OAC Core: Small: Devising Data-driven Methodologies by Employing Large-scale Empirical Data to Fingerprint, Attribute, Remediate and Analyze Internet-scale IoT Maliciousness

到2023年，至少有200亿台设备将连接到互联网。这些设备中的许多设备实时传输关键和敏感的系统和个人数据。被统称为“物联网”（IoT），这个市场代表着每年2670亿美元的行业。尽管这个市场很有价值，但该行业的安全支出几乎没有超过1%。事实上，虽然物联网供应商继续将更多的物联网设备推向市场，但这些设备的安全性往往被优先考虑，使它们更容易被利用。这严重威胁到消费者的隐私和关键任务系统的安全。虽然目前正在进行一些研究工作来解决物联网安全问题，但一些挑战阻碍了他们的成功。这些问题包括部署此类设备后缺乏物联网监控能力，当它们受到损害时缺乏补救技术，以及允许理解底层物联网恶意基础设施的方法不足。为此，该项目将服务于NSF的使命，即通过开发数据科学方法来近实时地识别和修复受感染的物联网设备，从而促进科学的进步。该项目还将促进少数民族和K-12学生的网络安全研究和培训。此外，该项目将通过开发用于物联网相关数据和威胁共享的大规模网络基础设施，为运营网络安全做出贡献，从而实现全面的动手网络科学。 该项目将仔细检查近100 GB/小时的实时未经请求的互联网规模流量，以设计和开发高效的深度学习分类器来识别物联网设备，识别其类型和供应商，并披露其大规模漏洞和托管环境。该项目将设计和开发用于L1范数主成分分析（PCA）数据降维的快速贪婪近似算法，从而实时执行基于密度的噪声应用空间聚类（DBSCAN）技术，以检测和归因于物联网编排的僵尸网络。该项目还将基于互联网范围内的主动测量来设计可扩展的攻击性安全算法，以提供宏观补救策略。该项目将每天管理近350万个恶意软件样本和约130万个被动DNS记录，以构建图论模型，从而发现和表征构成物联网恶意网络基础设施概念的相互关联的组件。此外，该项目将分析这些基础设施的演变，通过设计线性时间内的效率图相似性技术，通过设计和实现植根于图内核和最小哈希方法的算法来理解它们的工作方式。该项目还将（i）为物联网经验数据和网络威胁索引和共享开发独特的网络基础设施，（ii）通过利用高速内存数据处理技术自动化设计的算法和技术，（iii）通过探索模糊散列算法生成物联网特定的检测签名，以及（iv）使得能够通过安全API和前端访问所生成的IoT工件。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响进行评估，被认为值得支持审查标准。

At least 20 billion devices will be connected to the Internet by 2023. Many of these devices transmit critical and sensitive system and personal data in real-time. Collectively known as "the Internet of Things" (IoT), this market represents a $267 billion per year industry. As valuable as this market is, security spending on the sector barely breaks 1%. Indeed, while IoT vendors continue to push more IoT devices to market, the security of these devices has often fallen in priority, making them easier to exploit. This drastically threatens the privacy of the consumers and the safety of mission-critical systems. While a number of research endeavors are currently taking place to address the IoT security problem, several challenges hinder their success. These include the lack of IoT monitoring capabilities once such devices are deployed, the shortage of remediation techniques when they are compromised, and the inadequacy of methodologies to permit the comprehension of the underlying IoT malicious infrastructures. To this end, this project will serve NSF's mission to promote the progress of science by developing data science methodologies to identify and remediate infected IoT devices in near real-time. The project will also promote cyber security research and training for minorities and K-12 students. Moreover, the project will contribute to operational cyber security by developing a large-scale cyberinfrastructure for IoT-relevant data and threat sharing, enabling hands-on cyber-science at large. The project will scrutinize close to 100 GB/hr of real-time unsolicited Internet-scale traffic to devise and develop efficient deep learning classifiers to fingerprint IoT devices, identifying their types and vendors, and disclosing their large-scale vulnerabilities and hosting environments. The project will design and develop fast greedy approximation algorithms for L1-norm Principal Component Analysis (PCA) data-dimensionality reduction, enabling the real-time execution of the Density Based Spatial Clustering of Application with Noise (DBSCAN) technique for detecting and attributing IoT orchestrated botnets. The project will also design scalable offensive security algorithms based on Internet-wide active measurements to offer macroscopic remediation strategies. The project will curate close to 3.5 million malware samples/day and around 1.3 million passive DNS records/day to build graph-theoretic models to uncover and characterize inter-related components which form the concept of IoT malicious cyberinfrastructure. Further, the project will analyze the evolution of such infrastructures to comprehend their modus operandi by devising efficiency graph similarity techniques in linear time, by designing and implementing algorithms rooted in graph kernels and min-hashing methods. The project will also (i) develop a unique cyberinfrastructure for IoT empirical data and cyber threat indexing and sharing, (ii) automate the devised algorithms and techniques by leveraging high speed, in-memory data processing technologies, (iii) generate IoT-specific detection signatures by exploring fuzzy hashing algorithms, and (iv) enable at-large access to the generated IoT artifacts through a secure API and a front-end mechanism.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.