EAGER: Exploring Security Issues in Next-Generation Networking Infrastructure

互联网提供的数据通信对于商业、个人通信、电子政务和娱乐是必不可少的。我们的社会对数据通信网络的广泛可用性的依赖使这些系统成为当今基础设施的关键部分。支持新兴技术和网络范例的需求已经导致了许多正在进行的努力，以开发可以改进和取代现有网络系统的新型网络架构。许多新的网络设计使用虚拟化网络基础设施，在该虚拟化网络基础设施上可以实例化具有不同协议栈的网络。为了实现数据通信网络的这种动态部署，使用具有嵌入式分组处理系统的可编程路由器。在网络中引入这些新系统为使用网络或针对网络本身的新网络攻击打开了大门。这项工作将研究在这种新的虚拟化和可编程网络环境中出现的安全问题，并开发可用于识别，缓解和可能避免攻击的技术。研究人员将研究如何在下一代网络中描述攻击，以及如何开发新的异常检测算法。这些算法将使用协议层之间的合作以及节点和自治系统之间的分布式检测机制，以实现有助于保护网络基础设施的高检测能力。可编程节点在检测过程中的辅助能力将得到充分利用。这项工作的智力价值在于提供对新兴网络设计中的漏洞和可能防御的见解，这些设计与当今的互联网有着根本的不同。这项工作的更广泛影响旨在提供保护下一代互联网免受网络攻击所需的技术。

The Internet provides data communication that is essential for business, personal communication, E-Government, and entertainment. Our society's reliance on the broad availability of data communication networks makes these system a critical part of today's infrastructure. The need to support emerging technologies and networking paradigms has led to numerous ongoing efforts to develop novel network architectures that can improve and replace existing network systems. Many new network designs use a virtualized network infrastructure on which networks with different protocol stacks can be instantiated. To implement such dynamic deployment of data communication networks, programmable routers with embedded packet processing systems are used. The introduction of these new systems into the network opens the doors for new cyber attacks that use the network or target the network itself.This work will study the security issues that arise in this new virtualized and programmable networking environment and develop techniques that can be used to identify, mitigate, and possibly avoid attacks. The researchers will study how attacks can be characterized in next-generation network and how novel anomaly detection algorithms can be developed. The algorithms will use cooperation between protocol layers and distributed detection mechanisms between nodes and autonomous systems to achieve high detection capabilities that aid in defending the network infrastructure. The ability of programmable nodes to aid in the detection process will be leveraged.The intellectual merit of this work lies in providing insights on vulnerabilities and possible defenses in emerging network designs, which are fundamentally different from today's Internet.The broader impact of this work aims at providing the technology necessary to protecting the next-generation Internet from cyber attacks.