NeTS-NBD: Behavior Modeling and Profiling for Internet Traffic

0626812张随着互联网规模和复杂性的不断增长，有效配置、管理和保护互联网的挑战已与深入了解互联网流量密不可分。虽然已经存在大量关于互联网流量的流量表征的先前工作，但很少有人尝试根据行为，即终端主机和服务的通信模式来构建通用模型或配置文件。该项目致力于开发一种通用的面向行为的方法，用于根据互联网流量的通信模式、底层结构、时间属性和其他相关特征对其进行建模和分析。该项目由四个主要组件组成，它们相互构建，使用不同的功能和技术组合来探索、分析和描述流量行为。广泛的影响：该项目的最终目标是：i)在理论层面，帮助建立一个新的基于行为的理论框架，用于对互联网流量进行建模和研究，从而深入了解什么是网络中的“正常”或“异常”流量；以及ii)在实践层面，帮助开发有效的技术和工具，以改进网络问题识别、安全监控、攻击检测和归因。该项目的研究将被纳入课堂教学、本科生指导的研究和高级项目，以及国家科学基金会资助的暑期学校，该暑期学校是在SFS信息保障教师教育计划下进行的。

0626812 ZhangAs the Internet continues to grow in size and complexity, the challenge of effectively provisioning, managing and securing it has become inextricably linked to a deep understanding of Internet traffic. While there exists an extensive body of prior work on traffic characterization of Internet traffic, there has been very little attempt to build general models or profiles in terms of behaviors, i.e., communication patterns of end-hosts and services. This project is devoted to developing a general behavior-oriented methodology for modeling and profiling Internet traffic based on their communication patterns, underlying structures, temporal properties and other related features. The project consists of four major components which build upon each other to explore, analyze and profile traffic behaviors using different combinations of features and techniques.Broader Impact: The ultimate goal of the project is to i) at a theoretical level, help establish a new behavior-based theoretical framework for modeling and studying the Internet traffic so as to gain a deep understanding of what constitutes ``normal'' or ``anomalous'' traffic in a network; and ii) at a practical level, help develop effective techniques and tools for improved network problem identification, security monitoring, attack detection and attribution. The research of this project is to be incorporated into classroom teaching, undergraduate directed research and senior projects as well as in an NSF funded summer school under the SFS program for teacher education in information assurance.