Collaborative Research: Cybertrust Center for Internet Epidemiology and Defenses

协作研究：CyberTrust互联网流行病学和防御中心Stefan Savage，加州大学圣迭戈分校Vern Paxson，国际计算机科学研究所奖0433668摘要广泛的软件同质性和互联网不受限制的传播模式相结合，为具有传染性的、自我传播的病原体--“蠕虫”和“病毒”--创造了理想的环境，每一代新的爆发都表现出速度、毒性和复杂性的增加。互联网流行病和防御中心旨在解决两个基本需求：更好地了解互联网流行病的行为和局限性，并开发能够实时自动防御新爆发的系统。了解野生互联网规模的蠕虫的范围和新出现的行为，构成了一门新的科学，称为“互联网流行病学”。为了了解在全球互联网上传播的病原体，该中心正在建造和运行一个规模空前的分布式“网络望远镜”。该望远镜反过来喂养易受攻击的“蜜罐”服务器集合，这些服务器的感染表明存在互联网规模的蠕虫。为了一旦检测到蠕虫，该中心致力于开发机制，获取蠕虫活动的“签名”，并将这些机制传播到部署在全球网络中的蠕虫抑制设备。最后，该中心努力将其研究立足于潜在棘手但高度相关的“现实世界”问题，即在适当使用反蠕虫技术及其应用来提供法医证据方面为法律框架的发展提供信息；并能够开发精算模型，量化互联网流行病造成的总体风险和责任，这对支持新兴的网络保险业至关重要。

Collaborative Research: Cybertrust Center for Internet Epidemiology and DefensesStefan Savage, University of California - San DiegoVern Paxson, International Computer Science InstituteAward 0433668AbstractThe combination of widespread software homogeneity and the Internet's unrestricted communication model creates an ideal climate for infectious, self-propagating pathogens - "worms" and "viruses" - with each new generation of outbreaks demonstrating increasing speed, virulence, and sophistication. The Center for Internet Epidemiology and Defenses aims to address twin fundamental needs: to better understand the behavior and limitations of Internet epidemics, and to develop systems that can automatically defend against new outbreaks in real-time.Understanding the scope and emergent behavior of Internet-scale worms seen in the wild constitutes a new science termed "Internet epidemiology". To gain visibility into pathogens propagating across the global Internet, the Center is pursuing the construction and operation of a distributed "network telescope" of unprecedented scale. The telescope in turn feeds a "honeyfarm" collection of vulnerable "honeypot" servers whose infection serves to indicate the presence of an Internet-scale worm.To then fight worms once detected, the Center works on developing mechanisms for deriving "signatures" of a worm's activity and disseminating these to worm suppression devices deployed throughout the global network.Finally, the Center strives to ground its research in the potentially thorny, but highly relevant, "real-world" issues of informing the development of legal frameworks in terms of the appropriate use of anti-worm technologies and their applications for providing forensic evidence; and enabling the development of actuarial models for quantifying exposure to aggregate risk and liability from Internet epidemics, critical for supporting the emerging cyber-insurance industry.