EAGER: USBRCCR: Improving Network Security at the Network Edge

EAGER：USBRCCR：提高网络边缘的网络安全性

• 批准号: 1740895
• 负责人: Donald Towsley
• 金额: $ 30万
• 依托单位: University of Massachusetts Amherst
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-09-01 至 2021-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1740895&HistoricalAwards=false
• 关键词: EAGER; USBRCCR; Improving; Network; Security

Recent years have seen the Internet playing an increasingly critical role in our daily lives with home networks hosting PCs, tablets, mobile devices along with more specialized devices such as smart televisions, thermostats, and other Internet-of-Things (IoT) devices. While these devices offer users an array of services and conveniences, they come at the cost of introducing security vulnerabilities into the home network. Thus users are confronted with the dual challenges of securing their networks and devices against malicious software (malware) and botnets that may perform distributed denial of service attacks on commercial and public websites and of maintaining the privacy of increasingly personal flows of data through IoT devices.This project takes a multifaceted look at the problem of securing home networks in the face of these challenges. Specifically, it includes a partnership with a Brazilian Internet Service Provider giving access to data from thousands of home network connections. This allows the creation of a baseline of network behavior against which to identify malicious behavior due to malware or compromised devices. Second, the project will develop behavior models of typical use of IoT in the wild. This will allow a better understanding of how sensitive and personal information can leak from IoT devices to IoT providers. The baseline and the IoT behavior models will lead to new methods for identifying the presence of anomalous/malicious behavior as well as leakage of privacy information. The research conducted in this project provides significant benefits to society. First, the results will allow users to enhance the security of their home networks and better protect personal and sensitive information. Second, the project will provide substantial opportunities for students to develop software and research skills along with cybersecurity skills.This project tackles the problem of securing modern home networks. The approach to this problem will be analytical and empirical. The project will consist of:(i) Development of techniques based on statistical analysis and machine learning that rely on data gathered in home networks to detect and classify malicious network activities. These techniques will focus on malicious activities both within and outside home networks.(ii) Fingerprinting of home network traffic to enable detection of compromised devices and characterization of the behavior of such devices even when flows are encrypted. (iii) Development of tools that will help users control access to their data.

近年来，互联网在我们的日常生活中发挥着越来越重要的作用，家庭网络托管着PC、平板电脑、移动设备以及更专业的设备，如智能电视、恒温器和其他物联网(IoT)设备。虽然这些设备为用户提供了一系列服务和便利，但它们的代价是将安全漏洞引入家庭网络。因此，用户面临着保护他们的网络和设备免受恶意软件(恶意软件)和僵尸网络的双重挑战，这些恶意软件和僵尸网络可能在商业和公共网站上执行分布式拒绝服务攻击，以及维护通过物联网设备越来越个人化的数据流的隐私。本项目从多个方面探讨了面对这些挑战时保护家庭网络的问题。具体地说，它包括与一家巴西互联网服务提供商合作，允许访问数千个家庭网络连接的数据。这允许创建网络行为基线，以根据该基线识别恶意软件或受危害的设备造成的恶意行为。其次，该项目将开发物联网在野外的典型使用行为模型。这将使我们能够更好地了解敏感和个人信息如何从物联网设备泄露到物联网提供商。基准和物联网行为模型将带来识别异常/恶意行为以及隐私信息泄露的新方法。该项目所进行的研究为社会带来了显著的效益。首先，结果将允许用户增强其家庭网络的安全性，并更好地保护个人和敏感信息。其次，该项目将为学生提供大量机会来开发软件和研究技能，以及网络安全技能。该项目解决了现代家庭网络安全的问题。解决这个问题的方法将是分析性的和经验性的。该项目将包括：(1)开发基于统计分析和机器学习的技术，依靠在家庭网络中收集的数据来检测和分类恶意网络活动。这些技术将集中于家庭网络内部和外部的恶意活动。(Ii)家庭网络流量的指纹识别，以实现对受攻击设备的检测，并即使在流被加密时也能表征此类设备的行为。(3)开发工具，帮助用户控制对其数据的访问。

项目成果

A large-scale analysis of deployed traffic differentiation practices

• DOI: 10.1145/3341302.3342092
• 发表时间: 2019-08
• 期刊: Proceedings of the ACM Special Interest Group on Data Communication
• 作者: Fangfan Li;Arian Akhavan Niaki;D. Choffnes;Phillipa Gill;A. Mislove

Network anomaly detection based on tensor decomposition

基于张量分解的网络异常检测

• DOI: 10.1016/j.comnet.2021.108503
• 发表时间: 2021
• 期刊: Computer Networks
• 影响因子: 5.6
• 作者: Streit, Ananda;Santos, Gustavo H.A.;Leão, Rosa M.M.;de Souza e Silva, Edmundo;Menasché, Daniel;Towsley, Don
• 通讯作者: Towsley, Don

Fundamental scaling laws of covert DDoS attacks

隐蔽 DDoS 攻击的基本扩展法则

• DOI: 10.1016/j.peva.2021.102236
• 发表时间: 2021
• 期刊: Performance Evaluation
• 影响因子: 2.2
• 作者: Ramtin, Amir Reza;Nain, Philippe;Menasche, Daniel Sadoc;Towsley, Don;de Souza e Silva, Edmundo
• 通讯作者: de Souza e Silva, Edmundo

Characterizing the Deployment and Performance of Multi-CDNs

• DOI: 10.1145/3278532.3278548
• 发表时间: 2018-10
• 期刊: Proceedings of the Internet Measurement Conference 2018
• 作者: Rachee Singh;Arun Dunna;Phillipa Gill

Are Covert DDoS Attacks Facing Multi-Feature Detectors Feasible?

面对多功能检测器的隐蔽 DDoS 攻击是否可行？

• 发表时间: 2021
• 期刊: Proceedings of 2021 ACM SIGMETRICS MAMA Workshop
• 作者: Ramtin, Amir Rezae;Towsley, Don;Nain, Philippe;de Souza e Silva, Edmundo;Menasche, Daniel Sadoc
• 通讯作者: Menasche, Daniel Sadoc