CCRI: Planning: Towards Building a Community Data Infrastructure for CyberSecurity Research

该项目的长期愿景是创建一个多校园数据收集和共享基础设施，供机器学习网络安全和隐私研究人员使用。这些数据集在本质上将是多模态的（网络日志、主机日志、用于区块链检测的认证日志），提供连续的数据（用于长期的时间和拓扑分析），并且在本质上是及时的（对于处理不断变化的网络攻击性质是必要的）。该规划补助金的具体初始步骤是：（i）举办工作坊，让社会各界参与制订有关基建的理想和路线图，并讨论有关法律的、道德、私隐、组织和可持续发展的考虑因素，以及（ii）创建一个由多个数据提供商和数据用户组成的团队，并提交一份构建和使用数据基础设施的大联盟CCRI提案。设想的基础设施将是对于检测零日（新的，以前看不见的）攻击和具有复杂攻击链的大规模攻击非常有用，例如，Wannacry勒索软件攻击、米拉伊分布式拒绝服务（DDoS）攻击和高级持续威胁（APT）攻击。它将根据选定的早期采用者群体的投入来构建，即，数据用户可以开发和测试他们的机器学习技术。后来，Shibboleth单点登录访问Incommon联盟成员将用于扩大访问整个CISE社区.社区外联和宣传活动是规划赠款讲习班的一部分。一些本科生和研究生将参加弗吉尼亚大学（UVA），印第安纳州大学（IU）和乔治华盛顿大学（GWU）的这个项目。通过UVA和IU的中心以及GWU共同PI的研究实验室计划了多样性增强活动。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The long-term vision of this project is to create a multi-campus data collection and sharing infrastructure for use by machine-learning cybersecurity and privacy researchers. These datasets will be multimodal in nature (network logs, host logs, authentication logs for kill-chain detection), provide continuous data (for long-term temporal and topological analysis), and be timely in nature (necessary to handle the constantly evolving nature of cyber-attacks). The specific initial steps under this Planning Grant are: (i) organize a workshop to engage the community to formulate a vision and roadmap for this infrastructure and to discuss legal, ethical, privacy, organizational and sustainability considerations, and (ii) create a team of multiple data providers and data users and submit a Grand Ensemble CCRI proposal to build and use the data infrastructure.The envisioned infrastructure will be invaluable for detecting zero-day (new, previously unseen) attacks and large-scale attacks with complex kill-chains, e.g., the Wannacry ransomware attack, Mirai Distributed Denial of Service (DDoS) attacks and Advanced Persistent Threat (APT) attacks. It will be built with input from a selected group of early adopters, i.e., data users who can develop and test their machine learning techniques. Later, the Shibboleth Single Sign-On Access of Incommon Federation members will be used to broaden access to the entire CISE community. Community outreach and dissemination activities are part of the planning grant workshop. A number of undergraduate and graduate students will participate in this project at University of Virginia (UVA), Indiana University (IU), and George Washington University (GWU). Diversity enhancing activities are planned through centers at UVA and IU, and the GWU co-PI’s research Lab.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.