TWC: Small: Developing Advanced Digital Forensic Tools Based on Network Stack Side Channels

TWC：小型：开发基于网络堆栈侧通道的高级数字取证工具

• 批准号: 1420716
• 负责人: Jedidiah Crandall
• 金额: $ 45.8万
• 依托单位: University of New Mexico
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-08-01 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1420716&HistoricalAwards=false
• 关键词: TWC; Small; Developing; Advanced; Digital

This project is developing the next generation of network measurement tools for penetration testers, digital forensics experts, and other cybersecurity professionals who sometimes need to know more about the Internet or a specific network. It is developing techniques based on TCP/IP side channel inferences, where it is possible to infer something about a remote machine's view of the network based on the use of shared, limited resources. Because of this, the tools being developed as part of this project are able to overcome fundamental limitations of existing tools such as traceroute and nmap. For example, traceroute cannot detect tunnels along a path because it can only see the network from the perspective of the machine on which traceroute is running, whereas the methods being developed here can infer maximum transmission units bidirectionally at every hop and thus provide some information about potential tunnels. This is important because criminals often use tunnels to hide their illicit online activities.The research team plans to release all tools developed by this project under an open source license, so that there will be a paradigm shift in how cybersecurity practitioners conduct their jobs. TCP/IP side channels have the potential to change the science of Internet and network measurement in a fundamental way.

该项目正在为渗透测试人员、数字取证专家和其他网络安全专业人员开发下一代网络测量工具，他们有时需要更多地了解互联网或特定网络。它正在开发基于TCP/IP侧通道推断的技术，在这种技术中，可以根据共享的有限资源的使用推断远程机器对网络的看法。正因为如此，作为该项目的一部分开发的工具能够克服现有工具（如traceroute和nmap）的基本限制。例如，traceroute不能沿着路径检测隧道，因为它只能从运行traceroute的机器的角度来观察网络，而这里开发的方法可以在每一跳上双向推断最大传输单元，从而提供一些关于潜在隧道的信息。这一点很重要，因为犯罪分子经常使用隧道来隐藏他们的非法在线活动。研究团队计划在开源许可下发布该项目开发的所有工具，以便网络安全从业者如何开展工作的模式发生转变。TCP/IP侧通道有可能从根本上改变互联网和网络测量科学。