NeTS-NBD: Behavior Modeling and Profiling for Internet Traffic

随着互联网的规模和复杂性不断增长，有效地提供、管理和保护它的挑战已经与对互联网流量的深刻理解密不可分。虽然在互联网流量特征方面存在广泛的先前工作，但很少有人尝试在行为方面建立一般模型或概况，即终端主机和服务的通信模式。该项目致力于开发一种基于通信模式、底层结构、时间属性和其他相关特征的通用行为导向方法，用于对互联网流量进行建模和分析。该项目由四个主要部分组成，它们相互建立，使用不同的功能和技术组合来探索、分析和描述交通行为。更广泛的影响：该项目的最终目标是i)在理论层面，帮助建立一个新的基于行为的理论框架来建模和研究互联网流量，从而深入了解网络中什么是“正常”或“异常”流量；ii)在实践层面，帮助开发有效的技术和工具，以改进网络问题识别、安全监控、攻击检测和归因。本课题的研究将纳入课堂教学、本科生指导研究和高年级项目，并纳入国家科学基金资助的信息保障教师教育暑期学校。

0626812 ZhangAs the Internet continues to grow in size and complexity, the challenge of effectively provisioning, managing and securing it has become inextricably linked to a deep understanding of Internet traffic. While there exists an extensive body of prior work on traffic characterization of Internet traffic, there has been very little attempt to build general models or profiles in terms of behaviors, i.e., communication patterns of end-hosts and services. This project is devoted to developing a general behavior-oriented methodology for modeling and profiling Internet traffic based on their communication patterns, underlying structures, temporal properties and other related features. The project consists of four major components which build upon each other to explore, analyze and profile traffic behaviors using different combinations of features and techniques.Broader Impact: The ultimate goal of the project is to i) at a theoretical level, help establish a new behavior-based theoretical framework for modeling and studying the Internet traffic so as to gain a deep understanding of what constitutes ``normal'' or ``anomalous'' traffic in a network; and ii) at a practical level, help develop effective techniques and tools for improved network problem identification, security monitoring, attack detection and attribution. The research of this project is to be incorporated into classroom teaching, undergraduate directed research and senior projects as well as in an NSF funded summer school under the SFS program for teacher education in information assurance.