EAGER: C2DIT: Community Continuous Distributed Internet Traffic Datasets

EAGER：C2DIT：社区连续分布式互联网流量数据集

• 批准号: 2217886
• 负责人: Christos Papadopoulos
• 金额: $ 29.96万
• 依托单位: University of Memphis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-06-01 至 2025-05-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2217886&HistoricalAwards=false
• 关键词: EAGER; C2DIT; Community; Continuous; Distributed

This project will make available to the general networking community continuous, distributed, and multimode datasets currently being collected at three Research and Education Networks (RENs). The data is well-suited for cybersecurity research, anomaly detection, evaluation, and classification tasks such as detecting DDoS and other network attacks, route hijacking, encrypted application traffic and quantifying network resilience.The project will provide both anonymized and non-anonymized data, the latter accessed through the project’s existing infrastructure. The uniqueness of the data lies in its continuous, distributed, uniform and multimode nature. The data is continuous because traffic capture happens 24/7. This is important because interesting phenomena can happen at any time. The data is distributed and uniform because the same capture process runs at all locations simultaneously. This is important because attacks and other anomalies may be distributed and observing them at multiple networks at the same time facilitates easier correlation. Uniformity is important to access data in a consistent and familiar environment. Finally, the data will be presented in multiple modes: unsampled flows, sFlow, Netflow, and in some locations, accompanied by commercial Intrusion Detection System (IDS) alerts. Each of these modes has its own advantages: unsampled flows are needed to discover needle-in-a-haystack phenomena; sFlow and Netflow summarize traffic making datasets smaller and easier to handle; and IDS alerts provide external DDoS labeling.In addition to benefiting researchers in cybersecurity, the data will benefit the broader networking community working on routing, censorship, traffic correlation, characterization and engineering, machine learning, privacy, and other areas. The data has been used in hackathons and in the classroom to build exercises and demonstrations. Finally, the data will also have a broad societal impact given the increasing use of the Internet for work, education, and entertainment. Datasets may be requested at https://ant.isi.edu/classnet/This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目将向一般网络社区提供目前在三个研究和教育网络(RES)收集的连续、分布式和多模式数据集。这些数据非常适合网络安全研究、异常检测、评估和分类任务，如检测DDoS和其他网络攻击、路由劫持、加密应用流量和量化网络弹性。该项目将提供匿名和非匿名数据，后者通过该项目现有的基础设施访问。数据的独特性在于其连续性、分布性、统一性和多模性。数据是连续的，因为流量捕获全天候发生。这一点很重要，因为有趣的现象随时可能发生。数据是分布式和统一的，因为相同的捕获过程同时在所有位置运行。这一点很重要，因为攻击和其他异常可能是分布式的，同时在多个网络上观察它们有助于更容易地进行关联。一致性对于在一致且熟悉的环境中访问数据非常重要。最后，数据将以多种模式呈现：未采样流、sFlow、Netflow，以及在某些位置伴随商业入侵检测系统(IDS)警报。每种模式都有自己的优点：需要未采样的数据流来发现大海捞针现象；sFlow和Netflow汇总流量，使数据集更小、更易于处理；以及入侵检测警报提供外部DDoS标签。除了使网络安全研究人员受益外，这些数据还将使从事路由、审查、流量关联、表征和工程、机器学习、隐私等领域的更广泛的网络社区受益。这些数据已被用于黑客马拉松和课堂练习和演示。最后，鉴于工作、教育和娱乐越来越多地使用互联网，这些数据还将产生广泛的社会影响。数据集可在https://ant.isi.edu/classnet/This获奖时申请，这反映了国家科学基金会的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，认为值得支持。