CT-T: Establishing a Cross-Institutional Platform for Cooperative Security Monitoring and Forensics

国家科学基金会CISE/CNSForm 7审查分析和建议编号：0716640PI：Vern Paxson Institution：加州大学伯克利分校国际计算机科学研究所领导建议摘要CT-T：为合作安全监控和取证建立跨机构平台虽然已经有很多研究开发全球共享安全信息的系统，但这些方法往往是有限的，因为它们的广泛范围限制了参与者对系统的信任。相反，这个项目寻求通过考虑一个更有限的范围来获得更大的效用：一个基于一组明确决定相互合作的站点之间交换信息的协调安全分析系统。这个更有限的范围针对这样一个常见情况进行了优化，即在这样的环境中，参与站点通常(但不总是)以负责任的方式行事。该项目的一个关键关注点是自动化安全监视和取证分析中通常涉及的步骤，同时仍然让分析师对重大决策保持“知情”。当出现安全问题时，检测到事件的站点会将攻击描述编码到“分析脚本”中，以导出到其他站点。收到这样的脚本的分析师会检查它们，以确定它们是否感兴趣。如果是这样的话，他们可以指示系统对过去的活动进行追溯搜索，并改进站点的监控配置以检测未来的情况。由于验证这种方法需要操作部署，该项目试图展示一个在劳伦斯·伯克利国家实验室、国家能源研究科学计算中心和加州大学伯克利分校之间协调分析的工作系统。

National Science FoundationCISE/CNSForm 7 Review Analysis and RecommendationProposal Number: 0716640PI: Vern PaxsonInstitution: International Computer Science Institute, University of California BerkeleyLeadProposal AbstractCT-T: Establishing a Cross-Institutional Platform for Cooperative Security Monitoring and ForensicsAlthough there has been much research in developing systems for globally sharing security information, often these approaches are fundamentally limited because their broad scope limits the trust that participants can place in the system. This project instead seeks to reap significantly greater utility by considering a more restricted scope: a system for coordinated security analysis based on exchanging information between a set of sites who have explicitly decided to work with each other. This more limited scope optimizes for the common case that in such an environment the participating sites will usually (but not always) act in a responsible manner.A key focus of the project concerns automating the steps commonly involved in security monitoring and forensic analysis while still keeping an analyst "in the loop" for significant decisions. As security problems arise, a site detecting an incident codifies a description of the attack in an "analysis script" to export to other sites. Analysts receiving such scripts inspect them to determine whether they are of interest. If so, they can instruct the system to conduct both a retrospective search for the activity in the past, and refine the site's monitoring configurations to detect future instances.As validating such an approach requires operational deployment, the project seeks to demonstrate a working system for coordinating analysis between the Lawrence Berkeley National Laboratory, the National Energy Research Scientific Computing Center, and the University of California at Berkeley.