Defending Against Multi-Step Network Intrusions in large-scale computer networks

点击翻译按钮获取中文摘要

In the long term, the proposed research program aims to develop techniques for automatically interpreting and predicting attackers' progress, strategies, and intentions in defending computer networks against intrusions. In the short term, the research will be focused on scalable and efficient knowledge representations and algorithms, and on the design, implementation, and evaluation of practical systems for defending against multi-step intrusions in large-scale, distributed computer systems. More specifically, the proposed research program will identify root causes to the poor scalability of current knowledge representation and remove the limitation by proposing novel ways of representing knowledge about vulnerabilities and network connectivity. The research will devise heuristic algorithms for finding minimum-cost solutions to harden a network and evaluate the devised algorithms through extensive experiments. It will also propose security metrics for measuring risks, costs, resistance to attacks in an integrated framework and design efficient algorithms for optimizing network configurations based on the proposed metrics. Finally, it will study the distributed computation and analysis of attack graphs while taking into consideration potential local security policies that may prohibit the disclosure of vulnerability information to other parties.