Open source cyber fusion center

开源网络融合中心

• 批准号: 508310-2016
• 负责人: Weiss, Michael
• 金额: $ 7.29万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2018
• 资助国家: 加拿大
• 起止时间: 2018-01-01 至 2019-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=668367
• 关键词: Open; source; cyber; fusion; center

Small businesses, including early-stage startups with high-growth potential, face the same cybersecurity threats as large companies, including cyber-crime, cyber-espionage, and cyber-vandalism that can compromise the confidentiality and integrity of sensitive business data and the availability of essential business services. Furthermore, smaller organizations often lack the knowledge, skills, resources, and capabilities to respond effectively and to keep up with a constantly-shifting threat landscape. The new Cyber Fusion Center will aggregate information about security events and architecture-related information from the installed application stacks, identify attack patterns and architectural flaws, generate and deploy new sensor rules, and identify areas of the application source code that need to be patched. The proposal addresses four research challenges: (1) gathering security and architecture-related events from installed application stacks and aggregating events in real time, (2) enabling a proactive response to threats by detecting attacks, campaigns, and patterns in aggregated threat information, and generating both (i) semantically-rich and easily-understood metrics and (ii) rules to be deployed back into installed stacks to enhance resilience, (3) monitoring the application stack architecture for flaws indicative of security risks and recommending patches to the software source code, and (4) deploying application stacks and security patches. Benefits will include new knowledge, production of much-needed highly qualified personnel, and competitive advantage for Ontario and Quebec businesses that are more resilient to cyberattacks and more aware of emerging cyberthreats.**********************

小型企业，包括具有高增长潜力的早期创业公司，面临着与大型公司相同的网络安全威胁，包括网络犯罪，网络间谍和网络破坏行为，这些威胁可能会损害敏感业务数据的机密性和完整性以及基本业务服务的可用性。此外，规模较小的组织往往缺乏知识、技能、资源和能力，无法有效应对不断变化的威胁形势。新的网络融合中心将从已安装的应用程序堆栈中汇总有关安全事件和架构相关信息的信息，识别攻击模式和架构缺陷，生成和部署新的传感器规则，并确定需要修补的应用程序源代码区域。该提案涉及四项研究挑战：（1）从已安装的应用程序堆栈收集安全和架构相关事件并真实的聚集事件，（2）通过检测聚集的威胁信息中的攻击、活动和模式来实现对威胁的主动响应，以及生成（i）语义丰富且易于理解的度量和（ii）将被部署回已安装栈以增强弹性的规则，（3）监视应用堆栈体系结构以寻找指示安全风险的缺陷，并向软件源代码推荐补丁，以及（4）部署应用堆栈和安全补丁。其好处将包括新知识、培养急需的高素质人才，以及为安大略和魁北克企业带来竞争优势，这些企业对网络攻击的适应能力更强，对新出现的网络威胁的意识更强。*