CT-ISG: Computer Log Anonymization and Information Sharing

CT-ISG：计算机日志匿名化和信息共享

• 批准号: 0524643
• 负责人: Adam Slagell
• 金额: $ 40万
• 依托单位: University of Illinois at Urbana-Champaign
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2005
• 资助国家: 美国
• 起止时间: 2005-08-15 至 2009-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0524643&HistoricalAwards=false
• 关键词: CT; ISG; Computer; Log; Anonymization

Proposal ID: 0524643Title: CT-ISG: Computer Log Anonymization and Information SharingPI: Adam SlagellTo make computer and network log anonymization most useful, solutions must be customizable. Current tools are inflexible and do not support more than a single type of log. This, in turn, has inhibited log sharing, making the detection and response to modern, distributed and coordinated attacks more difficult. The main goal of this project is to create an anonymization framework that allows users to choose from multiple levels of anonymization that make different trade-offs between information loss and the protection of sensitive logging information. This research accomplishes this by addressing the following 5 research problems: (1) create a classification of logs by the types of security events that can be detected, (2) create a metric of utility based upon the different fields within a set of logs, (3) determine how different anonymization algorithms affect this metric, (4) determine how the choice of anonymization algorithms affects the strength of the anonymization scheme itself, and (5) create an architecture that provides multi-level anonymization for logs while optimizing the log utility metric for a given security requirement. The results of this research project will remove barriers that have prevented many organizations from sharing logs, thus making it more likely to detect and understand broad and coordinated attacks.

提案ID：0524643标题：CT-ISG：计算机日志匿名化和信息共享PI：Adam Slagell为了使计算机和网络日志匿名化最有用，解决方案必须是可定制的。 当前的工具不灵活，只支持一种类型的日志。 这反过来又抑制了日志共享，使得检测和响应现代的分布式和协同攻击变得更加困难。该项目的主要目标是创建一个匿名化框架，允许用户从多个级别的匿名化中进行选择，在信息丢失和保护敏感日志信息之间进行不同的权衡。本研究通过解决以下5个研究问题来实现这一目标：（1）根据可以检测到的安全事件的类型来创建日志的分类，（2）基于一组日志内的不同字段来创建效用度量，（3）确定不同的匿名化算法如何影响该度量，（4）确定匿名化算法的选择如何影响匿名化方案本身的强度，以及（5）创建一种体系结构，该体系结构为日志提供多级匿名化，同时针对给定的安全要求优化日志效用度量。该研究项目的结果将消除阻止许多组织共享日志的障碍，从而更有可能检测和理解广泛和协调的攻击。