TWC: TTP Option: Small: Collaborative: SRN: On Establishing Secure and Resilient Networking Services

几乎每个组织都依赖于基于云的服务。基于云的服务的后端是为多个租户设计的，并驻留在分布在多个物理位置的数据中心中。网络安全和安全管理是这样一个复杂的共享环境中的主要障碍。本研究通过采用移动目标防御（MTD）方法来减轻安全挑战。不断调整系统资源，如数据中心的拓扑结构、带宽分配和流量策略，使攻击者难以危及系统。将制定新的评估方法，以确保这些多边贸易体制机制在实践中正常运作。这项研究的结果是拥有更安全、更能抵御攻击的云服务。这项研究是由来自三所不同大学的研究人员合作进行的，这三所大学是亚利桑那州立大学、杜克大学和密苏里大学堪萨斯城分校。研究生将接受培训，以满足日益增长的网络安全专业教育需求。拟议研究的结果将纳入各机构教授的几门课程。多位置、多租户数据中心环境中的MTD方法需要复杂的协调级别。本研究探讨防御机制在数据中心的虚拟网络环境的基础上可编程的网络解决方案，使主动攻击对策可以部署与系统资源消耗的考虑，软件错误/漏洞，对策的有效性，并对消费者运行的应用程序的影响。研究成果可用于需要以非常细的粒度分辨率（从几毫秒到几秒）准确预测安全态势感知变量的应用程序。这带来了额外的挑战，即为网络、数据收集、支持大数据的安全处理和控制开发新的性能模型。为了应对这些挑战，该项目有两个相互依赖的基础研究方向：（a）在网络和软件层面研究动态和自适应的防御框架;以及（B）部署自适应安全-启用流量工程方法，以选择最佳对策，考虑有效性的对策和网络带宽分配，同时尽量减少入侵的应用程序和部署的成本对策该项目的成果将包括一套软件API和工具，以整合测量系统和分析模型，过渡到实践工作。

Almost every organization depends on cloud-based services. The backend of cloud-based services are designed for multiple tenants and reside in data centers spread across multiple physical locations. Network security and security management are major hurdles in such a complex, shared environment. This research investigates mitigating the security challenges by taking a moving target defense (MTD) approach. Continually adjusting the system resources such as the topology of the data center, bandwidth allocation and traffic flow policies makes it difficult for attackers to compromise the system. New evaluations methods will be developed to ensure that these MTD mechanisms work properly in practice. The outcome of this research is to have cloud services that are more secure and resilient to attacks. This research is a collaborative effort conducted by researchers from three different universities, Arizona State University, Duke University, and the University of Missouri-Kansas City. Graduate students will be trained to serve the growing need for educating professionals in cyber security. The results of the proposed research will be incorporated into several courses taught at the respective institutions. The MTD approach in a multi-location, multi-tenant data center environment requires a complex level of coordination. This research investigates defense mechanisms in the data center's virtual networking environment based on programmable networking solutions so that proactive attack countermeasures can be deployed with considerations of the system resource consumption, software bugs/vulnerabilities, effectiveness of countermeasures, and impact on consumers running applications. The research outcomes can be employed for applications that require security situation-awareness variables accurately predicted at a very fine grain resolution, from a few milliseconds to a few seconds. This introduces additional challenges, namely, developing new performance models for networking, data collection, big data-enabled security processing, and control. To address these challenges, this project has two interdependent fundamental research thrusts: (a) investigate a dynamic and adaptive defensive framework at both networking and software levels; and (b) deploy an adaptive security-enabled traffic engineering approach to select optimal countermeasures by considering the effectiveness of countermeasures and network bandwidth allocations while minimizing the intrusiveness to the applications and the cost of deploying the countermeasures. The outcomes of this project will include a set of software APIs and tools to integrate the measurement system and analytical models in a transition to practice effort.