CC*DNI Integration (Area 4): Application Aware Software-Defined Networks for Secure Cloud Services (SecureCloud)

应用感知、软件定义的安全云服务网络（SecureCloud）项目为云计算网络设计和构建创新的网络基础设施，在不降低网络性能的情况下增强数据安全性。随着云计算的出现，新的高度复杂的网络安全威胁不断增长，并使国家网络安全基础设施面临风险，SecureCloud是对这些威胁的回应。网络攻击是近期一系列问题的罪魁祸首，从窃取个人信息、干扰金融交易，到威胁国家安全和政府运作。SecureCloud正在研究1)如何最大限度地减少多组件恶意软件渗透的影响，2)如何提高威胁可见性和响应时间。该项目开发、测试和部署在整个云基础设施中实现的全自动安全系统。该系统在Marist学院的软件定义网络（SDN）测试平台上进行原型设计，并首先在区域和纽约州范围内的网络中投入生产。SecureCloud使用SDN动态重新分配网络资源，以应对即将发生的攻击。该基础设施包括虚拟网络功能的控制，如虚拟路由器/防火墙组合，城域网中的流量隔离，以及使用网络流量分析从其他数据源集成威胁情报。总体目标是1)启用新的网络功能，以保护网络免受恶意软件和拒绝服务攻击；2)提高对安全威胁的可见性和响应时间，3)隔离受感染的计算机，以及4)向社区贡献新的开源软件，以便与广泛的应用程序集成。

The Application-Aware, Software-Defined Networks for Secure Cloud Services (SecureCloud) project designs and builds an innovative cyberinfrastructure for cloud computing networks and enhancing data security without degrading network performance. SecureCloud is a response to the growth of new, highly sophisticated cybersecurity threats that have accompanied the emergence of cloud computing and placed national cybersecurity infrastructure at risk. Cyber attacks are responsible for a range of recent problems ranging from theft of personal information and interfering with financial transactions to threatening national security and government operations.SecureCloud is studying 1) how to minimize the impact of multi-component malware infiltration and 2) how to improve threat visibility and response time. The project develops, tests, and deploys a fully automated security system that is implemented throughout the cloud infrastructure. The system is prototyped in a software-defined networking (SDN) test bed at Marist College, and first deployed into production across regional and New York State-wide networks. SecureCloud uses SDN to dynamically re-provision network resources in response to impending attacks. The infrastructure includes control of virtual network functions such as virtual router/firewall combinations, traffic flow segregation in metropolitan area networks, and integration of threat intelligence from other data sources using network traffic analytics. The overarching goals are to 1) enable new network functionality to protect networks from malware and denial of service attacks; 2) improve visibility and response time to security threats, 3) quarantine infected computers, and 4) contribute new open source software to the community for integration with a wide range of applications.