CICI: SSC: Proactive Cyber Threat Intelligence and Comprehensive Network Monitoring for Scientific Cyberinfrastructure: The AZSecure Framework

科学仪器中计算技术的快速发展提高了发现的速度。最近的一些例子包括新的基本粒子的发现和有史以来第一次黑洞的图像。不幸的是，促成这些高影响力发现的技术也被黑客瞄准，以窃取想法或获利。这些攻击威胁到隐私、完整性和访问有价值的科学数据和事件的能力。科学设施所面临的风险以及它们如何受到攻击，仍然没有得到适当的映射。该项目将使用新的人工智能来（1）研究国际和不断发展的暗网中的黑客，并识别和分类数十万风险，（2）将这些风险与两个大型科学社区设施可能受到的攻击联系起来。其中之一是由国家科学基金会资助的一个设施，为生命科学提供先进的计算资源。另一个使用遍布地球仪的传感器网络为地球科学收集详细和及时的数据。研究这些有价值的目标可以调查当前和新出现的威胁，目前的风险，以科学发现。该项目由亚利桑那大学（UA）的西班牙裔服务机构（HSI）领导，设计了一个创新的，整体的，主动的网络威胁情报（CTI）框架，两个协同研究流。第一个基于我们NSF安全和可信网络空间（SaTC）研究的高级主题建模和文本分类方法，系统地收集和探索数百万记录的暗网黑客论坛，用于科学的网络基础设施利用。第二个设计新颖的横幅数据特征提取，文本分析和自定义漏洞扫描集成国家的最先进的工具，全面分类和评估CyVerse？s（生命科学）和LEO？地球科学的各种仪器、数据、硬件和软件。漏洞利用和漏洞评估结果通过基于词嵌入的新型深度学习漏洞利用深度结构化语义模型（EV-DSSM）联系起来。UA？美国国家安全局指定的网络防御，研究和运营学术卓越中心，NSF奖学金服务（SFS）网络军团和硕士？在网络安全计划的位置与教学和研究协同项目。在这个项目中开发的技术不仅将促进CTI的知识，但网络分析，深度学习和跨多个学科的文本分析。这项研究的结果将传播给75个以上的SFS伙伴机构，并为更大的科学界提供业务情报（例如，该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The rapid growth of computing technologies in scientific instruments has increased the rate of discovery. Some recent examples include the discovery of new fundamental particles and the first-ever images of a black hole. Unfortunately, the same technologies contributing to these high-impact discoveries are also being targeted by hackers to steal ideas or for profit. These attacks threaten the privacy, integrity, and ability to access valuable scientific data and events. The risks to scientific facilities and how they can be attacked have still not been properly mapped. This project will use novel Artificial Intelligence to (1) study hackers in the international and ever-evolving Dark Web and identify and categorize hundreds of thousands of risks and (2) link those risks to possible attacks on two large-scale science community facilities. One of them is a facility funded by the National Science Foundation offering advanced computing resources for Life Sciences. The other uses a network of sensors around the globe to collect detailed and timely data for Earth Sciences. Studying these valuable targets enables investigation of current and emerging threats that present risk to scientific discovery.Led by the Hispanic Serving Institution (HSI) University of Arizona (UA), this project designs an innovative, holistic, and proactive Cyber Threat Intelligence (CTI) framework with two synergistic research streams. The first builds upon advanced topic modelling and text classification approaches from our NSF Secure and Trustworthy Cyberspace (SaTC) research to systematically collect and explore multi-million record Dark Web hacker forums for scientific cyberinfrastructure exploits. The second designs novel banner data feature extraction, text analytics, and custom vulnerability scanning integrating state-of-the-art tools to comprehensively categorize and assess the vulnerabilities within CyVerse?s (life sciences) and LEO?s (earth sciences) diverse instruments, data, hardware, and software. Exploit and vulnerability assessment results are linked via a novel deep learning-based Exploit Vulnerability Deep Structured Semantic Model (EV-DSSM) based on word embedding. UA?s National Security Agency-designated Center of Academic Excellence in Cyber Defense, Research, and Operations, NSF Scholarship-for-Service (SFS) Cyber-Corps, and Master?s in Cybersecurity programs position the project for synergy with teaching and research. Techniques developed in this project will advance knowledge not only CTI, but network analysis, deep learning, and text analytics across multiple disciplines. Findings from this research will be disseminated to 75+ SFS partner institutions and operational intelligence for the larger scientific community (e.g., NSF Cybersecurity Summits of Large Facilities and Cyberinfrastructure).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.