Quantitative Network Security Analysis

题目：定量网络安全分析pi: David Moore， Geoffrey M. Voelker， Stefan savage该研究调查了以下问题：大规模互联网安全威胁的性质如何随着时间的推移而变化，攻击者如何有效地破坏服务，以及现有的安全对策在实践中如何为这些威胁提供有意义的防御？这就需要开发网络分析技术和网络测量基础设施的组合来分析这些威胁。特别地，这个项目有三个具体目标。首先，我们的原型测量基础设施将被重新设计，以提供对当前互联网范围内安全异常的实时分析。这将允许主动测量来表征攻击的影响，安全对策和补丁的存在和有效性，并更好地将这些数据与其他网络测量数据来源相关联。其次，长期跟踪这些事件可以提取大规模网络攻击的流行、构成和阶段的趋势。创建这种纵向数据集对于理解被利用的威胁和漏洞的演变至关重要。最后，虽然已经对大规模同质攻击的结果进行了初步验证，但这些技术如何也能用于观察较小或高度倾斜的攻击分布，这是一个悬而未决的问题。本研究将通过比较较小规模的监测器和单个网络上的直接测量来评估技术的分辨率。这些努力将产生关于互联网大规模网络攻击的第一个有意义的数据集。希望这些数据最终会产生超出本研究单个结果的影响，并将改变网络安全决策的方式。

Proposal number: CCR-0311690Title: Quantitative Network Security AnalysisPIs: David Moore, Geoffrey M. Voelker, Stefan SavageThe research investigates the following questions: how does the nature oflarge-scale Internet security threats change over time, how effectiveare attackers at compromising services, and how well do existingsecurity countermeasures provide a meaningful defense against thesethreats in practice?This requires the development of a combination of network analysistechniques and network measurement infrastructure to analyze thesethreats. In particular, this project has three specific goals. First,our prototype measurement infrastructure will be re-engineered toprovide real-time analysis about current Internet-wide securityanomalies. This will allow for active measurements to characterize theimpact of attacks, the presence and effectiveness of securitycountermeasures and patches, and to better correlate this data withother sources of network measurement data. Second, tracking theseevents on a long-term basis allows extraction of trends in theprevalence, make-up, and staging of large-scale Internet attacks.Creating this kind of longitudinal dataset is essential forunderstanding the evolution of the threats and vulnerabilities beingexploited. Finally, while there has been initial validation of resultsconcerning large-scale homogenous attacks, it is an open question howwell these techniques can be used for also observing smaller or highlyskewed attack distributions. This research will evaluate the resolutionof techniques by comparing with smaller scale monitors and directmeasurements on individual networks. Together these efforts willproduce the first meaningful datasets about large-scale network attackson the Internet. It is hoped that this data will ultimately have impactbeyond the individual results of this research, and will change the waynetwork security decisions are made.