CICI: TCR: IRIS: Instrumentation for Research and Inter-institutional SOC

该项目解决了设计，工程和维护一个有效的和可扩展的网络和网络安全基础设施的问题，这将使独特的研究机会，跨越互联网自由，网络监控，威胁情报和安全和隐私等领域，同时授权保护Merit Network（密歇根州的研究和教育网络）内的成员机构免受网络威胁。有效的网络安全面临重大障碍，包括网络安全预算有限、人员配备不足以及需要持续的基础设施维护。 Merit成员中资源不足的小型机构尤其受到这些障碍的挑战，它们发现在当今网络攻击日益频繁和复杂的互联网中难以保持竞争力和相关性。在这些考虑因素下，该项目创建了一个Merit管理的共享基础设施，使这些实体能够专注于自己的任务，并相信他们拥有基线水平的网络安全防御。 该项目开发态势感知基础设施，以有效监控进出Merit网络边界的互联网流量，并检测和帮助缓解针对Merit成员机构的网络威胁（即，大学、K12学校等）。所谓的IRIS（研究和机构间安全运营中心（SOC））基础设施能够以集中、可配置和可持续的方式以流式方式监控超高速网络流量。 这种高速网络监控基础设施部署在Merit骨干网络的关键对等位置，并不断提供丰富的网络研究数据以及提取的网络安全威胁（例如，恶意软件下载、拒绝服务攻击等）。SOC平台通过最先进的网络安全解决方案（包括开源解决方案）收集此类威胁，并将其传递到数据管道进行进一步分析，丰富和研究。这些分析产品为安全分析师和研究人员提供了关于当前恶意软件生态系统的最新见解，有关受损计算机系统和恶意互联网站点的可操作威胁情报，以及需要补救的可利用漏洞。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估而被认为值得支持。

This project addresses the problems of designing, engineering and maintaining an effective and scalable networking and cybersecurity infrastructure that would enable unique research opportunities that span the areas of Internet freedom, networking monitoring, threat intelligence and security and privacy, while at the same empowering the protection of member institutions within Merit Network (Michigan’s research and education network) from cyber threats. There are significant barriers to effective cybersecurity, including constrained cybersecurity budgets, inadequate staffing, and the need for continuous infrastructure maintenance. Small, low-resourced institutions within Merit’s membership are especially challenged by these barriers, finding it difficult to remain competitive and relevant in today’s Internet in which cyber-attacks are growing both in frequency and sophistication. Under these considerations, the project creates a Merit-managed, shared infrastructure that allows these entities to focus on their missions and be confident that they have a baseline level of cybersecurity defense. This project develops situational awareness infrastructure to efficiently monitor Internet traffic entering and leaving Merit’s network border, and to detect and help mitigate cyber-threats destined to Merit’s member institutions (i.e., universities, K12 schools, etc.). The so-called IRIS (Instrumentation of Research and Inter-institutional Security Operations Center (SOC)) infrastructure has the capability of monitoring ultra high speeds of network traffic in a streaming manner in a centralized, configurable, and sustainable manner. This high-speed network monitoring infrastructure is deployed on the Merit backbone network at key peering locations and provides a constant feed of rich network research data as well as distilled cyber-security threats (e.g., malware downloads, denial of service attacks, etc.). The SOC platform gleans such threats via state-of-the-art cybersecurity solutions (including open source ones) and passes them to a data pipeline for further analysis, enrichment and research. These analysis products provide to security analysts and researchers up-to-date insights with regards to the current malware ecosystem, actionable threat intelligence regarding compromised computer systems and malicious Internet sites, and exploitable vulnerabilities which require remediation.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.