CIF21 DIBBs: DIBBs for Intelligence and Security Informatics Research Community

对互联网和其他关键基础设施的网络攻击越来越多，导致人们更加迫切地需要更好地了解此类入侵背后的动机和方法。该项目为情报和安全信息学(ISI)社区开发了一个研究基础设施，由计算机、信息和社会科学领域的专家组成。该基础设施由在线档案和分析工具组成。这些档案包含广泛的开源数据，包括：黑客运营的在线论坛上的讨论，用于发动计算机攻击的僵尸网络指挥和控制服务器的数据，来自经济和政治不稳定国家和地区的视频流和推文，以及新闻摘要。为该项目开发的分析工具支持一系列研究调查。社交网络分析工具使研究人员能够研究组织是如何形成的，以及人们如何在虚拟和面对面的情况下相互作用。数据可视化工具对于帮助研究人员从不同类型和不同来源的大量数据中挑选出重要的模式和趋势非常重要。一种用于敌意数据挖掘和欺骗检测的新工具使研究人员能够深化他们对网络攻击背后的意图的调查和分析。通过集成这些不同的数据源，安全研究社区可以更轻松地与社区其他成员协作、快速测试假设、评估检测技术、追踪恶意行为者并识别网络基础设施网络中的弱点。

The growing number of cyber attacks on the Internet and other critical infrastructure has led to an increased sense of urgency in developing a better understanding of the motivation and methods behind such incursions. This project develops a research infrastructure for the Intelligence and Security Informatics (ISI) community comprised of experts across the computer, information, and social sciences. The infrastructure consists of online archives and analysis tools. The archives contain a wide array of open source data including: discussions in online forums run by hackers, data from botnet command and control servers used to stage computer attacks, video streams and tweets and news summaries from economically and politically unstable states and regions. The analysis tools developed for this project support a range of research investigations. The social network analysis tool allows researchers to study how organizations form and how people interact with one another both virtually and in person. The data visualization tools are important for helping researchers pick out important patterns and trends in large sets of data of different types and from disparate sources. A new tool for adversarial data mining and deception detection allows researchers to deepen their enquiries and analysis of the intentions behind cyber-attacks. Integrating these divergent data sources allows the security research community to more easily collaborate with other members of the community, rapidly test hypotheses, evaluate detection techniques, track down malicious actors, and identify weaknesses in a cyberinfrastructure network.