deployed in most computing systems and networks. While few instances of adversarial exploits along these lines have been identified recently---namely, the PIs work on Reduction of Quality (RoQ) attacks on admission controllers of end-hosts and on TCP adaptation in networks---little is known about the significance, prevalence, and other-than-adversarial motives of such exploits, not to mention effective defenses. INTELLECTUAL MERITS: The work to be pursued as part of this proposal flows along three dimensions: (1) vulnerability assessment, (2) attack synthesis, and (3) hardening and countermeasures. Along the first dimension, and in order to assess the vulnerability of system components, the PIs intend to adopt a control-theoretic approach to model the transient operation of common adaptive system and network components -- from schedulers, load balancers, and admission controllers to network traffic engineering and routing protocols. These models will be used to analytically characterize the vulnerabilities of such components to various exploits, whether the motive of such exploits is adversarial in nature (e.g., reducing a system's fidelity or effective capacity) or simply unfriendly (e.g., causing the system to preferentially treat a particular class of requests or flows). Along the second dimension, the PIs will investigate how a determined adversary could infer the vulnerabilities of a given system component through simple observations (from the outside), and thereupon design an exploit of low intensity but of high impact on the component's availability or service quality. Along the third dimension, the PIs intend to develop mechanisms that harden a component's susceptibility to exploits by non-clairvoyant adversaries, and also enable the identification (e.g., trace-back) of perpetrators.The PIs will focus their attention on two specific types of systems that are particularly vulnerable to exploits of adaptation dynamics, and with which they have had quite a bit of experience, namely (A) network management and engineering, and (B) scalable web services, virtual hosting environments, and firewalls. These systems are particularly vulnerable due to their open nature, necessitating the use of dynamic resource management policies, which are exploitable by adversaries.Expected outcomes from this effort include:- The development of metrics and techniques that are capable of quantifying the vulnerabilities of computing systems to exploits that target their dynamics. - The development of design principles that elucidate the tradeoffs between various design goals. For example, by relating a system's adaptation speed to its susceptibility to exploits, a system designer would be able to discern the risks and rewards involved in choosing one adaptation strategy versus another. - The development of novel adaptation strategies and protocols that would be tolerant to specific exploits. While the PIs' focus will be on adaptation techniques that are prevalent in Internet systems, the new approaches and principles they develop will be applicable to a much wider range of systems, including operating systems, embedded systems, sensor networks, ad-hoc and distributed systems, among others.BROADER IMPACT: The proposed work will also result in important tangible contributions to education and training through the development of various artifacts, including:- The creation of a repository that would act as a knowledge base of known vulnerabilities and defenses in various adaptive systems. The mere availability of such a repository would be quite instrumental in hardening newly developed systems by enabling practitioners access to what amounts to benchmarks for testing their designs.- The development of artifacts (e.g., tutorials, laboratory modules, software tools, and Web-based demonstrations) that could be integrated into standard systems and networking curricula. In addition, the pursuit of the proposed work will result in important intangible broader impacts, including:- Heightening the research community's appreciation of the importance of system dynamics, which will undoubtedly lead to concrete advancement in basic research with the expected outcomes of scientific publications and student training.- Leveraging the efforts of the PIs in extending their proven service record to the systems and networking research community, as well as their outreach to minority and under-represented groups.Last but not least, the pursuit of the research outlined in this proposal will promote the design of information systems, which are worthy of (and to which we can entrust) our society.