Exploring the Transition of Research-Derived Cyber-Threat Data

将后期网络安全研究转变为业务能力仍然是国家的优先事项。2011年和2016年的联邦网络安全研究和发展战略计划，由参与NITRD(网络和信息技术研发)计划的机构合作编写，明确将过渡到实践(TTP)确定为包括NSF在内的资助网络安全研究的联邦机构设定的目标。《2016年计划》规定，各机构应：“评估障碍并确定激励措施，以加速将经过证据验证的有效和高效的网络安全研究成果转化为采用的技术，特别是针对新兴技术和威胁。”该项目考虑了以数据馈送、提炼威胁情报或在线门户服务形式体现的大规模数据或分析结果过渡过程中的独特挑战。随着美国机构越来越重视资助数据科学和网络安全研究界的跨学科研究，这项研究既及时又重要。通过使用许多新兴的大规模可扩展机器学习技术，可以派生出新的安全应用程序。有组织的网络对手经常发动复杂的大规模攻击和恶意软件驱动的运动，目标是大型大学、研究组织、行业、国家，甚至互联网本身。现在迫切需要与网络威胁相关的深度推理应用程序，而与此同时，海量互联网数据集和数据挖掘解决方案的可用性不断增长，以利用这些数据。该提案探讨了将这种大规模数据分析的结果转化为实际使用所涉及的问题。

Transitioning later stage cybersecurity research into operational capabilities remains a national priority. Both the 2011 and 2016 Federal Cybersecurity Research and Development Strategic Plans, collaboratively authored by agencies which participate in the NITRD (Networking and Information Technology R&D) program, explicitly identify Transition to Practice (TTP) as a goal set by the Federal agencies that fund Cybersecurity research, including NSF. The 2016 Plan states that agencies should: "Assess barriers and identify incentives that could accelerate the transition of evidence-validated effective and efficient cybersecurity research results into adopted technologies, especially for emerging technologies and threats." This project considers the unique challenges in the transition of large-scale data or analytic results that are embodied as data feeds, distilled threat intelligence, or online portal services. With the growing attention by U.S. agencies in sponsoring cross-disciplinary research from the Data Science and cybersecurity research communities, the study is both timely and important.Novel security applications can be derived through the use of many newly emerging massively scalable machine learning technologies. Organized cyber-adversaries regularly mount sophisticated large-scale attacks and malware-driven campaigns that target large Universities, research organizations, industries, nations, and even the Internet itself. The dire need for deep reasoning cyber-threat-relevant applications now coincides with the growing availability of massive Internet datasets and the data mining solutions to capitalize on this data. This proposal explores the issues involved in transitioning the results of such large-scale data analytics into practical use.