MRI: Development of iSNARLD (Instrument for Situational Network Awareness for Real-time and Long-term Data)

MRI：iSNARLD（实时和长期数据情境网络感知工具）的开发

• 批准号: 1626338
• 负责人: Gregory Peterson
• 金额: $ 82.21万
• 依托单位: University of Tennessee Knoxville
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2020-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1626338&HistoricalAwards=false
• 关键词: MRI; Development; iSNARLD; Instrument; Situational

In partnership with Alliance Technology Group (Alliance), The University of Tennessee (UT) proposes to develop an instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD). Developing this unique instrument enables network packet capture coupled with a powerful analytics engine capable of providing insights into the characteristics of network traffic, breadth of traffic flows, detection of potential attacks or unauthorized data exfiltration, sources of inefficiencies or incorrect behaviors, and the behaviors of user or automated traffic. This instrument will enable, for the first time, analysis that can focus on a specific point in time (such as for real-time analysis), across a range of time spanning months to years, or both. Leveraging the respective strengths in the current the partnership will greatly enhance the prospects for developing an effective instrument with unprecedented capabilities and versatility. Furthermore, the collected network traffic data and associated analytics capabilities will provide information enabling revolutionary new insight into a spectrum of exciting new research thrusts, such as cyber security in forensics and intrusion detection, real-time network situational awareness, operations research into network performance and bottleneck identification, as well as a limitless panoply of other possibilities that heretofore have been impossible. Ergo, the project has extraordinary potential impact on the broad research community as well as to society as a whole. Moreover, the system will impact national cyberinfrastructure and local research as well as the educational mission at UT. Finally, the proposed system has excellent prospects for wide commercial adoption through the partnership with Alliance Technology.The proposed instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD) will fundamentally transform networking and security research through its packet capture and impressive analytics capability. The instrument is the next major step in the evolution of networking infrastructure that provides high bandwidth coupled with security capabilities to detect intrusion and protect computational and data assets. The instrument will build upon a 20Gb/sec SentryWire Sentry 250 system from Alliance with an effective capacity of up to 4 PB (sufficient for months of network data, depending on specific traffic patterns). The proposed system will provide: (1) high-bandwidth, lossless packet capture; (2) metadata extraction to summarize and aggregate packet data to enable efficient analytics; (3) (near) real-time data analytics to support situational awareness of flows and performance along with security applications such as intrusion detection and prevention of data exfiltration; (4) batch or off-line analytics for machine-learning-based discovery; (5) visualization support for enhanced situational awareness and network usage insight; and (6) unprecedented scale of network data (months to years) for analysis. The proposed system presents dramatically improved capabilities for providing situational awareness and understanding network usage in real-time or across periods spanning months to years, providing revolutionary opportunities across a broad spectrum of networking research, operations, and even social science.

田纳西大学（UT）与联盟技术集团（Alliance Technology Group）合作，提议开发一种实时和长期数据情境网络感知工具（iSNARLD）。开发这种独特的工具可以实现网络数据包捕获，并结合强大的分析引擎，能够深入了解网络流量的特征、流量流量的广度、潜在攻击或未经授权的数据泄露的检测、效率低下或不正确行为的来源以及用户或自动流量的行为。这一工具将首次实现分析，可以集中在一个特定的时间点（如实时分析），跨越几个月到几年的时间范围，或两者兼而有之。利用目前各自的优势，这一伙伴关系将大大增强开发一个具有前所未有的能力和多功能性的有效工具的前景。此外，收集的网络流量数据和相关的分析能力将提供信息，使人们能够对一系列令人兴奋的新研究重点进行革命性的新见解，例如取证和入侵检测中的网络安全，实时网络态势感知，对网络性能和瓶颈识别的运营研究，以及迄今为止不可能实现的其他无限可能性。因此，该项目对广泛的研究界以及整个社会具有非凡的潜在影响。此外，该系统将影响国家网络基础设施和地方研究以及UT的教育使命。最后，通过与Alliance Technology的合作，该系统具有广泛的商业应用前景。该仪器用于实时和长期数据的情景网络感知（iSNARLD），将通过其数据包捕获和令人印象深刻的分析能力从根本上改变网络和安全研究。该仪器是网络基础设施发展的下一个重要步骤，提供高带宽和安全功能，以检测入侵并保护计算和数据资产。该仪器将基于Alliance的20Gb/sec SentryWire Sentry 250系统，有效容量高达4 PB（根据特定的流量模式，足以存储数月的网络数据）。拟议的系统将提供：（1）高带宽、无损的数据包捕获;（2）元数据提取，以汇总和聚合数据包数据，从而能够进行有效的分析;（3）（近）实时数据分析，以支持对流量和性能的态势感知，并沿着安全应用，如入侵检测和防止数据泄露;（4）用于基于机器学习的发现的批处理或离线分析;（5）用于增强态势感知和网络使用洞察的可视化支持;以及（6）用于分析的前所未有的网络数据规模（数月至数年）。拟议的系统提供了显着改进的能力，可实时或跨数月至数年的时间段提供态势感知和了解网络使用情况，为广泛的网络研究，运营甚至社会科学提供革命性的机会。