MRI: Development of iSNARLD (Instrument for Situational Network Awareness for Real-time and Long-term Data)

田纳西大学(UT)与联盟技术集团(Alliance)合作，提议开发一种实时和长期数据的态势网络感知工具(ISNARLD)。开发这一独特的工具可以使网络数据包捕获与强大的分析引擎相结合，该引擎能够深入了解网络流量的特征、流量的广度、检测潜在的攻击或未经授权的数据外泄、低效或不正确行为的来源以及用户或自动流量的行为。这一工具将首次使分析能够侧重于特定的时间点(例如实时分析)，跨越几个月到几年的时间范围，或两者兼而有之。利用当前的各自优势，这一伙伴关系将极大地增强制定一项具有前所未有的能力和多功能性的有效文书的前景。此外，收集的网络流量数据和相关分析能力将提供信息，使人们能够革命性地以新的视角洞察一系列令人兴奋的新研究推动力，例如取证和入侵检测中的网络安全、实时网络状况感知、网络性能和瓶颈识别的运营研究，以及迄今为止不可能实现的其他无限可能性。因此，该项目对广泛的研究界以及整个社会都具有非同寻常的潜在影响。此外，该系统将影响国家网络基础设施和地方研究以及德克萨斯大学的教育使命。最后，通过与Alliance技术的合作，建议的系统具有广泛的商业应用前景。建议的实时和长期数据态势网络感知工具(ISNARLD)将通过其数据包捕获和令人印象深刻的分析能力从根本上改变网络和安全研究。该仪器是网络基础设施发展的下一个重要步骤，该基础设施提供高带宽和安全功能，以检测入侵并保护计算和数据资产。该仪器将建立在Alliance的20 Gb/秒哨兵250系统的基础上，有效容量高达4PB(根据特定的流量模式，足以存储数月的网络数据)。拟议的系统将提供：(1)高带宽、无损的数据包捕获；(2)元数据提取，以总结和聚合数据包数据，以实现高效分析；(3)(接近)实时数据分析，以支持对流量和性能的情景感知以及入侵检测和防止数据外泄等安全应用；(4)批量或离线分析，用于基于机器学习的发现；(5)可视化支持，以增强情景感知和网络使用洞察；以及(6)前所未有的大规模网络数据(数月至数年)用于分析。推荐的系统提供了显著改进的能力，可实时或跨数月至数年的时间段提供态势感知和了解网络使用情况，从而在广泛的网络研究、运营甚至社会科学领域提供革命性的机会。

In partnership with Alliance Technology Group (Alliance), The University of Tennessee (UT) proposes to develop an instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD). Developing this unique instrument enables network packet capture coupled with a powerful analytics engine capable of providing insights into the characteristics of network traffic, breadth of traffic flows, detection of potential attacks or unauthorized data exfiltration, sources of inefficiencies or incorrect behaviors, and the behaviors of user or automated traffic. This instrument will enable, for the first time, analysis that can focus on a specific point in time (such as for real-time analysis), across a range of time spanning months to years, or both. Leveraging the respective strengths in the current the partnership will greatly enhance the prospects for developing an effective instrument with unprecedented capabilities and versatility. Furthermore, the collected network traffic data and associated analytics capabilities will provide information enabling revolutionary new insight into a spectrum of exciting new research thrusts, such as cyber security in forensics and intrusion detection, real-time network situational awareness, operations research into network performance and bottleneck identification, as well as a limitless panoply of other possibilities that heretofore have been impossible. Ergo, the project has extraordinary potential impact on the broad research community as well as to society as a whole. Moreover, the system will impact national cyberinfrastructure and local research as well as the educational mission at UT. Finally, the proposed system has excellent prospects for wide commercial adoption through the partnership with Alliance Technology.The proposed instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD) will fundamentally transform networking and security research through its packet capture and impressive analytics capability. The instrument is the next major step in the evolution of networking infrastructure that provides high bandwidth coupled with security capabilities to detect intrusion and protect computational and data assets. The instrument will build upon a 20Gb/sec SentryWire Sentry 250 system from Alliance with an effective capacity of up to 4 PB (sufficient for months of network data, depending on specific traffic patterns). The proposed system will provide: (1) high-bandwidth, lossless packet capture; (2) metadata extraction to summarize and aggregate packet data to enable efficient analytics; (3) (near) real-time data analytics to support situational awareness of flows and performance along with security applications such as intrusion detection and prevention of data exfiltration; (4) batch or off-line analytics for machine-learning-based discovery; (5) visualization support for enhanced situational awareness and network usage insight; and (6) unprecedented scale of network data (months to years) for analysis. The proposed system presents dramatically improved capabilities for providing situational awareness and understanding network usage in real-time or across periods spanning months to years, providing revolutionary opportunities across a broad spectrum of networking research, operations, and even social science.