TC: Medium: Collaborative Research: Tracking Adversarial Behavior in Distributed Systems with Secure Networked Provenance

网络和分布式系统的操作员经常发现自己需要回答诊断或取证问题--系统的某个部分被发现处于意外状态，操作员必须确定该状态是合法的还是秘密攻击的症状。在这种情况下，要求系统对观察到的状态进行“解释”将是有用的。在没有攻击的情况下，新兴的网络起源技术可以通过构建将观察到的状态与其根本原因联系起来的事件链来构建这样的解释。但是，攻击者可以使他控制的节点伪造或隐藏信息，从而产生貌似合理(但不正确)的解释。因此，运营商可能没有注意到攻击。这项研究开发了安全的网络起源技术，即使在系统受到强大对手的攻击时，也可以提供有用的解释。该项目(I)通过增加取证环境所需的功能，极大地扩展和推广了网络来源的概念；(Ii)开发了在没有任何可信组件的情况下安全存储来源的技术；(Iii)设计了有效查询安全来源的方法；(Iv)介绍了保护来源机密性的方法；以及(V)在具体应用的背景下评估了这些技术。该项目的来源和取证的主题与宾夕法尼亚大学新的市场和社会系统工程本科课程相结合。它将为各种分布式应用程序提供取证支持，包括关键基础设施可能很快建立在其上的新兴云应用程序。

Operators of networks and distributed systems often find themselves needing to answer a diagnostic or forensic question -- some part of the system is found to be in an unexpected state, and the operators must decide whether the state is legitimate or a symptom of a clandestine attack. In such cases, it would be useful to ask the system for an 'explanation' of the observed state. In the absence of attacks, emerging network provenance techniques can construct such explanations by constructing a chain of events that links the observed state to its root causes. However, an attacker can cause the nodes under his control to forge or suppress information and thus produce a plausible (but incorrect) explanation. As a result, the operators may fail to notice the attack.This research develops secure network provenance techniques that can provide useful explanations even when the system is under attack by a powerful adversary. The project (i) substantially extends and generalizes the concept of network provenance by adding capabilities needed in a forensic setting; (ii) develops techniques for securely storing provenance without any trusted components; (iii) designs methods for efficiently querying secure provenance; (iv) introduces methods for protecting the confidentiality of provenance; and (v) evaluates these techniques in the context of concrete applications.The project's theme of provenance and forensics is integrated with Penn's new undergraduate program in Market and Social Systems Engineering. It will provide forensics support for a wide variety of distributed applications, including emerging cloud applications upon which critical infrastructure may soon be based.