TWC: Small: Understanding Network Level Malicious Activities: Classification, Community Detection and Inference of Security Interdependence

TWC：小：了解网络级恶意活动：分类、社区检测和安全依赖性推断

• 批准号: 1422211
• 负责人: Mingyan Liu
• 金额: $ 50万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1422211&HistoricalAwards=false
• 关键词: TWC; Small; Understanding; Network; Level

This goal of this project is development of a formal method to quantitatively assess the security posture of large networks and assign them a numeric score. Large networks are made up of a collection of individual machines, which exhibit more stable behavior and features as a group than at the IP level, where each host is inspected separately. Networks at an aggregate level thus carry more predictive power, enabling a more robust and accurate policy design. A large-scale statistical analysis of network data forms the basis of two sets of metrics. The first concerns a network as a standalone entity irrespective of other networks in the same ecosystem. The second concerns a network as one of many inter-connected networks. This second set is crucial due to the fact that the actions of one network affect its neighbor networks. If a network tolerates malicious behavior, its network neighbors feel the impact.This project enables network operators to design network security policies that can be meaningfully applied at a network or organizational level, for example peering arrangements between Internet Service Providers, traffic routing decisions, and incentive mechanisms (e.g., cyber insurance) aimed at encouraging better security practices and investment by organizations. The outcome of this project is thus expected to have significant impact on security and incentive policy design across the very core of the Internet.

这个项目的目标是开发一种正式的方法来定量评估大型网络的安全状况，并为它们分配一个数字分数。大型网络由一组单独的机器组成，作为一个整体，这些机器表现出比在IP级别更稳定的行为和特性，在IP级别，每个主机都是单独检查的。因此，聚合级别的网络具有更强的预测能力，从而实现更稳健和准确的策略设计。对网络数据的大规模统计分析构成了两套度量标准的基础。第一种是将网络作为一个独立的实体，与同一生态系统中的其他网络无关。第二种是将网络视为许多相互连接的网络之一。第二组是至关重要的，因为一个网络的行为会影响它的邻居网络。如果一个网络容忍恶意行为，它的网络邻居会感受到影响。该项目使网络运营商能够设计可在网络或组织层面有意义地应用的网络安全政策，例如互联网服务提供商之间的对等安排、流量路由决策和激励机制（例如，网络保险），旨在鼓励组织更好的安全实践和投资。因此，预计该项目的结果将对整个互联网核心的安全和激励政策设计产生重大影响。