CCRI: Planning: Towards Building a Community Data Infrastructure for CyberSecurity Research

该项目的长期愿景是创建一个多校园数据收集和共享基础设施，供机器学习、网络安全和隐私研究人员使用。这些数据集本质上是多模式的(网络日志、主机日志、杀伤链检测的身份验证日志)，提供连续数据(用于长期的时间和拓扑分析)，并且是及时的(处理网络攻击不断演变的性质所必需的)。根据这一规划拨款，最初的具体步骤是：(I)组织一次研讨会，让社区参与制定这一基础设施的愿景和路线图，并讨论法律、道德、隐私、组织和可持续发展方面的考虑因素，以及(Ii)创建一个由多个数据提供商和数据用户组成的团队，并提交一份构建和使用数据基础设施的大集合CCRI提案。设想的基础设施对于检测零日(新的、以前看不见的)攻击和具有复杂杀伤链的大规模攻击将是非常宝贵的，例如Wannacry勒索软件攻击、Mirai分布式拒绝服务(DDoS)攻击和高级持续威胁(APT)攻击。它将与选定的一组早期采用者，即能够开发和测试其机器学习技术的数据用户的投入一起建立。稍后，不常见的联盟成员的Shibboleth单点登录访问将用于扩大对整个CSISE社区的访问。社区外联和传播活动是规划赠款讲习班的一部分。弗吉尼亚大学(UVA)、印第安纳大学(IU)和乔治华盛顿大学(GWU)的一些本科生和研究生将参与这个项目。多样性增强活动是通过弗吉尼亚大学和印第安纳大学的中心以及GWU联合PI的研究实验室计划的。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The long-term vision of this project is to create a multi-campus data collection and sharing infrastructure for use by machine-learning cybersecurity and privacy researchers. These datasets will be multimodal in nature (network logs, host logs, authentication logs for kill-chain detection), provide continuous data (for long-term temporal and topological analysis), and be timely in nature (necessary to handle the constantly evolving nature of cyber-attacks). The specific initial steps under this Planning Grant are: (i) organize a workshop to engage the community to formulate a vision and roadmap for this infrastructure and to discuss legal, ethical, privacy, organizational and sustainability considerations, and (ii) create a team of multiple data providers and data users and submit a Grand Ensemble CCRI proposal to build and use the data infrastructure.The envisioned infrastructure will be invaluable for detecting zero-day (new, previously unseen) attacks and large-scale attacks with complex kill-chains, e.g., the Wannacry ransomware attack, Mirai Distributed Denial of Service (DDoS) attacks and Advanced Persistent Threat (APT) attacks. It will be built with input from a selected group of early adopters, i.e., data users who can develop and test their machine learning techniques. Later, the Shibboleth Single Sign-On Access of Incommon Federation members will be used to broaden access to the entire CISE community. Community outreach and dissemination activities are part of the planning grant workshop. A number of undergraduate and graduate students will participate in this project at University of Virginia (UVA), Indiana University (IU), and George Washington University (GWU). Diversity enhancing activities are planned through centers at UVA and IU, and the GWU co-PI’s research Lab.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.