SaTC: TTP: Small: STINGAR - Deployment of highly automated, reliable, and fast cybersecurity threat response systems

现代网络安全攻击通常是通过自动化的“机器人”或代理程序进行的，这些机器人或代理程序在几分钟内大规模系统地攻击网络。 这使得组织争先恐后地应对必须首先由人类验证或制定的防御措施，因此需要时间来安装。 机构再也不能用我们较慢的，有时容易出错的模拟（基于人类的）响应来对抗这些强大而快速的数字攻击。 相反，该项目利用其独特的数字保护形式（自动化和可扩展）来实现对传入恶意流量的实时阻止。该项目团队试图将一个已在杜克大学成功使用两年的系统扩展到其他大学、学院和区域网络，特别关注少数民族服务和较小的学院和大学的可用性，这些学院和大学的信息技术（IT）和安全人员可能缺乏时间或专业知识来开发类似的保护或购买昂贵的商业工具。该项目已经开发的工具套件利用了一系列“传感器”和“执行器”，可以自动阻止某些类型的恶意流量，从而提高网络安全威胁响应的速度、规模和可靠性。本项目将这些工具从杜克转移到北卡罗来纳州中央大学（NCCU）的生产使用，旨在确认其可用性并确保在杜克获得的价值在其他地方可重现。 然后，该项目将覆盖范围扩大到其他大学、学院和区域网络。 该项目包括在参与大学之间共享数据的机制，从而“众包”任何一个校园的主动攻击的意识，使所有其他校园可以主动制定保护之前，他们成为同样的攻击的受害者。该奖项反映了NSF的法定使命，并已被认为是值得支持的评估使用基金会的智力价值和更广泛的影响审查标准。

Modern cybersecurity attacks are often carried out through automated "bots" or agents that systematically attack networks, at scale and in a matter of minutes. This has left organizations scrambling to respond with defenses that must first be validated or enacted by humans, and so take time to mount. Institutions can no longer afford to combat these powerful and rapid digital attacks with our slower and sometimes error-prone analog (human-based) responses. Instead, this project utilizes its own distinctive form of digital protections - which are both automated and scalable - to implement real-time blocks of incoming malicious traffic. The project team seeks to extend a system that has been used successfully for two years at Duke University to other universities, colleges and regional networks with special attention on usability by minority-serving and smaller colleges and universities, where Information Technology (IT) and security personnel may lack the time or expertise to develop similar protections or purchase expensive commercial tools. The suite of tools that the project has already developed utilizes a series of "sensors" and "actuators," which automatically block certain types of malicious traffic and as a result improve the speed, scale, and reliability of cybersecurity threat responses. This project transitions these tools from Duke to production use at North Carolina Central University (NCCU), with the intention of confirming their usability and ensuring the value derived at Duke is reproducible elsewhere. Then, the project expands coverage to other universities, colleges, and regional networks. The project includes mechanisms to share data among participating universities, thereby "crowdsourcing" awareness of an active attack on any one campus, so that all other campus may proactively enact protections before they fall victim to the same attack.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.