SDCI Sec Improvement: Enhancing Bro for Operational Network Security Monitoring in Scientific Environments

点击翻译按钮获取中文摘要

Over recent years, significant effort has gone into ensuring highavailability and integrity of NSF-funded large-scale computationalresearch cyberinfrastructure. This project targets the improvementof a particular security component that is widely used to protectthese NSF investments: the open-source "Bro" intrusion detectionframework, which is deployed by major universities, large researchlabs, supercomputing centers, and open-science communities. Bro'spopularity is a two-edged sword, however, as it comes with demandsthat are often difficult to meet for the small research team behindthe system. Therefore, this work establishes a sustainabledevelopment model for Bro by providing explicit engineeringresources outside of the scope of research efforts, and uses them toadvance the system to a state at which Bro's user community can takea more active role in its future development. More specifically, this project (1) improves the perspective ofBro's end-users by providing extensive up-to-date documentation andsupport, and refining many of the rough edges that the system hasaccumulated over time; (2) unifies and modernizes Bro's current codebase that has evolved over 14 years of active development; (3)improves Bro's processing performance to the degree required foroperation in current and future large-scale scientific environments;and (4) adds new data analysis functionality in the form of a highlyinteractive graphical user interface and a transparent databaseinterface. By specifically addressing much of the feedback the Broteam has received from users, the project enables a wide range ofnew sites to use Bro effectively for protecting theircyberinfrastructure.