ATD: Collaborative Research: Extremal Dependence and Change-Point Detection Methods for High-Dimensional Data Streams with Applications to Network Cybersecurity

该项目的动机是，需要开发先进的网络监测工具，再加上自动统计方法，以快速检测由于持续攻击或即将发生的网络安全威胁而导致的互联网流量异常。重点放在检测网络安全威胁，如高度分布式的恶意软件感染，它可以对国家的互联网基础设施发起协调和破坏性的分布式拒绝服务攻击。 这将通过研究所谓的暗网流量数据来实现。网络中的恶意行为者系统地探测互联网空间，寻找易受攻击或配置错误的设备。在这样做时，它们会自动将数据发送到整个互联网地址空间，其中包括未使用的互联网地址空间。这种无处可去的流量表示恶意软件感染尝试或隐形漏洞扫描。 调查人员的目标是开发和部署专门的工具，使网络安全分析师能够有效地分析暗网流量数据。这项研究涉及一组计算机工程师和统计学家，他们将密切合作，实施一个原型系统，用于检测、绘制和识别互联网上的世界范围恶意活动。该项目将创建并向公众传达一组简单易懂的风险指数，总结当前的暗网威胁活动。 由于互联网参与者的动态性和物联网生态系统的快速扩张，互联网威胁不断演变，了解互联网威胁需要在细粒度的空间和时间尺度上获得足够的数据。项目团队可以访问Merit Network，Inc.收集的唯一网络安全数据。捕获Internet范围内的活动，包括网络扫描、恶意软件传播、拒绝服务攻击和网络中断。这些数据由未经请求的互联网流量组成，目的地是路由但未使用的互联网地址空间，称为暗网。该项目将开发算法和软件基础设施，以收集和组织暗网数据到高维，多变量数据流，并将研究基于（i）极值依赖，（ii）变点检测和/或（iii）高维稀疏信号检测和恢复的统计方法，以告知构建互联网威胁指数，量化恶意扫描的风险，网络脆弱性的程度，拒绝服务攻击的风险等。在高维设置的极端统计是一个具有挑战性的问题，因为它需要建模/估计的一个无限维的参数-频谱测量。使用多元规则变化，这个项目将研究新的超图形模型，量化和提供可解释的抽象的同时发生的极端在高维度。利用因变量最大值的极限理论，项目团队将解决关于极值依赖超图的表征和高维稀疏信号检测的开放性理论问题。这种分析将导致开发新的威胁指数，表现出空间依赖性，将与快速，可扩展的变化点检测算法进行分析。新的变点方法的目的是在不影响统计准确性的情况下，实现与标准方法相比的大计算增益，并将对大型数据流的分析做出重大贡献。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

The project is motivated by the need to develop advanced network monitoring tools coupled with automated statistical methods for the quick detection of Internet traffic anomalies due to ongoing attacks or impending cybersecurity threats. Emphasis is placed on detecting cybersecurity threats such as highly distributed malware infections, which can launch coordinated and crippling distributed denial of service attacks on the nation's Internet infrastructure. This will be achieved through a study of the so-called darknet traffic data. Malicious actors in the network systematically probe the Internet space for vulnerable or misconfigured devices. In doing so, they automatically send data to the entire Internet address space, which includes the space of unused Internet addresses. This destined-to-nowhere traffic is indicative of malware infection attempts or stealthy vulnerability scanning. The investigators aim to develop and deploy specialized tools that allow cyber-security analysts to efficiently analyze darknet traffic data. The research involves a team of computer engineers and statisticians, who will work closely together to implement a prototype system for detecting as well as mapping and identifying world-wide malicious activity in the Internet. The project will create and communicate to the public a set of simple-to-interpret risk indices that summarize the current darknet threat activity. This effort will potentially enable the prevention and mitigation of cybersecurity network traffic threats.Understanding Internet threats, which continue to evolve due to the dynamic nature of Internet actors and the rapid expansion of the Internet of Things ecosystem, requires adequate data at fine-grained spatial and temporal scales. The project team has access to unique cyber-security data collected at Merit Network, Inc. that capture Internet-wide activity including network scanning, malware propagation, denial of service attacks, and network outages. This data consists of unsolicited Internet traffic destined to a routed but unused Internet address space, referred to as a darknet. This project will develop algorithmic and software infrastructure to collect and organize darknet data into high-dimensional, multivariate data streams, and will study statistical methods based on (i) extremal dependence, (ii) change-point detection, and/or (iii) high-dimensional sparse signal detection and recovery to inform the construction of Internet threat indices that quantify the risk of malicious scanning, degree of network vulnerability, risk of denial of service attacks, etc. Statistics of extremes in high-dimensional setting is a challenging problem since it requires the modeling/estimation of an infinite-dimensional parameter---the spectral measure. Using multivariate regular variation, this project will study novel hyper-graphical models that quantify and provide interpretable abstractions for the simultaneous occurrence of extremes in high-dimensions. Using limit theory for maxima of dependent variables, the project team will address open theoretical problems on the characterization of extremal dependence hyper-graphs and sparse signal detection in high-dimension. This analysis will lead to the development of novel threat indices that exhibit spatial dependence that will be analyzed with fast, scalable change-point detection algorithms. The new change-point methodology is designed to achieve large computational gains vis-a-vis standard approaches without compromising statistical accuracy and would be a significant contribution to the analysis of large data streams.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.