CICI: TCR: IRIS: Instrumentation for Research and Inter-institutional SOC

该项目解决了设计、设计和维护有效和可扩展的网络和网络安全基础设施的问题，该基础设施将提供横跨互联网自由、网络监控、威胁情报以及安全和隐私领域的独特研究机会，同时使Merit Network(密歇根州的研究和教育网络)内的成员机构能够免受网络威胁。有效的网络安全存在重大障碍，包括网络安全预算有限、人员不足以及需要持续的基础设施维护。Merit会员中资源不足的小型机构尤其受到这些障碍的挑战，它们发现很难在今天的互联网上保持竞争力和相关性，因为网络攻击的频率和复杂性都在增长。在这些考虑下，该项目创建了一个功绩管理的共享基础设施，使这些实体能够专注于他们的任务，并相信他们拥有基线水平的网络安全防御。该项目开发态势感知基础设施，以有效监控进出Merit网络边界的互联网流量，并检测和帮助缓解针对Merit成员机构(即大学、K12学校等)的网络威胁。所谓的IRIS(研究和机构间安全运营中心(SOC))基础设施具有以集中、可配置和可持续的方式以流方式监控超高速网络流量的能力。这一高速网络监控基础设施部署在关键对等位置的Merit主干网络上，可持续提供丰富的网络研究数据以及提炼出的网络安全威胁(例如恶意软件下载、拒绝服务攻击等)。SOC平台通过最先进的网络安全解决方案(包括开源解决方案)收集此类威胁，并将它们传递到数据管道进行进一步分析、浓缩和研究。这些分析产品为安全分析师和研究人员提供有关当前恶意软件生态系统的最新见解、有关受攻击的计算机系统和恶意互联网站点的可操作威胁情报以及需要补救的可利用漏洞。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project addresses the problems of designing, engineering and maintaining an effective and scalable networking and cybersecurity infrastructure that would enable unique research opportunities that span the areas of Internet freedom, networking monitoring, threat intelligence and security and privacy, while at the same empowering the protection of member institutions within Merit Network (Michigan’s research and education network) from cyber threats. There are significant barriers to effective cybersecurity, including constrained cybersecurity budgets, inadequate staffing, and the need for continuous infrastructure maintenance. Small, low-resourced institutions within Merit’s membership are especially challenged by these barriers, finding it difficult to remain competitive and relevant in today’s Internet in which cyber-attacks are growing both in frequency and sophistication. Under these considerations, the project creates a Merit-managed, shared infrastructure that allows these entities to focus on their missions and be confident that they have a baseline level of cybersecurity defense. This project develops situational awareness infrastructure to efficiently monitor Internet traffic entering and leaving Merit’s network border, and to detect and help mitigate cyber-threats destined to Merit’s member institutions (i.e., universities, K12 schools, etc.). The so-called IRIS (Instrumentation of Research and Inter-institutional Security Operations Center (SOC)) infrastructure has the capability of monitoring ultra high speeds of network traffic in a streaming manner in a centralized, configurable, and sustainable manner. This high-speed network monitoring infrastructure is deployed on the Merit backbone network at key peering locations and provides a constant feed of rich network research data as well as distilled cyber-security threats (e.g., malware downloads, denial of service attacks, etc.). The SOC platform gleans such threats via state-of-the-art cybersecurity solutions (including open source ones) and passes them to a data pipeline for further analysis, enrichment and research. These analysis products provide to security analysts and researchers up-to-date insights with regards to the current malware ecosystem, actionable threat intelligence regarding compromised computer systems and malicious Internet sites, and exploitable vulnerabilities which require remediation.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.