TWC: Medium: Collaborative: Active Security

计算机和网络安全目前受到各种网络环境的挑战，包括云和数据中心、个人电脑和企业基础设施。这种环境的多样性与越来越复杂的攻击相结合。当今用于保护网络和计算基础设施的工具可以使用可用组件精心组合和配置，但无法自动从其环境中学习并积极保护它。本研究介绍了主动安全，这是一种对网络防御者具有根本优势的架构方法；主动安全不断地感知威胁并调整防御措施以应对这些威胁，包括那些以前未见过的威胁。主动安全原型和应用程序结合了一种新颖的高速率决策过程，避免了人工干预。该项目涉及：(1)网络“传感器”的特征，这些特征对“观察-定向-决定-行动”（OODA）循环最有用；(2)基于感知事件确定适当动作的决策和控制算法；(3)稳健可靠的系统所需的基础设施，需要最少的人机交互；(4)在各种网络设置中可行的、无伤害且可恢复的自动化防御方法；(5)主动安全系统的性能评估指标，如响应性和准确性。主动安全的核心主题是网络安全、网络传感和自动防御，自然地整合到参与机构的研究生和本科教育中，包括美国海军学院的学员和美国军事学院的学员。网络安全是整个社会越来越关注的问题，主动安全实现可以直接部署在配备可编程软件定义网络（SDN）控制器的网络上，这种技术越来越多地出现在数据中心、运营商和企业网络中。

Computer and network security is currently challenged by the need to secure diverse network environments including clouds and data-centers, PCs and enterprise infrastructures. This diversity of environments is coupled to increased attack sophistication. Today's tools for securing network and computing infrastructures can be painstakingly composed and configured using available components, but fail to automatically learn from their environment and actively protect it. This research introduces Active Security, which is an architectural approach with fundamental advantages for network defenders; Active Security continuously senses threats and adapts defenses to those threats, including those previously unseen.Active Security prototyping and applications incorporate a novel high-rate decision procedure that avoids manual intervention. The project addresses: (1) the characteristics of network 'sensors' most useful to an observe-orient-decide-act (OODA) loop; (2) decision and control algorithms for determining appropriate actions based on sensed events; (3) the infrastructure required for robust and trustworthy systems requiring minimal human-in-the-loop interaction; (4) automated defense approaches viable in diverse network settings that do no harm and are recoverable; and (5) metrics for performance assessment of an Active Security system such as responsiveness and accuracy.Active Security's central themes of network security, network sensing, and automated defenses integrate naturally into both graduate and undergraduate education at participating institutions, including both midshipmen at the United States Naval Academy and cadets at the United States Military Academy. Network security is an increasing concern for society at large, and an Active Security implementation is straightforward to deploy on networks equipped with programmable software defined networking (SDN) controllers, a technology increasingly present in data center, carrier and enterprise networks.