Exploring the Transition of Research-Derived Cyber-Threat Data

将后期网络安全研究转化为行动能力仍然是国家的优先事项。2011年和2016年联邦网络安全研究和发展战略计划，由参与NITRD（网络和信息技术研发）计划的机构合作撰写，明确将过渡到实践（TTP）作为资助网络安全研究的联邦机构（包括NSF）设定的目标。2016年计划指出，各机构应：“评估障碍并确定激励措施，以加速将经证据验证的有效和高效的网络安全研究成果转化为已采用的技术，特别是针对新兴技术和威胁。该项目考虑了大规模数据或分析结果转换过程中的独特挑战，这些数据或分析结果体现为数据馈送、提炼的威胁情报或在线门户服务。随着美国机构越来越关注赞助数据科学和网络安全研究社区的跨学科研究，这项研究既及时又重要。通过使用许多新兴的大规模可扩展机器学习技术，可以获得新的安全应用。有组织的网络对手经常发起复杂的大规模攻击和恶意软件驱动的活动，目标是大型大学，研究机构，行业，国家甚至互联网本身。对深度推理网络威胁相关应用程序的迫切需求与海量互联网数据集和利用这些数据的数据挖掘解决方案的日益可用性相吻合。该提案探讨了将这种大规模数据分析的结果转化为实际应用所涉及的问题。

Transitioning later stage cybersecurity research into operational capabilities remains a national priority. Both the 2011 and 2016 Federal Cybersecurity Research and Development Strategic Plans, collaboratively authored by agencies which participate in the NITRD (Networking and Information Technology R&D) program, explicitly identify Transition to Practice (TTP) as a goal set by the Federal agencies that fund Cybersecurity research, including NSF. The 2016 Plan states that agencies should: "Assess barriers and identify incentives that could accelerate the transition of evidence-validated effective and efficient cybersecurity research results into adopted technologies, especially for emerging technologies and threats." This project considers the unique challenges in the transition of large-scale data or analytic results that are embodied as data feeds, distilled threat intelligence, or online portal services. With the growing attention by U.S. agencies in sponsoring cross-disciplinary research from the Data Science and cybersecurity research communities, the study is both timely and important.Novel security applications can be derived through the use of many newly emerging massively scalable machine learning technologies. Organized cyber-adversaries regularly mount sophisticated large-scale attacks and malware-driven campaigns that target large Universities, research organizations, industries, nations, and even the Internet itself. The dire need for deep reasoning cyber-threat-relevant applications now coincides with the growing availability of massive Internet datasets and the data mining solutions to capitalize on this data. This proposal explores the issues involved in transitioning the results of such large-scale data analytics into practical use.