TC: Medium: Collaborative Research: Wide-Aperture Traffic Analysis for Internet Security

TC：媒介：协作研究：互联网安全的大孔径流量分析

• 批准号: 0905186
• 负责人: Paul Barford
• 金额: $ 40万
• 依托单位: University of Wisconsin-Madison
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-01 至 2014-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0905186&HistoricalAwards=false
• 关键词: TC; Medium; Collaborative; Research; Wide

TC: Medium: Collaborative Research: Wide-Aperture Traffic Analysis for Internet SecurityAmong emerging network threats, some of the most pernicious and elusive are stealthy attacks that take place at very low rates and in a targeted fashion. This project is developing methods for identifying malicious and unwanted activity in the Internet -- specifically, traffic that is low-volume and well "hidden'' among normal traffic. The approach being taken is to develop new methods for direct analysis of Internet traffic of unprecedented scope and scale. In particular, the project is designing and implementing a system that leverages high-performance cluster computing to allow application of sophisticated pattern analysis and machine learning algorithms to network traffic at the packet and flow level.An organizing principle of the system is its decomposition into data-parallel "lenses'' and more computationally challenging "pattern analysis'' components. The project is investigating the application of this architecture to dark address monitoring in traffic from core networks -- a capability that has not been possible to date.The end result of this project will be a set of tools and a running system that may be used by researchers to enable new investigations into traffic analysis, and may be used by network operators on an ongoing basis to help protect their networks.

技术委员会：中等：合作研究：在新兴的网络威胁中，一些最致命和最难以捉摸的是以非常低的速率和有针对性的方式发生的隐形攻击。该项目正在开发用于识别互联网中恶意和不必要活动的方法-特别是低流量和在正常流量中很好地“隐藏”的流量。正在采取的办法是开发新的方法，直接分析前所未有的范围和规模的互联网流量。特别是，该项目正在设计和实现一个系统，该系统利用高性能集群计算，允许将复杂的模式分析和机器学习算法应用于数据包和流级别的网络流量。该系统的组织原则是将其分解为数据并行的“透镜”和更具计算挑战性的“模式分析”组件。该项目正在研究这种架构在核心网络流量暗地址监控中的应用--这是一种迄今为止还不可能实现的功能。该项目的最终结果将是一套工具和一个运行系统，研究人员可以使用这些工具和系统对流量分析进行新的研究，网络运营商也可以使用这些工具和系统来帮助保护他们的网络。