CIF21 DIBBs: DIBBs for Intelligence and Security Informatics Research Community

对因特网和其他关键基础设施的网络攻击日益增多，使人们更加迫切地需要更好地了解这种入侵背后的动机和方法。该项目为情报和安全信息学（ISI）社区开发了一个研究基础设施，该社区由计算机，信息和社会科学的专家组成。基础设施包括在线档案和分析工具。这些档案包含了大量的开源数据，包括：黑客运行的在线论坛中的讨论，用于发动计算机攻击的僵尸网络命令和控制服务器的数据，来自经济和政治不稳定国家和地区的视频流和推文以及新闻摘要。为该项目开发的分析工具支持一系列研究调查。社交网络分析工具允许研究人员研究组织如何形成以及人们如何在虚拟和面对面的情况下相互交流。数据可视化工具对于帮助研究人员从不同类型和不同来源的大量数据中挑选重要模式和趋势非常重要。一种用于对抗性数据挖掘和欺骗检测的新工具使研究人员能够深入调查和分析网络攻击背后的意图。整合这些不同的数据源使安全研究社区能够更轻松地与社区的其他成员合作，快速测试假设，评估检测技术，追踪恶意行为者，并识别网络基础设施网络中的弱点。

The growing number of cyber attacks on the Internet and other critical infrastructure has led to an increased sense of urgency in developing a better understanding of the motivation and methods behind such incursions. This project develops a research infrastructure for the Intelligence and Security Informatics (ISI) community comprised of experts across the computer, information, and social sciences. The infrastructure consists of online archives and analysis tools. The archives contain a wide array of open source data including: discussions in online forums run by hackers, data from botnet command and control servers used to stage computer attacks, video streams and tweets and news summaries from economically and politically unstable states and regions. The analysis tools developed for this project support a range of research investigations. The social network analysis tool allows researchers to study how organizations form and how people interact with one another both virtually and in person. The data visualization tools are important for helping researchers pick out important patterns and trends in large sets of data of different types and from disparate sources. A new tool for adversarial data mining and deception detection allows researchers to deepen their enquiries and analysis of the intentions behind cyber-attacks. Integrating these divergent data sources allows the security research community to more easily collaborate with other members of the community, rapidly test hypotheses, evaluate detection techniques, track down malicious actors, and identify weaknesses in a cyberinfrastructure network.