TC: Small: Data Driven Analysis of Security Attacks in Large Scale Systems

尽管用于运行时检测入侵者的复杂监控工具和旨在保护计算系统免受广泛攻击的技术，攻击者仍在不断渗透即使是保护良好的系统。来自真实、大规模生产环境(在本工作中是位于伊利诺伊州的国家超级计算应用中心(NCSA))的攻击数据被用作描述和建模攻击者行为以及发现监控基础设施缺陷的基础。增加对这些分析和建模活动引起的攻击的了解，大大有助于改进安全系统分析和设计。这些分析揭示了新的、现实的攻击场景，可以指导增强功能的设计，以在各个级别提高系统对恶意活动的保护。通过详细的取证了解真实的攻击模式和类别，找出网络/系统中的漏洞，并表征攻击者的行为。对数据的深入研究可以调查攻击者的行为和意图，并为设计协助数据收集、分析和响应的自动化工具奠定基础。数据的大小和多样性使得可以开发一个灵活的框架，可以结合从未知攻击中获得的见解。这项研究为自动(半自动)分析大量安全攻击数据提供了可靠的方法，并开发了促进分析和检测的工具。目标是了解攻击模式，建立全面的模型来捕获攻击者的行为，并使用这些模型来开发快速检测恶意篡改系统的技术。

Despite sophisticated monitoring tools for runtime detection of intruders and techniques designed to protect computing systems from a wide range of attacks, attackers continually penetrate even well-protected systems. Attack data from real, large-scale production environments (National Center for Supercomputing Applications (NCSA) at Illinois, in this work) are used as a basis for characterizing and modeling attacker behavior and for uncovering deficiencies of the monitoring infrastructure. Increased understanding of attacks arising from these analysis and modeling activities significantly contributes to improvements in secure systems analysis and design. The analyses uncover new and realistic attack scenarios that can guide the design of enhancements to improve system protection against malicious activities at every level. Understanding real attack patterns and classes through detailed forensics pinpoints the open holes in a network/system and characterizes attacker behavior. In-depth study of the data allows investigating actions and intentions of the attacker, and creates a foundation for the design of an automated tool to assist in data collection, analysis, and response. The size and variety of the data enable a flexible framework to be developed that can incorporate insights gained from attacks yet unseen.This research produces sound methods for automated (semi-automated) analysis of large populations of data on security attacks and develops tools to facilitate the analysis and detection. The goals are to understand the attack patterns, establish comprehensive models to capture attacker behavior, and use the models to enable development of techniques for rapid detection of malicious tampering with the system.