Enterprise security

众所周知，互联网已经成为现代生活的几乎所有方面的组成部分，从科学到娱乐，从政府到工业，从经济到我们的文化。 但是，虽然互联网的开放式架构一直是其爆炸性增长的主要推动力，但这种开放性，加上安装在终端主机中的大量不安全商业软件，为攻击者提供了几乎取之不尽的易受攻击主机，无论是作为主要受害者还是作为漏洞利用链中的中间步骤。 这些威胁威胁着互联网上商业和活动的安全性和完整性。 我们建议在这里研究技术和工具，为企业更好地保护他们的网络，主机和数据资源。 两个主题在整个研究中反复出现。 首先是强调异常检测方法，而不是误用检测方法。 在后者中，模型由非法流量组成，并且当流量或行为与模型匹配时发出警报。 在前者中，模型由合法流量组成，当流量或行为偏离模型时会发出警报。 大多数安全工具依赖于误用检测，因为人们普遍认为计算系统的行为太复杂，无法建模用于异常检测。 本提案中描述的两个项目涉及模拟复杂领域。 第二个主题是强调衡量和改进安全性和可用性/可用性之间的权衡。

It is a truism that the Internet has become integral to nearly all aspects of modern life, from science to entertainment, from government to industry, from the economy to our culture. But while the open architecture of the Internet has been the chief enabler of it's explosive growth, this same openness, combined with the abundance of insecure commercial software installed in end-hosts, has provided attackers with a nearly inexhaustible supply of vulnerable hosts to exploit, either as primary victims or as intermediate steps in a chain of exploits. These threats comprimise the safety and integrity of commerce and activity on the Internet. We propose here research into techniques and tools for enterprises to better secure their networks, hosts, and data resources. Two themes recur throughout this research. The first is an emphasis on the anomaly detection approach rather than the misuse detection approach. In the later, models are made of illegitimate traffic and alarms are raised when traffic or behaviour matches a model. In the former, a model is made of legitimate traffic and an alarm is raised when traffic or behaviour deviates from the model. The majority of security tools rely on misuse detection as there is a wide-spread belief that the behaviour of computing systems are too complex to model for use in anomaly detection. Two of the projects described in this proposal involve modelling complex domains. The second theme is an emphasis on measuring and improving the tradeoff between security and usability/availability.