CICI: SSC: Proactive Cyber Threat Intelligence and Comprehensive Network Monitoring for Scientific Cyberinfrastructure: The AZSecure Framework

科学仪器中计算技术的快速发展提高了发现的速度。最近的一些例子包括发现新的基本粒子和第一张黑洞的图像。不幸的是，为这些高影响力的发现做出贡献的技术也成为黑客窃取创意或牟利的目标。这些攻击威胁到隐私、完整性以及访问有价值的科学数据和事件的能力。科学设施面临的风险以及如何攻击它们仍然没有得到适当的映射。该项目将使用新颖的人工智能来(1)研究国际和不断发展的暗网中的黑客，并识别和分类数十万个风险；(2)将这些风险与两个大型科学社区设施可能遭受的攻击联系起来。其中一个是由国家科学基金会资助的设施，为生命科学提供先进的计算资源。另一个利用遍布全球的传感器网络为地球科学收集详细和及时的数据。研究这些有价值的目标，可以调查对科学发现构成风险的当前和新出现的威胁。该项目由亚利桑那大学（UA）西班牙裔服务机构（HSI）领导，设计了一个具有两个协同研究流的创新、整体和主动的网络威胁情报（CTI）框架。第一个是建立在先进的主题建模和文本分类方法的基础上，这些方法来自我们的NSF安全与可信网络空间（SaTC）研究，系统地收集和探索数百万记录的暗网黑客论坛，用于科学的网络基础设施利用。第二种设计新颖的横幅数据特征提取、文本分析和自定义漏洞扫描，集成了最先进的工具，以全面分类和评估CyVerse中的漏洞。s（生命科学）和LEO？S（地球科学）各种仪器、数据、硬件和软件。利用基于词嵌入的基于深度学习的漏洞利用深度结构化语义模型（EV-DSSM）将漏洞利用和漏洞评估结果联系起来。UA ?美国国家安全局指定的网络防御、研究和运营学术卓越中心、美国国家科学基金会服务奖学金（SFS）网络军团和硕士？在网络安全项目中，定位项目与教学和研究的协同作用。该项目开发的技术不仅将推进CTI知识，还将推进跨多个学科的网络分析、深度学习和文本分析。这项研究的结果将传播给75个以上的SFS合作机构，并为更大的科学界提供运营情报（例如，NSF大型设施和网络基础设施网络安全峰会）。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The rapid growth of computing technologies in scientific instruments has increased the rate of discovery. Some recent examples include the discovery of new fundamental particles and the first-ever images of a black hole. Unfortunately, the same technologies contributing to these high-impact discoveries are also being targeted by hackers to steal ideas or for profit. These attacks threaten the privacy, integrity, and ability to access valuable scientific data and events. The risks to scientific facilities and how they can be attacked have still not been properly mapped. This project will use novel Artificial Intelligence to (1) study hackers in the international and ever-evolving Dark Web and identify and categorize hundreds of thousands of risks and (2) link those risks to possible attacks on two large-scale science community facilities. One of them is a facility funded by the National Science Foundation offering advanced computing resources for Life Sciences. The other uses a network of sensors around the globe to collect detailed and timely data for Earth Sciences. Studying these valuable targets enables investigation of current and emerging threats that present risk to scientific discovery.Led by the Hispanic Serving Institution (HSI) University of Arizona (UA), this project designs an innovative, holistic, and proactive Cyber Threat Intelligence (CTI) framework with two synergistic research streams. The first builds upon advanced topic modelling and text classification approaches from our NSF Secure and Trustworthy Cyberspace (SaTC) research to systematically collect and explore multi-million record Dark Web hacker forums for scientific cyberinfrastructure exploits. The second designs novel banner data feature extraction, text analytics, and custom vulnerability scanning integrating state-of-the-art tools to comprehensively categorize and assess the vulnerabilities within CyVerse?s (life sciences) and LEO?s (earth sciences) diverse instruments, data, hardware, and software. Exploit and vulnerability assessment results are linked via a novel deep learning-based Exploit Vulnerability Deep Structured Semantic Model (EV-DSSM) based on word embedding. UA?s National Security Agency-designated Center of Academic Excellence in Cyber Defense, Research, and Operations, NSF Scholarship-for-Service (SFS) Cyber-Corps, and Master?s in Cybersecurity programs position the project for synergy with teaching and research. Techniques developed in this project will advance knowledge not only CTI, but network analysis, deep learning, and text analytics across multiple disciplines. Findings from this research will be disseminated to 75+ SFS partner institutions and operational intelligence for the larger scientific community (e.g., NSF Cybersecurity Summits of Large Facilities and Cyberinfrastructure).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.