STI: Viable Network Defense for Scientific Research Institutions

现代科学大量使用互联网进行协作，这些协作远远超出了简单的用途，例如用于讨论的电子邮件和用于共享数据的Web访问（在某些情况下有数百种不同的服务）。这种访问也为不断的网络攻击打开了大门，研究机构发现自己面临越来越大的压力，不得不以防火墙、限制允许的应用程序和强制代理的形式对这种访问施加重大限制。这些问题可能会削弱现代科学在广泛学科领域的有效性。保持开放性的一个关键工具是入侵检测：实时检测正在进行的攻击，如果有必要，启动响应以阻止它。然而，在小规模环境（如研究人员的局域网）中检测攻击者与在大规模环境（如整个开放站点）中检测攻击者之间存在着天壤之别。更高的性能要求和大幅增加的流量多样性都带来了重大挑战。但是，对于大型开放站点的入侵检测，学术研究却很少，因为许多研究人员在获取必要的访问权限方面面临着巨大的困难。然而，由于他在ICSI和LBNL的联合任命，该提案的PI在开发和验证这些站点的网络入侵检测研究方面处于独特的地位。LBNL的运营网络安全以使用由PI开发的入侵检测系统BRO为中心。PI可以完全监控实验室的网络流量，并参与大型研究所的网络安全现实。此外，加州大学伯克利分校（University of California, Berkeley）也在使用BRO， PI同样拥有完全的监控权限。拟议的努力将牢固地建立在保护大型研究机构的现实基础上。作品不会是抽象的；它将验证针对实际现场攻击和实际操作需求开发的机制，避免设计在实际部署时失败的有吸引力的解决方案的陷阱。研究将跨越多个领域：(i)开发检测攻击的新方法（检测自动攻击软件和蠕虫使用的网络“触发器”；试图通过用户的击键时间来“指纹”；利用LBNL的大量TCP连接摘要存档来设计健壮的异常检测算法）；（ii）解决在监控高速、高容量链路方面的挑战（在多台机器上分配监控；与边界路由器协调监控，将一部分流量“分流”到监视器，并切断其余的流量；设计强大的机制来处理大规模的流量洪水）；（iii）解决管理大规模安全策略的现实问题（理解单个警报和导致它们的复杂策略之间的关系；自动定位不再相关的“过时”策略元素）。这项工作将推动两个关键领域的发展：（iv）改进和应用早期开发的跟踪匿名化框架，以解决网络入侵检测研究中完全缺乏包括数据包内容的流量跟踪的主要缺点；(v)将BRO软件系统提升至必要的支持水平，使其成为大型科研机构业务部署的首选开源监测系统。

Modern science makes heavy use of the Internet for collaborations that draw upon the network in ways far beyond simple uses such as email for discussion and Web access for sharing data in some cases several hundred distinct services. This access also opens the doors to incessant network attacks and research institutes find themselves under growing pressure to place significant restrictions on such access in the form of firewalls, limited permitted applications, and mandatory proxies. These issues threaten to diminish the effectiveness of how modern science is conducted across a broad range of disciplines. A key tool to maintain openness is intrusion detection: detecting in real-time that an attack is underway and, if warranted, initiating a response in order to thwart it. However, there is a world of difference between detecting attackers in a small-scale environment such as a researcher's LAN and doing so at a large scale such as for an entire open site. Both the much higher required performance and the greatly increased traffic diversity present major challenges. But intrusion detection for large, open sites also sees very little in the way of academic research, because of the great difficulties many researchers face in acquiring the necessary access.The PI of this proposal, however, is in a unique position for developing and validating network intrusion detection research at such sites, by virtue of his joint appointment at ICSI and LBNL. LBNL's operational cyber security is centered around use of BRO- the intrusion detection system developed by the PI. The PI has full monitoring access to the Laboratory's network traffic, and participation in the realities of network security at a large institute. In addition, BRO is used operationally at the University of California, Berkeley, where the PI likewise has full monitoring access. The proposed efforts will be firmly grounded in the realities of defending large research institutions. The work will not be abstract; it will validate mechanisms developed against actual in situ attacks and actual operational needs, avoiding the pitfall of devising attractive solutions that fail in practice when actually deployed. The research will be spanning a number of areas: (i) developing new ways of detecting attacks (detecting network "triggers" used by automated exploit software and by worms; attempting to "finger print" users by their keystroke timing; drawing upon LBNL's immense archive of TCP connection summaries to devise robust anomaly detection algorithms); (ii) addressing challenges in monitoring very high-speed, high volume links (distributing monitoring across multiple machines; coordinating monitors with border routers that will "shunt" a portion of the traffic to the monitor and cut through the rest; devising robust mechanisms for dealing with massive traffic floods); and (iii) addressing the realities of managing large-scale security policies (understanding the relationship between individual alerts and the complex policies that lead to them; automatically locating "stale" policy elements no longer relevant). The work will advance development in two key areas: (iv) refining and applying the trace anonymization framework developed in earlier in order to address the major shortcoming in network intrusion detection research of a complete lack of traffic traces that include packet contents; and (v) bringing the BRO software system up to the level of support necessary for it to become the open-source monitoring system of choice for operational deployment at large scientific research institutes.