CICI: RSSD: LaSIC: Labeled Security Information Capture

孟菲斯大学（UofM）和佛罗里达国际大学（FIU）正在合作LaSIC（标记安全信息捕获）项目，以支持NSF保护科学资产的使命。科学研究严重依赖网络资产（网络化组件和服务），这些资产必须安全运行，以支持基础科学研究并增加对结果和结论的信心。开发健壮的安全性需要高质量、值得信赖的数据集来调优、测试和验证安全模型和机制。如果这些数据集被标记，它们的研究价值将大大增加，这对于开发新的机器学习（ML）技术和建立基础真理至关重要。然而，由于它们的分布式特性、数量和隐私问题，在尊重用户隐私的情况下，标记数据集很难生成并分发给安全社区。LaSIC捕获，标记和分发来自AmLight的真实流量，AmLight是一个生产国际研究和教育网络，服务于几个科学社区，致力于保护科学数据和文物的研究人员。AmLight提供与众多科学学科的连接，包括天文学、气候、高能物理、基因组学等。AmLight通过多个海底光缆系统，以及美国大陆的ESnet和Internet2等其他网络，将拉丁美洲、加勒比地区和非洲与美国连接起来。LaSIC使用现有的、独特的捕获基础设施和功能来记录、处理和标记数据集，包括通过英特尔Tofino交换机捕获细粒度网络遥测的能力，支持高达40G的自定义数据包捕获工具，从原始数据包捕获中获得的未采样流数据，网络范围内采样Netflow数据，以及来自部署在网络中的商业入侵检测系统（IDS）的警报。LaSIC提供多模式、结构化和标记的网络事件网络安全数据集，支持广泛的安全研究。最后，LaSIC根据数据的敏感性通过各种机制分发这些数据集，以保护用户隐私。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The University of Memphis (UofM) and Florida International University (FIU) are partnering on project LaSIC (Labeled Security Information Capture) to support NSF’s mission to secure scientific assets. Scientific research relies heavily on cyber assets (networked components and services) that must operate securely to support fundamental scientific research and increase confidence in outcomes and conclusions. Developing robust security requires high-quality, trustworthy datasets to tune, test and validate security models and mechanisms. The research value of such datasets increases greatly if they are labeled, which is essential for developing new machine learning (ML) techniques, and establishing ground truth. However, due to their distributed nature, volume and privacy issues, labeled datasets have been extremely hard to produce and distribute to the security community while respecting user privacy.LaSIC captures, labels and distributes real traffic from AmLight, a production international research and education network serving several scientific communities, to researchers working on securing scientific data and artifacts. AmLight provides connectivity to numerous science disciplines, including Astronomy, Climate, High-Energy Physics, Genomics, and more. AmLight connects Latin America, the Caribbean, and Africa to the U.S. through multiple submarine optical cable systems, as well as other networks such as ESnet and Internet2 in the continental US. LaSIC uses an existing, unique capture infrastructure and capabilities to record, process, and label datasets, including the ability to capture fine-grained network telemetry through Intel Tofino switches, a custom packet capture tool that supports speeds up to 40G, unsampled flow data derived from raw packet capture, network-wide sampled Netflow data, and alerts from a commercial Intrusion Detection System (IDS) deployed in the network. LaSIC provides multimode, structured, and labeled cybersecurity datasets of networking events that support a wide range of security research. Finally, LaSIC distributes these datasets through various mechanisms according to the sensitivity of the data to protect user privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.