CRII: SaTC: Empowering Elastic-honeypot as Real-time Malicious Content Sniffers for Social Networks

垃圾信息、错误信息、虚假信息和彻头彻尾的欺诈在社交网络上猖獗。为了将这些恶意内容从良性和有用的内容中分离出来，并保护社交网络，需要一个强大的内容分类系统。然而，在设计这样的系统之前，需要训练分类器的数据。蜜罐是获取此类恶意攻击者行为数据的好方法。传统的蜜罐依赖于手动创建的人工用户帐户作为诱捕攻击活动的诱饵。然而，这样的蜜罐通常很容易被聪明的攻击者识别出来。它们还缺乏部署灵活性、特性可变性、网络可伸缩性和系统可移植性。本项目开发了一种新颖且轻量级的基于蜜罐的恶意内容捕获系统，攻击者无法轻易绕过该系统。然后蜜罐被用来智能地收集和自动地将内容分类为可能是恶意的和可能是良性的。目标是减轻恶意内容的不利影响，净化社会环境，显著提高社会网络的安全性和信任度。研究数据集和软件工具包与更广泛的研究社区共享。研究结果以书籍章节和实践课堂材料的形式转化为教育材料，交付给路易斯安那大学拉斐特分校的学生，并与全球其他大学共享。该项目还包括本科生和代表性不足的学生的研究经验。为了克服传统的基于蜜罐的解决方案的缺点，本项目开发了一种新的轻量级的基于蜜罐的恶意内容嗅探系统，称为弹性蜜罐嗅探器。弹性蜜罐嗅探器由两个核心部件组成：(1)实时数据采集和(2)弹性蜜罐探测器。在现有的垃圾邮件数据集上使用强大的学习技术，该项目确定了被发现是垃圾邮件发送者有利可图目标的用户的特征和行为概况。针对实时数据采集，弹性蜜罐基于学习到的易受攻击用户特征动态部署人工用户账号作为诱饵，智能诱骗攻击者。与传统蜜罐技术相比，它的主要优点是节点可用性、部署灵活性、特性可变性、网络可伸缩性和系统可移植性。弹性蜜罐嗅探器捕获的数据用于设计稳健的分类技术，以区分恶意和良性内容，这些内容可以抵御对抗性攻击。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Spam messages, misinformation, disinformation and outright fraud are rampant on social networks. To separate out such malicious content from benign and useful content and protect social networks, there is a need for robust content classification systems. However, before such systems can be designed, there is a need for data that train the classifiers. Honeypots are a good way to obtain such data about malicious attacker behavior. Conventional honeypots rely on manually created artificial user accounts as lures to trap attack activities. However, such honeypots are often identified easily by smart attackers. They also suffer from lack of deployment flexibility, feature variability, network scalability, and system portability. This project develops a novel and lightweight honeypot-based malicious content capturing system that cannot be easily bypassed by attackers. The honeypot is then used to intelligently gather and automatically classify contents into likely malicious and likely benign. The goal is to mitigate the adverse effects of malicious contents and sanitize social environments, significantly elevating the security and trust of social networks. Research datasets and software toolkits are shared with the broader research community. The research findings are transitioned into educational materials in the form of book chapters and hands-on classroom materials, delivered to students at the University of Louisiana at Lafayette and also shared with other universities worldwide. The project also involves undergraduate and under-represented students for research experience. This project develops a novel and lightweight honeypot-based malicious content sniffing system, named the elastic-honeypot sniffer, to overcome drawbacks in conventional honeypot-based solutions. Two core components constitute the elastic-honeypot sniffer: (1) real-time data gathering and (2) elastic-honeypot detector. Using robust learning techniques on existing spam datasets, the project identifies features and behavior profiles of users who are found to be lucrative targets for spammers. For real-time data gathering, the elastic-honeypot dynamically deploys artificial user accounts as lures based on the learnt vulnerable user profiles to trap attackers intelligently. The main advantages over conventional honeypot technology are node availability, deployment flexibility, features variability, network scalability, and system portability. The data captured by the elastic-honeypot sniffer is used to design robust classification techniques to differentiate between malicious and benign content that are resilient against adversarial attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.