Collaborative Research: CT-L: CLEANSE: Cross-Layer Large-Scale Efficient Analysis of Network Activities to SEcure the Internet

第八层攻击(例如，垃圾邮件和网络钓鱼)是从恶意服务平台(例如僵尸网络)发起的，该服务平台由大量受感染的机器(或机器人)组成。这种攻击平台依靠较低层的网络服务来实现通信和攻击活动的高效、健壮和隐身。这些服务包括查找(如DNS)、托管(如Web服务器)和传输(如BGP)。CLENSE项目的主要研究目标和方法是：1.控制平面监控。安装Layer-8攻击的大部分基础设施涉及核心网络服务(例如，DNS和BGP)中控制平面的滥用。Cleanse项目开发分布式、在线和实时的控制平面异常检测传感器。2.数据平面监控。该项目开发了基于流量采样和聚类的新的通用网络异常检测算法，用于监控高速流量。3.提高安全审计能力。Cleanse项目开发了数据包“标记/污染”技术，以实现对网络流量流(例如，由同一个bot程序生成的流量)的跟踪和集群。该项目还开发了改进的流量采样功能，这些功能具有攻击感知和分布式网络范围。通过专注于监控核心网络服务，Cleanse框架可以检测未来的第八层攻击和新形式的大规模恶意软件感染。该项目还创建了教育内容，包括新的教科书和在线课程材料，这些内容直接受益于研究活动。清洁项目团队还与行业合作伙伴(包括互联网服务提供商)合作，组织有重点的研讨会，将学术界的研究人员和行业/互联网服务提供商、政府和执法机构的从业人员聚集在一起，促进思想、数据和技术的交流。

Layer-8 attacks (e.g., spam and phishing) are launched from a malicious service platform, e.g., botnet, which consists of a large number of infected machines (or bots). Such an attack platform relies on lower-layer network services to achieve efficiency, robustness, and stealth in communication and attack activities. These services include look-up (e.g., DNS), hosting (e.g., Web servers), and transport (e.g., BGP).The main research goals and approaches of the CLEANSE project are: 1. Control-plane monitoring. Much of the infrastructure for mounting layer-8 attacks involves abuse of the control plane in core network services (e.g., DNS and BGP).The CLEANSE project develops control-plane anomaly detection sensors that are distributed, online, and real-time. 2. Data-plane monitoring. The project develops new and general network anomaly detection algorithms based on traffic sampling and clustering for monitoring high-speed traffic. 3. Improved security auditing capabilities. The CLEANSE project develops packet "tagging/tainting" techniques to enable tracking and clustering of network traffic flows (e.g., that are generated by the same bot program). The project also develops improved traffic sampling capabilities that are attack-aware and distributed network-wide.By focusing on monitoring of core network services, the CLEANSE framework can detect future layer-8 attacks and new forms of large-scale malware infections. The project also creates educational contents, including new textbooks and on-line course materials, which directly benefit from the research activities. The CLEANSE project team also work with industry partners (including the ISPs) to organize focused workshops that bring together researchers from academia and practitioners from the industry/ISP, government, and law enforcement agencies to foster the exchange of ideas, data, and technologies.