TC: Small: Data Driven Analysis of Security Attacks in Large Scale Systems

尽管有用于检测入侵者的复杂监控工具和旨在保护计算系统免受各种攻击的技术，攻击者仍然不断地渗透甚至保护良好的系统。来自真实的大规模生产环境的攻击数据（在这项工作中，伊利诺伊州的国家超级计算应用中心（NCSA））被用作描述和建模攻击者行为的基础，并用于发现监控基础设施的缺陷。增加对这些分析和建模活动中产生的攻击的理解，大大有助于改进安全系统分析和设计。分析揭示了新的和现实的攻击场景，可以指导设计增强功能，以提高系统对每个级别恶意活动的保护。通过详细的取证来了解真实的攻击模式和类，可以确定网络/系统中的漏洞，并描述攻击者的行为特征。对数据的深入研究允许调查攻击者的行为和意图，并为设计辅助数据收集、分析和响应的自动化工具奠定基础。数据的大小和种类使开发一个灵活的框架成为可能，该框架可以包含从攻击中获得的尚未看到的见解。本研究为自动化（半自动化）分析大量安全攻击数据提供了可靠的方法，并开发了促进分析和检测的工具。目标是了解攻击模式，建立全面的模型来捕获攻击者的行为，并使用这些模型来开发快速检测系统恶意篡改的技术。

Despite sophisticated monitoring tools for runtime detection of intruders and techniques designed to protect computing systems from a wide range of attacks, attackers continually penetrate even well-protected systems. Attack data from real, large-scale production environments (National Center for Supercomputing Applications (NCSA) at Illinois, in this work) are used as a basis for characterizing and modeling attacker behavior and for uncovering deficiencies of the monitoring infrastructure. Increased understanding of attacks arising from these analysis and modeling activities significantly contributes to improvements in secure systems analysis and design. The analyses uncover new and realistic attack scenarios that can guide the design of enhancements to improve system protection against malicious activities at every level. Understanding real attack patterns and classes through detailed forensics pinpoints the open holes in a network/system and characterizes attacker behavior. In-depth study of the data allows investigating actions and intentions of the attacker, and creates a foundation for the design of an automated tool to assist in data collection, analysis, and response. The size and variety of the data enable a flexible framework to be developed that can incorporate insights gained from attacks yet unseen.This research produces sound methods for automated (semi-automated) analysis of large populations of data on security attacks and develops tools to facilitate the analysis and detection. The goals are to understand the attack patterns, establish comprehensive models to capture attacker behavior, and use the models to enable development of techniques for rapid detection of malicious tampering with the system.