CAREER: SMART -- A Scalable Monitoring, Analysis, and Response Toolkit for the Internet

网络管理中的一个核心问题是如何监控、分析和应对由于各种原因（如故障、错误配置、路由不稳定、闪存拥挤、分布式拒绝服务（DDoS）攻击和计算机蠕虫）而导致的网络状况变化。手动跟踪和响应这些变化是劳动密集型的，容易出错，并且在许多情况下是不可行的（例如，现代蠕虫可以在几分钟内造成灾难性的损害-对于人类来说，手动响应的时间尺度太小了）。 因此，这是一个重要的和紧迫的研究挑战，开发工具和技术，完全自动化的过程中的网络监测，分析，和responses.The研究解决了上述挑战，通过开发一个可扩展的监测，分析和响应工具包（SMART）。 SMART允许应用程序执行网络范围的流量监控，识别网络状态中的异常和变化，诊断变化的原因，并动态控制网络流量-所有这些都是以自动化的方式进行的。 通过将实用的网络领域知识和工程经验与算法，统计，数据挖掘和机器学习方面的坚实理论基础相结合，SMART具有可扩展性，准确性，鲁棒性和易于部署性。 它可以大大简化大规模网络管理和安全应用程序的开发和部署。 为了证明SMART的实用价值，该研究使用该工具包开发了两个重要的现实安全应用程序：自动蠕虫指纹识别和基于网络的DDoS防御。 最后，研究包括一个重要的教育和培训部分。 该项目的研究成果将通过开发新课程纳入本科生和研究生课程。

Yin ZhangUniversity of Texas, Austin0546720AbstractA central problem in network management is how to monitor, analyze, and react to changing network conditions due to various reasons such as failures, misconfigurations, routing instability, flash crowds, distributed denial-of-service (DDoS) attacks, and computer worms. Manually tracking and reacting to such changes is labor-intensive, error-prone, and in many cases infeasible (e.g. modern worms can causecatastrophic damages within minutes -- too small a timescale for human to respond manually). It is therefore an important and urgent research challenge to develop tools and techniques to fully automate the process of network monitoring, analysis, and response.The research addresses the above challenge by developing a ScalableMonitoring, Analysis, and Response Toolkit (SMART). SMART allows applications to perform network-wide traffic monitoring, identifyanomalies and changes in the network state, diagnose the causes for the changes, and dynamically control the network traffic -- all in an automated fashion. By integrating practical network domain knowledge and engineering experience with solid theoretical foundations in algorithms, statistics, data mining, and machine learning, SMART is scalable, accurate, robust, and easy-to-deploy. It can significantly simplify the development and deployment of large-scale network management and security applications. To demonstrate the practical values of SMART, the research develops two significant real-world security applications using the toolkit: automated worm fingerprinting, and network-based DDoS defense. Finally, the research includes a significant education and training component. The research results of the project will be integrated into both the undergraduateand the graduate curricula through the development of new courses.