CAREER: SMART -- A Scalable Monitoring, Analysis, and Response Toolkit for the Internet

网络管理中的一个中心问题是如何监控、分析由于各种原因(如故障、错误配置、路由不稳定、闪存拥塞、分布式拒绝服务(DDoS)攻击和计算机蠕虫)而导致的不断变化的网络状况并做出反应。手动跟踪和应对此类变化是劳动密集型的，容易出错，而且在许多情况下是不可行的(例如，现代蠕虫可以在几分钟内造成灾难性破坏--对于人类手动响应来说，时间尺度太小)。因此，开发完全自动化的网络监控、分析和响应过程的工具和技术是一个重要而紧迫的研究挑战。研究通过开发可扩展的监控、分析和响应工具包(SMART)来解决上述挑战。SMART允许应用程序执行网络范围的流量监控，识别网络状态中的异常和变化，诊断变化的原因，并动态控制网络流量--所有这些都是以自动方式进行的。通过将实用的网络领域知识和工程经验与算法、统计、数据挖掘和机器学习方面的坚实理论基础相结合，SMART具有可扩展性、准确性、健壮性和易于部署的特点。它可以显著简化大规模网络管理和安全应用的开发和部署。为了展示SMART的实用价值，该研究使用该工具包开发了两个重要的现实世界安全应用程序：自动蠕虫指纹识别和基于网络的DDoS防御。最后，这项研究包括一个重要的教育和培训部分。该项目的研究成果将通过开发新课程纳入本科生和研究生课程。

Yin ZhangUniversity of Texas, Austin0546720AbstractA central problem in network management is how to monitor, analyze, and react to changing network conditions due to various reasons such as failures, misconfigurations, routing instability, flash crowds, distributed denial-of-service (DDoS) attacks, and computer worms. Manually tracking and reacting to such changes is labor-intensive, error-prone, and in many cases infeasible (e.g. modern worms can causecatastrophic damages within minutes -- too small a timescale for human to respond manually). It is therefore an important and urgent research challenge to develop tools and techniques to fully automate the process of network monitoring, analysis, and response.The research addresses the above challenge by developing a ScalableMonitoring, Analysis, and Response Toolkit (SMART). SMART allows applications to perform network-wide traffic monitoring, identifyanomalies and changes in the network state, diagnose the causes for the changes, and dynamically control the network traffic -- all in an automated fashion. By integrating practical network domain knowledge and engineering experience with solid theoretical foundations in algorithms, statistics, data mining, and machine learning, SMART is scalable, accurate, robust, and easy-to-deploy. It can significantly simplify the development and deployment of large-scale network management and security applications. To demonstrate the practical values of SMART, the research develops two significant real-world security applications using the toolkit: automated worm fingerprinting, and network-based DDoS defense. Finally, the research includes a significant education and training component. The research results of the project will be integrated into both the undergraduateand the graduate curricula through the development of new courses.