CCollaborative Research: CT-M: Beyond Testbeds-Catalyzing Transformative Research and Education through Cybersecurity Collaboratories (BTCT)

C协作研究：CT-M：超越测试床 - 通过网络安全协作实验室 (BTCT) 促进变革性研究和教育

• 批准号: 0831491
• 负责人: John Wroclawski
• 金额: $ 17.8万
• 依托单位: University of Southern California
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-10-01 至 2011-03-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0831491&HistoricalAwards=false
• 关键词: CCollaborative; Research; CT; Beyond; Testbeds

Experimental cybersecurity research is inherently risky. An experiment may involve releasing live malware code, operating a botnet, or creating highly disruptive network conditions. Realism is required in replicating attacks so that proposed defenses can be thoroughly tested and future attacks anticipated. This proposal, in addressing intellectual merit, seeks to develop a unique model for risky experiment management; enabling researchers to carry out experiments that interact with their larger environment while retaining both control and safety. The model forwarded here is based on a very simple line of reasoning: If the behavior of an experiment is completely unconstrained, the behavior of the host environment must be completely constraining, because it can assume nothing about the experiment; but, if the behavior of the experiment is constrained in some particular and well-chosen way or ways, the behavior of the host testbed can be less constraining, because the combination of experiment and environment constraints together can provide the required overall assurance of good behavior. The key benefit of this model is that both experimenter and testbed operator can proceed with assurance in carrying out a wide and interesting range of previously unsupportable experiments. The ultimate goal is to develop both implementation and formalization of this model, including logical tools to reason about experiment and testbed constraint composition (broader impact). Initial work will develop mechanisms to support the model in the DETER facility and similar Emulab-based testbeds.The proposal was reviewed by panelists and received one Very Good, one Very Good/Good and one Good. Panelists viewed all three elements of the proposal (risky experimentation support, dynamic health monitoring, and federation of testbeds) to represent contributions to the field, with the most valuable area of the three being risky experimentation support. The panel overall wanted to see a stronger case made for improving existing security testbeds in general, and particularly a tie in with current uses and needs of the DETER testbed by researchers. Panelists recognized the team as being well qualified for the work. If successful, the activities were viewed as advancing the state-of-the-art in experimental facilities for cybersecurity.

实验性网络安全研究本身就具有风险。实验可能涉及释放实时恶意软件代码，操作僵尸网络或创建高度破坏性的网络条件。在复制攻击时需要现实主义，以便可以彻底测试拟议的防御措施，并预测未来的攻击。这项建议，在解决智力价值，寻求开发一个独特的模型，风险实验管理，使研究人员能够进行实验，与他们的更大的环境，同时保持控制和安全。这里提出的模型是基于一个非常简单的推理：如果实验的行为是完全不受约束的，那么宿主环境的行为必须是完全受约束的，因为它不能对实验进行任何假设;但是如果实验的行为以某种特定的和精心选择的一种或多种方式受到约束，则主机测试台的行为可以较少受到约束，因为实验和环境约束的结合可以提供良好行为的所需总体保证。 该模型的主要优点是，实验者和试验台操作员都可以放心地进行广泛而有趣的先前无法支持的实验。最终目标是开发该模型的实现和形式化，包括逻辑工具来推理实验和测试床约束组合（更广泛的影响）。初步工作将开发机制，以支持在DETER设施和类似的Emulab为基础的测试bottes.The建议进行了审查小组成员，并收到一个非常好，一个非常好/好和一个良好的模型。 小组成员认为该提案的所有三个要素（风险实验支持，动态健康监测和测试台联合）代表了对该领域的贡献，其中最有价值的领域是风险实验支持。总体而言，专家组希望看到一个更强有力的案例来改进现有的安全测试平台，特别是与研究人员目前使用和需求DETER测试平台的联系。小组成员承认该小组完全有资格从事这项工作。如果成功，这些活动被视为推进了网络安全实验设施的最新水平。