Collaborative Proposal Cybertrust: Center for Internet Epidemiology and Defenses

合作研究：互联网流行病学和防御网络信任中心Stefan Savage，加州大学圣地亚哥分校Vern Paxson，国际计算机科学研究所Award 0433668摘要广泛的软件同质性和互联网不受限制的通信模式的结合为传染性的、自我传播的病原体-“蠕虫”和“病毒”-创造了理想的环境，每一代新的爆发都表现出越来越快的速度、毒性、和复杂性 互联网流行病学和防御中心旨在解决两个基本需求：更好地了解互联网流行病的行为和局限性，并开发能够实时自动防御新爆发的系统。了解野外互联网规模蠕虫的范围和紧急行为构成了一门新的科学，称为“互联网流行病学”。 为了了解病原体在全球互联网上的传播情况，该中心正在建造和运行一个规模空前的分布式“网络望远镜”。 该望远镜反过来又向一个由易受攻击的“蜜罐”服务器组成的“蜜罐农场”提供信息，这些服务器的感染表明存在互联网规模的蠕虫。为了在检测到蠕虫后立即与蠕虫作斗争，该中心致力于开发一种机制，用于获取蠕虫活动的“特征”，并将这些特征传播到部署在全球网络中的蠕虫抑制设备。最后，该中心努力将其研究建立在潜在的棘手但高度相关的“现实世界”问题上，即在适当使用反蠕虫技术及其应用程序提供法医证据方面为法律的框架的发展提供信息;以及能够开发精算模型，用于量化互联网流行病的总风险和责任，这对支持新兴的网络保险业至关重要。

Collaborative Research: Cybertrust Center for Internet Epidemiology and DefensesStefan Savage, University of California - San DiegoVern Paxson, International Computer Science InstituteAward 0433668AbstractThe combination of widespread software homogeneity and the Internet's unrestricted communication model creates an ideal climate for infectious, self-propagating pathogens - "worms" and "viruses" - with each new generation of outbreaks demonstrating increasing speed, virulence, and sophistication. The Center for Internet Epidemiology and Defenses aims to address twin fundamental needs: to better understand the behavior and limitations of Internet epidemics, and to develop systems that can automatically defend against new outbreaks in real-time.Understanding the scope and emergent behavior of Internet-scale worms seen in the wild constitutes a new science termed "Internet epidemiology". To gain visibility into pathogens propagating across the global Internet, the Center is pursuing the construction and operation of a distributed "network telescope" of unprecedented scale. The telescope in turn feeds a "honeyfarm" collection of vulnerable "honeypot" servers whose infection serves to indicate the presence of an Internet-scale worm.To then fight worms once detected, the Center works on developing mechanisms for deriving "signatures" of a worm's activity and disseminating these to worm suppression devices deployed throughout the global network.Finally, the Center strives to ground its research in the potentially thorny, but highly relevant, "real-world" issues of informing the development of legal frameworks in terms of the appropriate use of anti-worm technologies and their applications for providing forensic evidence; and enabling the development of actuarial models for quantifying exposure to aggregate risk and liability from Internet epidemics, critical for supporting the emerging cyber-insurance industry.