SDCI Sec Improvement: Enhancing Bro for Operational Network Security Monitoring in Scientific Environments

近年来，在确保nsf资助的大规模计算研究网络基础设施的高可用性和完整性方面付出了巨大的努力。这个项目的目标是改进一个特定的安全组件，该组件被广泛用于保护这些NSF投资：开源的“Bro”入侵检测框架，该框架被主要大学、大型研究实验室、超级计算中心和开放科学社区部署。然而，“兄弟”的受欢迎程度是一把双刃剑，因为它带来的需求往往难以满足该系统背后的小型研究团队。因此，这项工作通过提供研究工作范围之外的明确工程资源，为Bro建立了一个可持续发展模型，并利用它们将系统推进到Bro的用户社区可以在其未来发展中发挥更积极作用的状态。更具体地说，该项目(1)通过提供广泛的最新文档和支持，改善了bro最终用户的观点，并改进了系统随着时间积累的许多粗糙的边缘；(2)统一并现代化了Bro目前的代码库，该代码库已经过14年的积极开发；(3)将Bro的处理性能提高到当前和未来大规模科学环境操作所需的程度；(4)以高度交互的图形用户界面和透明的数据库界面的形式添加新的数据分析功能。通过特别处理Broteam从用户那里收到的大部分反馈，该项目使广泛的新站点能够有效地使用Bro来保护他们的网络基础设施。

Over recent years, significant effort has gone into ensuring highavailability and integrity of NSF-funded large-scale computationalresearch cyberinfrastructure. This project targets the improvementof a particular security component that is widely used to protectthese NSF investments: the open-source "Bro" intrusion detectionframework, which is deployed by major universities, large researchlabs, supercomputing centers, and open-science communities. Bro'spopularity is a two-edged sword, however, as it comes with demandsthat are often difficult to meet for the small research team behindthe system. Therefore, this work establishes a sustainabledevelopment model for Bro by providing explicit engineeringresources outside of the scope of research efforts, and uses them toadvance the system to a state at which Bro's user community can takea more active role in its future development. More specifically, this project (1) improves the perspective ofBro's end-users by providing extensive up-to-date documentation andsupport, and refining many of the rough edges that the system hasaccumulated over time; (2) unifies and modernizes Bro's current codebase that has evolved over 14 years of active development; (3)improves Bro's processing performance to the degree required foroperation in current and future large-scale scientific environments;and (4) adds new data analysis functionality in the form of a highlyinteractive graphical user interface and a transparent databaseinterface. By specifically addressing much of the feedback the Broteam has received from users, the project enables a wide range ofnew sites to use Bro effectively for protecting theircyberinfrastructure.