CSR: SGER: Dynamic Data Driven Defense Mechanisms for Cybersecurity

SGER项目的目标是寻求新颖和激进的方法来调查与关键基础设施保护相关的基本问题，并能够向最终用户可靠地提供合法流量，即使系统受到攻击也是如此。动态数据驱动应用系统(DDDAS)的概念能够很好地实现这些目标，因为它为开发适用于高性能协作环境的动态、数据驱动的入侵检测系统提供了基础。提出的探索性研究集中在四个基本研究主题上：用于入侵检测和响应的动态、协作防御基础设施，由对等网络组成，基于资源高效的检测包概率检测算法和协同哨兵部署算法，动态协作防御入侵和拒绝服务攻击，以确保可扩展的攻击响应的最佳网络覆盖。数据驱动入侵评估信息库(IAIB)：我们建议开发一个信息库(评估树库)，用于辅助检测和防御过程。以及在DDDAS范式下探索的用于中断检测、遏制和恢复的协同入侵检测算法和框架，允许探索用于入侵隔离、损害遏制和自适应恢复的分布式机制的可行性和设计要求。网络安全日益受到关注，而静态的安全解决方法是有限的。该项目带来了传统上相互脱节的技术方面，并整合了来自不同学科的跨学科工作，包括概率算法、人工智能技术、数据库、网络和协作系统，并推动了DDDAS概念。建议的方法和系统软件功能可能会对如何以自适应方式构建系统中的安全体系结构的基本问题产生影响。该项目包括教育和外展计划。其他更广泛的影响包括在规定的项目范围内推进最先进的技术是重要的，该项目有可能为未来和新的方法设定方向。

The objective of this SGER project is to pursue novel and radical approaches to investigate fundamental issues related to critical infrastructure protection and enable reliable delivery of legitimate traffic to end-users, even when the system is under attack. It is the tenet of this research project that these goals are best met using the concept of Dynamic Data-Driven Application Systems (DDDAS), as it provides the foundation for the development of a dynamic, data-driven intrusion detection systems for high-performance collaborative environments.The proposed exploratory research focuses on four fundamental research thrusts: Dynamic, collaborative defense infrastructure for intrusion detection and response, comprising of a network of peers, dynamically and collaboratively defend against intrusions and denial of service attacks based on resource efficient algorithms for probabilistic inspection of packets for detection and algorithms for collaborative sentinel deployment to guarantees optimal network coverage for scalable response to attacks.Data Driving the IDS -Intrusion Assessment Information Base (IAIB): We propose development of an information base (repository of assessment trees) that will be used to assist the detection and defense process. And Algorithms and Framework for Collaborative IDS for Disruption Detection, Containment & Recovery, explored within the paradigm of DDDAS, allowing exploration of the feasibility and design requirements of distributed mechanisms for intrusion isolation, damage containment and adaptive recovery.Network security is of increasing concern, and static methods to address security are limiting. The project brings technical aspects traditionally disjoint, and integrates interdisciplinary work from various disciplines including probabilistic algorithms, AI techniques, data bases, networks and collaborative systems, and driven the DDDAS concept. The proposed methods and systems software capabilities can have impact on fundamental issues how to architect security in systems in an adaptive way. The project includes education and outreach plans. Additional broader impacts include advancing the state of the art in the stated scope of the project is important, and the project has the potential to set directions for future and novel methods.