CT-ER: Physical Diffusion and Spectral Models for Network Forensic Investigation

CT-ER：用于网络取证调查的物理扩散和光谱模型

• 批准号: 0627409
• 负责人: Thomas Daniels
• 金额: --
• 依托单位: Iowa State University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-08-15 至 2009-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627409&HistoricalAwards=false
• 关键词: CT; ER; Physical; Diffusion; Spectral

The project will advance the state of the art in network forensics. For the first time, methods will be available to interactively investigate large datasets and then later detect similar scenarios when they recur. This is critical for large organizations so that they can respond quickly and correctly to cyber attacks. Because the methods are built upon a graph framework, analysts can easily interact with automated results to refine the investigation or rule out incorrect results from the system. Also, the methods developed can be refined by training on labeled data to improve the accuracy of automated investigation system.This project uses models from physics and spectral graph theory to extract attack scenarios from data collected in computer networks. The primary goals of the project are to provide the first mathematically well founded and tunable methods to extract and recognize attack scenarios in huge databases of network alerts, network flows, and expert knowledge. Secondarily, the methods are well suited to being transitioned to high performance computing technology and collaborative computing methods using established methods from the computational sciences. These methods derive from flow models in heat transfer and eigen analysis of graphs to extract meaningful features.

该项目将推进网络取证的最新技术水平。这是第一次，方法将可用于交互式地调查大型数据集，然后在它们再次出现时检测类似的场景。这对于大型组织至关重要，以便他们能够快速正确地应对网络攻击。由于这些方法是建立在图形框架之上的，因此分析人员可以轻松地与自动化结果进行交互，以改进调查或排除系统中的错误结果。 此外，开发的方法可以通过对标记数据进行训练来改进，以提高自动调查系统的准确性。该项目使用物理学和谱图理论的模型，从计算机网络中收集的数据中提取攻击场景。 该项目的主要目标是提供第一个数学上有充分依据和可调的方法来提取和识别网络警报，网络流和专家知识的巨大数据库中的攻击场景。其次，这些方法非常适合于使用来自计算科学的已建立的方法过渡到高性能计算技术和协作计算方法。这些方法来源于传热学中的流动模型和图的特征分析，以提取有意义的特征。