CICI: CE: Implementing CYBEX-P: Helping Organizations to Share with Privacy Preservation

CICI：CE：实施CYBEX-P：帮助组织共享隐私保护

• 批准号: 1739032
• 负责人: Shamik Sengupta
• 金额: $ 98.61万
• 依托单位: Board of Regents, NSHE, obo University of Nevada, Reno
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2018
• 资助国家: 美国
• 起止时间: 2018-01-01 至 2021-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1739032&HistoricalAwards=false
• 关键词: CICI; CE; Implementing; CYBEX; Helping

In response to the increasing number of attacks on cyberspace, public and private organizations are encouraged to share their cyber-threat information and data with each other. Although there are long-term interests in sharing security related information, it places organizations at risk regarding the protection of their data and exposure of other vulnerabilities. This project designs, develops and implements a CYBersecurity information EXchange with Privacy (CYBEX-P) platform using trusted computing paradigms and privacy-preserving information sharing mechanisms for cybersecurity enhancement and development of a robust cyberinfrastructure. The outcome of this project has a broader impact on the development of a novel cybersecurity information-sharing platform with privacy preservation and a robust governance structure. The project also has direct impact on undergraduate and graduate student education and training, emphasizing the engineering development of minorities and women, by providing a real-world platform for investigation and management of cyber threats.Envisioning that effective and privacy-preserving threat intelligence sharing can be instrumental for auditing the state of the threat landscape and helping to predict and prevent major cyber-attacks, this project provides a service for structured information exchange. The CYBEX-P platform provides valuable measurable information about the security status of systems and devices together with data about incidents stemming from cyber-attacks. To develop and implement such an environment across statewide organizations, then across the nation, this research project incorporates blind processing, privacy preservation and integrity of shared incident data by ensuring that only trusted processes access the raw data and only anonymized data are shared with other operators. Blind processing enables the advantages of additional information exchange while respecting organizational constraints and trust boundaries. This research also establishes a flexible governance framework that includes both policies and procedures to protect the data and provide all customers with the tools to demonstrate they are complying with both regulatory and internal data governance requirements. Specifically, the outcomes of the project demonstrate: i) CYBEX-P infrastructure development with affordable scalability, secure data exchange, and analytic components, ii) Privacy-preserving information sharing via blind processing and anonymization, and an iii) CYBEX-P governance framework.

为应对网络空间受到的越来越多的攻击，鼓励公共和私营组织相互分享其网络威胁信息和数据。虽然共享安全相关信息具有长期利益，但它使组织在保护其数据和暴露其他漏洞方面面临风险。该项目设计、开发和实施了一个网络安全信息隐私交换（CYBEX-P）平台，该平台使用可信计算模式和隐私保护信息共享机制，以加强网络安全并发展强大的网络基础设施。该项目的成果对开发一个具有隐私保护和强大治理结构的新型网络安全信息共享平台产生了广泛影响。该项目还对本科生和研究生的教育和培训产生直接影响，强调少数民族和妇女的工程发展，为网络威胁的调查和管理提供一个现实世界的平台。设想有效和保护隐私的威胁情报共享有助于审计威胁状况，并有助于预测和预防重大网络攻击，该项目提供有组织的信息交流服务。CYBEX-P平台提供有关系统和设备安全状态的宝贵可衡量信息，以及有关网络攻击事件的数据。为了在全州范围内的组织中开发和实施这样的环境，然后在全国范围内，该研究项目通过确保只有受信任的过程才能访问原始数据，并且只有匿名数据才与其他运营商共享，从而结合了盲处理，隐私保护和共享事件数据的完整性。盲处理在尊重组织约束和信任边界的同时，实现了额外信息交换的优势。这项研究还建立了一个灵活的治理框架，其中包括保护数据的政策和程序，并为所有客户提供工具，以证明他们遵守监管和内部数据治理要求。具体而言，该项目的成果表明：i）CYBEX-P基础设施开发具有可负担的可扩展性，安全的数据交换和分析组件，ii）通过盲处理和匿名化保护隐私的信息共享，以及iii）CYBEX-P治理框架。

项目成果

Correlation of Cyber Threat Intelligence Data Across Global Honeypots

全球蜜罐网络威胁情报数据的关联

• DOI: 10.1109/ccwc51732.2021.9376038
• 发表时间: 2021
• 作者: Thom, Jay;Shah, Yash;Sengupta, Shamik
• 通讯作者: Sengupta, Shamik

A System Architecture of Cybersecurity Information Exchange with Privacy (CYBEX-P)

具有隐私性的网络安全信息交换系统架构（CYBEX-P）

• DOI: 10.1109/ccwc.2019.8666600
• 发表时间: 2019
• 期刊: 2019 IEEE 9th Annual Computing and Communication Workshop and Conference (CCWC
• 作者: Sadique, Farhan;Bakhshaliyev, Khalid;Springer, Jeff;Sengupta, Shamik
• 通讯作者: Sengupta, Shamik

Automated Structured Threat Information Expression (STIX) Document Generation with Privacy Preservation

具有隐私保护功能的自动结构化威胁信息表达 (STIX) 文档生成

• DOI: 10.1109/uemcon.2018.8796822
• 发表时间: 2018
• 期刊: Electronics & Mobile Communication Conference (UEMCON
• 作者: Sadique, Farhan;Cheung, Sui;Vakilinia, Iman;Badsha, Shahriar;Sengupta, Shamik
• 通讯作者: Sengupta, Shamik

Friend or Foe: Discerning Benign vs Malicious Software and Malware Family

• DOI: 10.1109/globecom46510.2021.9685415
• 发表时间: 2021-12
• 期刊: 2021 IEEE Global Communications Conference (GLOBECOM)
• 作者: Aaron Walker;Tapadhir Das;R. Shukla;S. Sengupta

Analysis of Attacker Behavior in Compromised Hosts During Command and Control

命令和控制过程中受感染主机的攻击者行为分析

• DOI: 10.1109/icc42927.2021.9500859
• 发表时间: 2021
• 作者: Sadique, Farhan;Sengupta, Shamik
• 通讯作者: Sengupta, Shamik