CT-ER: Physical Diffusion and Spectral Models for Network Forensic Investigation

该项目将推动网络取证技术的发展。第一次，将有方法可以交互式地调查大型数据集，然后在类似的情况再次发生时检测出来。这对于大型组织来说是至关重要的，这样他们才能快速正确地响应网络攻击。由于这些方法是建立在图形框架之上的，分析人员可以很容易地与自动结果交互，以改进调查或从系统中排除不正确的结果。此外，所开发的方法可以通过对标记数据的训练来改进，以提高自动调查系统的准确性。该项目使用物理模型和谱图理论从计算机网络中收集的数据中提取攻击场景。该项目的主要目标是提供第一个在数学上建立良好且可调的方法，以从庞大的网络警报、网络流和专家知识数据库中提取和识别攻击场景。其次，这些方法非常适合转换为高性能计算技术和使用计算科学中已建立的方法的协作计算方法。这些方法来源于传热中的流动模型和图形的特征分析，以提取有意义的特征。

The project will advance the state of the art in network forensics. For the first time, methods will be available to interactively investigate large datasets and then later detect similar scenarios when they recur. This is critical for large organizations so that they can respond quickly and correctly to cyber attacks. Because the methods are built upon a graph framework, analysts can easily interact with automated results to refine the investigation or rule out incorrect results from the system. Also, the methods developed can be refined by training on labeled data to improve the accuracy of automated investigation system.This project uses models from physics and spectral graph theory to extract attack scenarios from data collected in computer networks. The primary goals of the project are to provide the first mathematically well founded and tunable methods to extract and recognize attack scenarios in huge databases of network alerts, network flows, and expert knowledge. Secondarily, the methods are well suited to being transitioned to high performance computing technology and collaborative computing methods using established methods from the computational sciences. These methods derive from flow models in heat transfer and eigen analysis of graphs to extract meaningful features.