Active Intrusion Prediction and Response for Computing Devices on the Internet

加拿大和世界各地的计算基础设施越来越多地受到入侵者的攻击，入侵者试图窃取对安全、商业和隐私至关重要的信息。这类入侵者往往得到犯罪企业或民族国家行为者的支持，在技术上非常复杂，拥有充足的资源。2015年，英国劳合社保险公司估计，全球网络犯罪造成的损失为5000亿美元。到2019年，这一数字预计将翻两番，达到2万亿美元。对抗这场日益恶化的危机的一个关键武器是一种工程解决方案，用于检测网络入侵并部署对策。 当前的入侵检测系统通过监控网络活动并寻找与已知攻击步骤相匹配的活动模式来工作。通常，这会导致在攻击发生后进行检测，响应仅限于恢复操作，而不是挫败正在进行的攻击。该建议旨在开发在以下方面远远超过最先进水平的入侵检测和响应的创新解决方案：a)在检测到入侵的初始阶段时生成许多可能的攻击场景；b)部署额外的监控工具，这些工具专门用于收集证据来确认或拒绝这些攻击场景；c)计划能够有效应对最可能的场景的防御措施；以及d)以破坏最小的方式部署这些防御措施，同时继续如上所述地评估情况。长远的愿景是开发能够在未来十年内感知安全形势的智能入侵响应系统。 本提案中旨在实现上述目标的短期目标包括开发一种新的方法来表示入侵事件，该方法可以捕获高级意图和低级别网络活动，识别属于更大攻击一部分的入侵事件的组合，并在允许建立情景感知的框架内部署这些工具。从长远来看，这项提议旨在开发能够根据正在进行的攻击的识别来预测即将到来的渗透的算法，并开发能够挫败这些预测的攻击的对策。提出的研究的一个亮点是开发了能够从过去的攻击中学习的算法，以及设置诱骗目标和动态改变网络路径以转移攻击从关键系统。后者还将允许收集有关这些攻击的关键数据，这些数据将用于未来设计更好的检测工具。 在可预见的未来，信息安全正成为一项迫切的需要，需要创新的方法和训练有素的专业人员来应对迫在眉睫的挑战。该计划将培训具有必要背景和实践经验的工程师，他们将能够满足这一关键和不断增长的需求。

Computing infrastructure in Canada as well as across the world are increasingly under attack from intruders attempting to steal information that is safety, business and privacy critical. Such intruders are often backed by criminal enterprises or nation-state actors and are technically very sophisticated with plenty of resources. In 2015, British insurance company Lloyd's estimated the world-wide loss due to cyber crime USD $500 billion. By 2019, this is expected to quadruple to $2 trillion. A crucial weapon in the fight against this worsening crisis is an engineering solution to detect network intrusions and deploy countermeasures. Current intrusion detection systems work by monitoring network activity and looking for activity patterns that match known attack steps. Often, this results in detection after the attack has taken place and response is limited to recovery operations instead of thwarting an ongoing attack. This proposal aims to develop innovative solutions for intrusion detection and response that far surpass the state-of-the-art in following ways: a) generate many possible attack scenarios when an initial stage of an intrusion is detected, b) deploy additional monitoring tools that are specifically designed to gather evidence to confirm or deny these attack scenarios, c) plan defensive measures that can effectively counter the most likely scenarios and d) deploy these defensive measures in a way that is is least disruptive while continually evaluating the situation as above. Long term vision is to develop intelligent intrusion response systems that are aware of the security situation within the next decade. The short term objectives in this proposal that are designed to achieve the above goals include developing a novel way to represent intrusion events that can capture high-level intent as well as low-level network activity, recognizing combinations of intrusion events that are part of a larger attack and deploying these tools within a framework that allows building situational awareness. In the long term, this proposal aims to develop algorithms that can predict impending penetrations based on identification of ongoing attacks and develop countermeasures that can thwart these predicted attacks. A highlight of the proposed research is the development of algorithms that can learn from past attacks as well as setup decoy targets and dynamically change the network paths to divert attacks away from critical systems. The latter will also allow gathering crucial data about these attacks that will be used to design better detection tools in the future. Information security is becoming a critical need for the foreseeable future and innovative approaches as well as highly trained professionals are needed to meet the looming challenges. This program will train the engineers with necessary background as well as with hands-on experience, who will be able to fill this critical and growing need.