CT-ISG: Computer Log Anonymization and Information Sharing

提案ID：0524643标题：CT-ISG：计算机日志匿名和信息共享PI：Adam Slagell要使计算机和网络日志匿名最有用，解决方案必须是可定制的。目前的工具不灵活，不支持超过一种类型的日志。这反过来又抑制了日志共享，使得对现代、分布式和协同攻击的检测和响应变得更加困难。这个项目的主要目标是创建一个匿名化框架，允许用户从多个匿名化级别中进行选择，这些匿名化级别在信息丢失和保护敏感日志记录信息之间做出不同的权衡。本研究通过解决以下5个研究问题来实现这一点：(1)根据可检测的安全事件的类型来创建日志分类；(2)基于一组日志中的不同字段来创建效用度量；(3)确定不同的匿名算法如何影响该度量；(4)确定匿名算法的选择如何影响匿名方案本身的强度；以及(5)创建一种体系结构，该体系结构在针对给定的安全需求优化日志效用度量的同时为日志提供多级匿名。该研究项目的结果将消除阻碍许多组织共享日志的障碍，从而使其更有可能检测和了解广泛和有组织的攻击。

Proposal ID: 0524643Title: CT-ISG: Computer Log Anonymization and Information SharingPI: Adam SlagellTo make computer and network log anonymization most useful, solutions must be customizable. Current tools are inflexible and do not support more than a single type of log. This, in turn, has inhibited log sharing, making the detection and response to modern, distributed and coordinated attacks more difficult. The main goal of this project is to create an anonymization framework that allows users to choose from multiple levels of anonymization that make different trade-offs between information loss and the protection of sensitive logging information. This research accomplishes this by addressing the following 5 research problems: (1) create a classification of logs by the types of security events that can be detected, (2) create a metric of utility based upon the different fields within a set of logs, (3) determine how different anonymization algorithms affect this metric, (4) determine how the choice of anonymization algorithms affects the strength of the anonymization scheme itself, and (5) create an architecture that provides multi-level anonymization for logs while optimizing the log utility metric for a given security requirement. The results of this research project will remove barriers that have prevented many organizations from sharing logs, thus making it more likely to detect and understand broad and coordinated attacks.