CT-ISG: Collaborative Research: Massive Dataset Algorithmics for Network Security

随着对计算机系统的恶意攻击的严重性和复杂性的增加，开发有效的方法来保护互联网是当今计算机科学面临的最重要的挑战之一。基于网络的安全机制提供了良好的覆盖范围和早期威胁检测的可能性，但它们往往与网络元素的性能要求相冲突，因为必须分析大量的流量数据。 该项目将把多维数据集（MDS）算法应用于网络安全，将两个以前互不相关的研究领域结合在一起。 该项目的目标是通过开发有效的、理论上严格的、可在现代网络中大规模部署的算法防御来实现网络安全的质的改进。该项目既解决了基本的算法设计问题，也解决了实际应用问题。 MDS算法提供了一组用于高效（例如，一次通过、小空间、多对数时间）分析大量数据。 本项目将研究这些方法如何用于（1）分组流的在线分类和属性测试，包括对由随机源混合生成的流的有效推断，（2）检测流量模式的变化和异常，以及（3）开发可计算处理的流量源模型，支持对各种对抗行为的推理，并结合先验知识在项目过程中开发的算法工具包将应用于实际的网络安全问题，如识别拒绝服务活动、蠕虫指纹和检测僵尸网络。

As malicious attacks on computer systems increase in severity and sophistication, developing effective methods for protecting the Internet is among the most important challenges facing computer science today.Network-based security mechanisms offer both good coverage and the possibility of early threat detection, but they often conflict with the performance requirements of network elements because of the vast amounts of traffic data that must be analyzed. This project will apply massive-dataset (MDS) algorithmics to network security, bringing together two previously unconnected research areas. The objective is to achieve a qualitative improvement in network security by developing efficient, yet theoretically rigorous, algorithmic defenses that can be deployed at scale in modern networks.The project addresses both fundamental algorithm-design problems and practical applications. MDS algorithmics provides a set of basic techniques for highly efficient (e.g., one-pass, small-space,polylog-time) analysis of large amounts of data. This project will investigate how these methods can be used for (1) online classification and property testing of packet streams, including efficient inference of streams generated by a mixture of stochastic sources, (2) detection of changes and anomalies in traffic patterns, and (3) development of computationally tractable models of traffic sources that support reasoning about a wide variety of adversarial behaviors and incorporate prior knowledge such as conventional intrusion-detection rules.The algorithmic toolkit developed in the course of the project will be applied to practical network-security problems such as recognizing denial of service activity, worm fingerprinting, and detecting botnets.