NeTS: Medium: Characterizing Enterprise Networks

NeTS：媒介：表征企业网络

• 批准号: 1161799
• 负责人: Mark Allman
• 金额: $ 59.35万
• 依托单位: International Computer Science Institute
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-05-01 至 2016-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1161799&HistoricalAwards=false
• 关键词: NeTS; Medium; Characterizing; Enterprise; Networks

The Internet is a global ``network of networks,'' connecting a broad range of edge networks together into a fabric that enriches the lives and businesses of millions of people every day. Study of the Internet---from routing behavior to traffic characteristics to inferring operator policies to security properties and beyond---has blossomed over the past two decades. A large literature now exists of studies undertaken by the research community, producing much empirically-based insight into the Internet's operation. However, the edge networks that the Internet weaves together---from cellular to enterprise to residential to data center networks---have received far less empirical study. The complexity of these networks grows ever-increasing, yet our understanding has failed to keep pace.Despite their widespread use and major roles in facilitating modern economic productivity, networks at this scale have received at best fleeting examination in the research literature. Part of the issue with studying these types of networks is that general availability of analysis tools is nearly non-existent. While tools to analyze packet trace data from wide-area networks are plentiful, this is not the case for enterprise networks. For instance, there are many application layer protocols that manifest inside enterprise networks, but rarely transit the shared Internet, for which no packet trace analysis tools exist. In this project we will develop such tools in the context of the Bro intrusion detection system.These tools will form a capability that enables deep analysis of enterprise networks by the research community at-large.Intellectual merit: Enterprise networks are vastly complicated entities that have been significantly understudied by the community. This project will dramatically broaden and deepen our capability to soundly measure these critical networks.Broader impact: By building enterprise network analysis techniques directly into the open-source Bro network monitoring system, we will enable broad access to these new capabilities, aiding both researchers conducting investigations of enterprise networks, and security operators who deploy Bro to protect their networks. As Bro has hundreds of users, providing this latter group with new analysis capabilities will have a significant real-world impact on network security.

互联网是一个全球性的“网络的网络”，将广泛的边缘网络连接在一起，成为一个结构，每天丰富数百万人的生活和业务。 对互联网的研究---从路由行为到流量特征，再到推断运营商策略，再到安全属性等等---在过去的二十年里蓬勃发展。 现在有大量的研究文献，研究界进行的研究，产生了许多基于实践的洞察互联网的运作。 然而，互联网编织在一起的边缘网络--从蜂窝网络到企业网络，再到住宅网络，再到数据中心网络--所得到的实证研究要少得多。 这些网络的复杂性不断增加，但我们的理解却未能跟上步伐。尽管它们在促进现代经济生产力方面得到了广泛的应用和重要作用，但这种规模的网络在研究文献中充其量只得到了短暂的检查。 研究这些类型的网络的部分问题是，分析工具的普遍可用性几乎不存在。 虽然用于分析广域网数据包跟踪数据的工具很多，但对于企业网络来说并非如此。 例如，有许多应用层协议在企业网络中出现，但很少通过共享的互联网，因为不存在数据包跟踪分析工具。 在本项目中，我们将在Bro入侵检测系统的背景下开发此类工具。这些工具将形成一种能够让整个研究界对企业网络进行深入分析的能力。智力优点：企业网络是非常复杂的实体，社区对它的研究还很不足。 更广泛的影响：通过将企业网络分析技术直接构建到开源的Bro网络监控系统中，我们将能够广泛地访问这些新功能，帮助研究人员对企业网络进行调查，并帮助安全运营商部署Bro来保护他们的网络。 由于Bro拥有数百名用户，为后者提供新的分析功能将对网络安全产生重大的现实影响。