Enterprise security

点击翻译按钮获取中文摘要

It is a truism that the Internet has become integral to nearly all aspects of modern life, from science to entertainment, from government to industry, from the economy to our culture. But while the open architecture of the Internet has been the chief enabler of it's explosive growth, this same openness, combined with the abundance of insecure commercial software installed in end-hosts, has provided attackers with a nearly inexhaustible supply of vulnerable hosts to exploit, either as primary victims or as intermediate steps in a chain of exploits. These threats comprimise the safety and integrity of commerce and activity on the Internet. We propose here research into techniques and tools for enterprises to better secure their networks, hosts, and data resources. Two themes recur throughout this research. The first is an emphasis on the anomaly detection approach rather than the misuse detection approach. In the later, models are made of illegitimate traffic and alarms are raised when traffic or behaviour matches a model. In the former, a model is made of legitimate traffic and an alarm is raised when traffic or behaviour deviates from the model. The majority of security tools rely on misuse detection as there is a wide-spread belief that the behaviour of computing systems are too complex to model for use in anomaly detection. Two of the projects described in this proposal involve modelling complex domains. The second theme is an emphasis on measuring and improving the tradeoff between security and usability/availability.