CAREER: A Timing Approach to Network Forensics

点击翻译按钮获取中文摘要

Abstract:Providing cyber security against attackers who penetrate the network, insider attackers, and non-malicious user errors or equipment failures is a formidable challenge for the scientific community. The investigator addresses problems in the area of network forensics that arise in packet-based communication of information. A key feature of the research approach is the use of timing as an under-utilized degree of freedom that provides rich statistical structure about the information dynamics. Using timing modality for performing network forensics has the advantage that it will not excessively perturb normal operation in packet networks where the information exchange is achieved via packet contents. A novelty of this research is the inclusion of causal inference. Human judgments about the likelihood of events and dependencies among variables is strongly influenced by the perception of cause-effect relationships. To extend the same decision making power, a man-made system must acquire the ability to process cause-effect relationships, rather than only assessing questions of statistical dependence. PI's objective is to understand causal influences between network flows using the timing modality. The PI will embark on an ambitious multidisciplinary research program that targets both theoretical and practical fundamental problems in security. The main research endeavors undertaken by the PI are: (1) analysis and mitigation of queuing timing side channels that arise in presence of shared resources; (2) develop of causal inference metrics and algorithms for complex networks; (3) design of efficient compression and storage approaches for network flows using good compression codes for point processes; (4) design of network flow watermarks that will be inserted in packet timings and serve the dual purpose of providing data integrity as well as a means for network inference.