NeTS: Medium: Characterizing Enterprise Networks

NeTS：媒介：表征企业网络

• 批准号: 1161799
• 负责人: Mark Allman
• 金额: $ 59.35万
• 依托单位: International Computer Science Institute
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-05-01 至 2016-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1161799&HistoricalAwards=false
• 关键词: NeTS; Medium; Characterizing; Enterprise; Networks

The Internet is a global ``network of networks,'' connecting a broad range of edge networks together into a fabric that enriches the lives and businesses of millions of people every day. Study of the Internet---from routing behavior to traffic characteristics to inferring operator policies to security properties and beyond---has blossomed over the past two decades. A large literature now exists of studies undertaken by the research community, producing much empirically-based insight into the Internet's operation. However, the edge networks that the Internet weaves together---from cellular to enterprise to residential to data center networks---have received far less empirical study. The complexity of these networks grows ever-increasing, yet our understanding has failed to keep pace.Despite their widespread use and major roles in facilitating modern economic productivity, networks at this scale have received at best fleeting examination in the research literature. Part of the issue with studying these types of networks is that general availability of analysis tools is nearly non-existent. While tools to analyze packet trace data from wide-area networks are plentiful, this is not the case for enterprise networks. For instance, there are many application layer protocols that manifest inside enterprise networks, but rarely transit the shared Internet, for which no packet trace analysis tools exist. In this project we will develop such tools in the context of the Bro intrusion detection system.These tools will form a capability that enables deep analysis of enterprise networks by the research community at-large.Intellectual merit: Enterprise networks are vastly complicated entities that have been significantly understudied by the community. This project will dramatically broaden and deepen our capability to soundly measure these critical networks.Broader impact: By building enterprise network analysis techniques directly into the open-source Bro network monitoring system, we will enable broad access to these new capabilities, aiding both researchers conducting investigations of enterprise networks, and security operators who deploy Bro to protect their networks. As Bro has hundreds of users, providing this latter group with new analysis capabilities will have a significant real-world impact on network security.

互联网是一个全球的``网络网络''，将广泛的边缘网络连接到每天丰富数百万人的生活和业务的结构中。 从路由行为到交通特征到推断运营商政策再到安全属性及以后的研究，在过去的二十年中，已经蓬勃发展。 现在，研究社区进行了大量的研究，对互联网的运作产生了许多基于经验的见解。 但是，从蜂窝到企业到居住到数据中心网络的互联网编织在一起的边缘网络已经获得了较少的经验研究。 这些网络的复杂性越来越不断增长，但是我们的理解未能保持步伐。尽管它们广泛使用并在促进现代经济生产力方面的主要作用，但这种规模的网络在研究文献中的最佳转瞬即逝。 研究这类网络的部分问题是，分析工具的一般可用性几乎不存在。 虽然分析数据包的工具从广阔的网络跟踪数据很丰富，但企业网络并非如此。 例如，有许多应用程序层协议在企业网络中表现出来，但是很少会过渡共享的Internet，因此没有数据包跟踪分析工具。 在这个项目中，我们将在BRO入侵检测系统的背景下开发此类工具。这些工具将形成一种能力，可以对研究社区进行一般性的企业网络进行深入分析。智能优点：企业网络是社区已大大研究的实体。 该项目将极大地扩展和加深我们有能力衡量这些关键网络的能力。BROADER的影响：通过将企业网络分析技术直接构建到开源BRO网络监控系统中，我们将使他们能够广泛访问这些新功能，并协助进行企业网络调查的研究人员，以及对他们部署网络保护他们网络的安全运营商的研究。 由于兄弟拥有数百个用户，因此为后一个组提供新的分析功能将对网络安全产生重大的现实影响。