CICI: RSSD: LaSIC: Labeled Security Information Capture

孟菲斯大学（UofM）和佛罗里达国际大学（FIU）正在合作开展LASIC（标记安全信息捕获）项目，以支持NSF保护科学资产的使命。科学研究在很大程度上依赖于网络资产（网络组件和服务），这些资产必须安全运行，以支持基础科学研究并提高对结果和结论的信心。开发强大的安全性需要高质量、值得信赖的数据集来调整、测试和验证安全模型和机制。如果这些数据集被标记，其研究价值将大大增加，这对于开发新的机器学习（ML）技术和建立地面真相至关重要。然而，由于其分布式性质、数量和隐私问题，在尊重用户隐私的情况下，标记数据集很难生成并分发给安全社区。LASIC捕获、标记和分发来自AmLight的真实的流量，AmLight是一个生产性国际研究和教育网络，为多个科学社区提供服务，供研究人员保护科学数据和文物。AmLight提供与众多科学学科的连接，包括天文学，气候，高能物理学，基因组学等。AmLight通过多个海底光缆系统以及美国大陆的ESnet和Internet2等其他网络将拉丁美洲、加勒比海和非洲连接到美国。LaSIC使用现有的、独特的捕获基础设施和功能来记录、处理和标记数据集，包括通过英特尔Tofino交换机捕获细粒度网络遥测的能力，这是一种自定义数据包捕获工具，支持高达40 G的速度、来自原始数据包捕获的未采样流数据、网络范围内的采样Netflow数据以及来自网络中部署的商用入侵检测系统（IDS）的警报。LASIC提供多模式、结构化和标记的网络事件网络安全数据集，支持广泛的安全研究。最后，LaSIC根据数据的敏感性通过各种机制分发这些数据集，以保护用户隐私。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响力审查标准进行评估，被认为值得支持。

The University of Memphis (UofM) and Florida International University (FIU) are partnering on project LaSIC (Labeled Security Information Capture) to support NSF’s mission to secure scientific assets. Scientific research relies heavily on cyber assets (networked components and services) that must operate securely to support fundamental scientific research and increase confidence in outcomes and conclusions. Developing robust security requires high-quality, trustworthy datasets to tune, test and validate security models and mechanisms. The research value of such datasets increases greatly if they are labeled, which is essential for developing new machine learning (ML) techniques, and establishing ground truth. However, due to their distributed nature, volume and privacy issues, labeled datasets have been extremely hard to produce and distribute to the security community while respecting user privacy.LaSIC captures, labels and distributes real traffic from AmLight, a production international research and education network serving several scientific communities, to researchers working on securing scientific data and artifacts. AmLight provides connectivity to numerous science disciplines, including Astronomy, Climate, High-Energy Physics, Genomics, and more. AmLight connects Latin America, the Caribbean, and Africa to the U.S. through multiple submarine optical cable systems, as well as other networks such as ESnet and Internet2 in the continental US. LaSIC uses an existing, unique capture infrastructure and capabilities to record, process, and label datasets, including the ability to capture fine-grained network telemetry through Intel Tofino switches, a custom packet capture tool that supports speeds up to 40G, unsampled flow data derived from raw packet capture, network-wide sampled Netflow data, and alerts from a commercial Intrusion Detection System (IDS) deployed in the network. LaSIC provides multimode, structured, and labeled cybersecurity datasets of networking events that support a wide range of security research. Finally, LaSIC distributes these datasets through various mechanisms according to the sensitivity of the data to protect user privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.