CICI: RSSD: LaSIC: Labeled Security Information Capture

CICI：RSSD：LaSIC：标记安全信息捕获

• 批准号: 2232864
• 负责人: Christos Papadopoulos
• 金额: $ 59.96万
• 依托单位: University of Memphis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-02-01 至 2026-01-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2232864&HistoricalAwards=false
• 关键词: CICI; RSSD; LaSIC; Labeled; Security

The University of Memphis (UofM) and Florida International University (FIU) are partnering on project LaSIC (Labeled Security Information Capture) to support NSF’s mission to secure scientific assets. Scientific research relies heavily on cyber assets (networked components and services) that must operate securely to support fundamental scientific research and increase confidence in outcomes and conclusions. Developing robust security requires high-quality, trustworthy datasets to tune, test and validate security models and mechanisms. The research value of such datasets increases greatly if they are labeled, which is essential for developing new machine learning (ML) techniques, and establishing ground truth. However, due to their distributed nature, volume and privacy issues, labeled datasets have been extremely hard to produce and distribute to the security community while respecting user privacy.LaSIC captures, labels and distributes real traffic from AmLight, a production international research and education network serving several scientific communities, to researchers working on securing scientific data and artifacts. AmLight provides connectivity to numerous science disciplines, including Astronomy, Climate, High-Energy Physics, Genomics, and more. AmLight connects Latin America, the Caribbean, and Africa to the U.S. through multiple submarine optical cable systems, as well as other networks such as ESnet and Internet2 in the continental US. LaSIC uses an existing, unique capture infrastructure and capabilities to record, process, and label datasets, including the ability to capture fine-grained network telemetry through Intel Tofino switches, a custom packet capture tool that supports speeds up to 40G, unsampled flow data derived from raw packet capture, network-wide sampled Netflow data, and alerts from a commercial Intrusion Detection System (IDS) deployed in the network. LaSIC provides multimode, structured, and labeled cybersecurity datasets of networking events that support a wide range of security research. Finally, LaSIC distributes these datasets through various mechanisms according to the sensitivity of the data to protect user privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

孟菲斯大学(UofM)和佛罗里达国际大学(FIU)正在合作LaSIC(标记为安全信息捕获)项目，以支持NSF保护科学资产的任务。科学研究在很大程度上依赖网络资产(联网部件和服务)，这些资产必须安全运行，以支持基础科学研究并增加对结果和结论的信心。开发强大的安全性需要高质量、值得信赖的数据集来调整、测试和验证安全模型和机制。如果对这些数据集进行标记，那么它们的研究价值就会大大增加，这对于开发新的机器学习(ML)技术和建立基本事实是必不可少的。然而，由于标签数据集的分布式性质、数据量和隐私问题，在尊重用户隐私的情况下，很难生成并分发给安全社区。LaSIC捕获、标记并分发来自AmLight的真实流量，AmLight是一个服务于多个科学社区的生产性国际研究和教育网络，致力于保护科学数据和文物的研究人员。AMLight提供与众多科学学科的连接，包括天文学、气候学、高能物理、基因组学等。AMLight通过多个海底光缆系统以及其他网络，如美国大陆的ESnet和Internet2，将拉丁美洲、加勒比和非洲与美国连接起来。LaSIC使用现有的独特捕获基础设施和功能来记录、处理和标记数据集，包括通过Intel Tofino交换机捕获细粒度网络遥测的能力、支持高达40G速度的定制数据包捕获工具、源自原始数据包捕获的未采样流量数据、全网采样的Netflow数据，以及来自网络中部署的商用入侵检测系统(IDS)的警报。LaSIC提供网络事件的多模式、结构化和标签网络安全数据集，支持广泛的安全研究。最后，LaSIC根据数据的敏感性通过各种机制分发这些数据集，以保护用户隐私。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。