CT-ISG: Modeling, Estimation, and Defense against Network Attacks

互联网的便捷访问和广泛使用使其成为恶意活动的主要目标和渠道。它构成了经济和社会结构中的关键基础设施，不仅是我们的国家，而且是发达国家和日益发展中的世界的关键基础设施。近年来，互联网已成为传播恶意软件程序的强大机制。它们被设计用来骚扰(例如，污损网页)、传播错误信息(例如，虚假新闻报道或股票报价)、拒绝服务(例如，损坏的硬盘)、窃取金融信息(例如，Visa卡号码)、启用远程登录(例如，特洛伊木马)等。此外，它们还被用来扰乱互联网本身内的正常操作。此外，发生重大网络中断的可能性极高。众所周知，1997年4月25日，一台配置错误的BGP路由器有效地关闭了大多数主要互联网主干长达两个小时，从而引发了一系列级联故障。如果意外错误配置的路由器能够造成如此严重的破坏，人们只能想象精心策划的攻击会以中断的方式产生多大的破坏。尽管恶意活动曾多次出现，但到目前为止，似乎还没有明确定义的方法来预测它们的行为和可能造成的损害。该提案描述了旨在开发可靠的基于数学的方法的研究，这些方法可以用来更好地了解不同网络攻击的特征，并检测和估计其参数。更具体地说，拟议的研究将集中在以下方面。o网络攻击的数学模型。研究人员将开发一种基于流体模型和网络马尔可夫链(NMC)的建模方法。这些模型将用于回答以下问题：网络拓扑如何影响互联网蠕虫的传播？攻击必须满足什么条件才能被认为是致命(严重)的？o检测和参数估计。研究人员将根据网络攻击早期阶段的指数增长趋势，分别使用流体模型和点过程模型，为不同类型的监视器开发检测和参数估计技术。他们还将开发基于假设测试的检测方法，并研究其性能和对防御策略的影响。此外，本研究产生的分析方法将在电网等大型复杂人造系统的故障和攻击场景的设计和分析中具有广泛的适用性。智力优势：该项目将产生研究和检测不同网络攻击(如蠕虫、电子邮件病毒、BGP基础设施攻击)的新技术。此外，该项目将加深我们对失败如何在像互联网这样的大型分布式系统中传播，以及更广泛地说，大型人造系统中的传播的理解。广泛的影响：该项目通过项目教师对学生的密切互动和指导，将研究生和本科生的研究和教育整合在一起。我们还将通过联合课程/研讨会的形式寻求与巴西大学的国际参与。

The easy access and wide usage of the Internet makes it a prime target and conduit for malicious activities. It constitutes a critical infrastructure in the economic and social fabric of, not only our nation, but the developed and, increasingly, the developing world. Recently, the Internet has become a powerful mechanism for propagating malicious software programs. These have been designed to annoy (e.g., deface web pages), spread misinformation (e.g., false news reports or stock quotes), deny service (e.g., corrupt hard disks), steal financial information (e.g., VISA card numbers), enable remote login (e.g., Trojan horses), etc. Moreover, they have been used to disrupt normal operations within the Internet itself. Furthermore, the potential for significant network disruptions is extremely high. It is well known that a single misconfigured BGP router on April 25th, 1997 effectively shut down most of the major Internet backbones for up to two hours, unleashing a sequence of cascading failures. If an accidentally misconfigured router can wreak such havoc, one can only imagine what a carefully orchestrated attack can produce in the way of disruptions.Although malicious activities have appeared on many occasions, to date there appears to be no well-defined methodology for predicting their behavior and the damage that they can cause. This proposal describes research aimed at developing sound mathematically-based methodologies that can be used to better understand the characteristics of different network attacks, and to detect and estimate their parameters. More specifically, the proposed research will focus on the following areas.o Mathematical models of network attacks. The researcher will develop a modelling methodology based on fluid models and networked Markov chains (NMCs). These models will be used to answer questions such as: how does network topology affect the spread of an Internet worm? What conditions must an attack meet to be considered virulent (severe)?o Detection and parameter estimation. The researchers will develop detection and parameter estimation techniques for different types of monitors, based on the exponential growth trend in the early stage of the network attacks, with fluid models and point process models, respectively. They will also develop "hypothesis testing" based detection methods and study the performance and the impact in the defense strategies.Furthermore, the analysis methodology produced by this research will have broad applicability in the design and analysis of failure and attack scenarios in large complex man made systems such as the power grid.Intellectual Merit: This project will generate new techniques for studying and detecting different network attacks (e.g., worms, email viruses, BGP infrastructure attacks). Furthermore, the project will enhance our understanding of how failures can propagate throughout a large distributed system like the Internet, and, more generally, large man-made systems.Broader Impact: The project integrates research and education of graduate and undergraduate students through the close interaction and mentoring of students by project faculty. We will also seek international involvement with Universities in Brazil in the form of joint courses/seminars.