SaTC: CORE: Small: Collaborative: An Integrated Approach for Enterprise Intrusion-Resilience

最近先进的网络攻击盛行，导致企业入侵，在国防、制造业和金融业等关键行业造成严重后果。目前的防御做法依赖于攻击预防和检测技术，但我们严重缺乏对这些安全工具抵御真正高级威胁的能力的了解，这些威胁的复杂性迅速增长。该项目寻求通过系统地设计新的多层抗入侵框架来加强企业安全，以抵御高级威胁，该框架解决了单个企业的防御以及基于社区的全球保护。总体而言，该项目的重点是教育活动、对代表性不足的少数群体的外联和向行业转让技术，旨在为安全界提供一种新的整体防御方法，以加强我们国家基础设施的安全立场。该项目开发了一个新的企业入侵防御框架，该框架：(1)保护个人资产和整个企业；(2)通过设计本身对入侵具有弹性的安全工具来适应攻击者的策略；以及(3)促进跨企业和行业的新的协调保护，同时保护共享数据的隐私。这些解决方案利用密码学、博弈论建模和基于社区的防御，针对高级威胁提供强大的入侵恢复能力。调查人员计划积极与安全行业接触，在实际环境中评估他们的技术，并就保护我们国家基础设施的当地和协调防御战略提出具体建议。通过教育学生和网络专业人员，以及向社区开展一系列外展活动，该项目旨在提高人们对新出现的攻击技术和成功缓解未来网络攻击的最佳主动防御措施的认识。

The recent prevalence of advanced cyber attacks has caused enterprise breaches with severe consequences in critical sectors, such as national defense, manufacturing and the financial industry. Current defense practices rely on attack prevention and detection technologies, but our understanding of the capabilities of these security tools against truly advanced threats, which rapidly grow in sophistication, is severely lacking. This project seeks to harden enterprise security against advanced threats by systematically designing a new multi-layer intrusion-resilient framework that addresses individual enterprise defenses, as well as global, community-based protections. Overall, with a focus on educational activities, outreach to under-represented minority groups and technology transfer to industry, this project aims at contributing a new holistic defense approach to the security community that increases the security stance of our national infrastructures. This project develops a new framework for enterprise intrusion resilience that: (1) protects both individual assets and enterprises as a whole; (2) adapts to attacker's strategies by devising security tools that are themselves resilient to breaches; and (3) promotes new coordinated protections across enterprises and industry sectors while protecting the privacy of shared data. These solutions leverage cryptography, game-theoretical modeling, and community-based defenses to provide strong intrusion resilience against advanced threats. The investigators plan to engage actively with the security industry to evaluate their techniques in practical settings and provide concrete recommendations on local and coordinated defensive strategies for protecting our national infrastructures. By educating students and cyber professionals, as well as conducting a range of outreach activities to the community, this project seeks to increase awareness of emerging attack techniques and best proactive defenses for successfully mitigating the cyber attacks of the future.