CCRI: Planning: Towards Building a Community Data Infrastructure for CyberSecurity Research

该项目的长期愿景是创建多校区数据收集和共享基础设施，供机器学习网络安全和隐私研究人员使用。这些数据集本质上是多模式的（网络日志、主机日志、杀伤链检测的身份验证日志），提供连续的数据（用于长期时间和拓扑分析），并且是及时的（处理不断演变的网络攻击的必要条件）。本规划补助金的具体初始步骤是：(i)组织研讨会，让社区参与制定该基础设施的愿景和路线图，并讨论法律、道德、隐私、组织和可持续性方面的考虑，以及（ii）创建一个由多个数据提供者和数据用户组成的团队，并提交一份大集成CCRI提案，以构建和使用数据基础设施。设想的基础设施对于检测零日（新的，以前未见过的）攻击和具有复杂杀伤链的大规模攻击，例如Wannacry勒索软件攻击，Mirai分布式拒绝服务（DDoS）攻击和高级持续威胁（APT）攻击，将是非常宝贵的。它将根据一组选定的早期采用者（即可以开发和测试其机器学习技术的数据用户）的输入构建。随后，Incommon Federation成员的Shibboleth单点登录将用于扩大对整个CISE社区的访问。社区外展和传播活动是规划赠款讲习班的一部分。一些本科生和研究生将在弗吉尼亚大学（UVA）、印第安纳大学（IU）和乔治华盛顿大学（GWU）参加这个项目。通过弗吉尼亚大学和印第安纳大学的中心以及GWU联合pi的研究实验室，计划开展多样性增强活动。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The long-term vision of this project is to create a multi-campus data collection and sharing infrastructure for use by machine-learning cybersecurity and privacy researchers. These datasets will be multimodal in nature (network logs, host logs, authentication logs for kill-chain detection), provide continuous data (for long-term temporal and topological analysis), and be timely in nature (necessary to handle the constantly evolving nature of cyber-attacks). The specific initial steps under this Planning Grant are: (i) organize a workshop to engage the community to formulate a vision and roadmap for this infrastructure and to discuss legal, ethical, privacy, organizational and sustainability considerations, and (ii) create a team of multiple data providers and data users and submit a Grand Ensemble CCRI proposal to build and use the data infrastructure.The envisioned infrastructure will be invaluable for detecting zero-day (new, previously unseen) attacks and large-scale attacks with complex kill-chains, e.g., the Wannacry ransomware attack, Mirai Distributed Denial of Service (DDoS) attacks and Advanced Persistent Threat (APT) attacks. It will be built with input from a selected group of early adopters, i.e., data users who can develop and test their machine learning techniques. Later, the Shibboleth Single Sign-On Access of Incommon Federation members will be used to broaden access to the entire CISE community. Community outreach and dissemination activities are part of the planning grant workshop. A number of undergraduate and graduate students will participate in this project at University of Virginia (UVA), Indiana University (IU), and George Washington University (GWU). Diversity enhancing activities are planned through centers at UVA and IU, and the GWU co-PI’s research Lab.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.