SBIR Phase I: Global Correlation Service for Network Security Applications

这个小企业创新研究第一阶段项目旨在满足企业和政府组织的需要，以更有效地监测和保护他们的电子网络。 网络安全设备（NSD），如防病毒、入侵检测/预防、垃圾邮件/网络钓鱼过滤和带宽异常检测系统，已成为我们网络中不可或缺的一部分，因为它们在维护数据完整性和机密性方面提供了宝贵的服务，同时保护了我们计算资源的可用性。 这项研究旨在显著提高NSD在应对快速变化和越来越复杂的网络安全攻击方面的及时性，准确性和成本效益。 如果成功，这项工作将提供有效的订阅服务，以根据全球信息更新安全策略，MetaFlows将通过减少误报来提高NSD的可用性。 这将从整体上提高网络安全和成本效益。 国家可持续发展的规划和维持是当今广泛采用国家可持续发展的一个重大障碍。 最常见和最严重的投诉是（1）太多假阳性事件（不应产生的事件）和（2）管理这些器械需要大量专业知识。 这些障碍限制了NSD被许多无力聘请网络安全专家的小公司采用。 这项研究工作将提高许多现有NSD的可靠性、准确性和投资回报率。 该技术的未来扩展将把这种基于订阅的方法推广到所有其他类型的NSD。 除了提高网络的客观安全性外，这些服务及其未来的扩展也将促进网络安全产品的更广泛采用。

This Small Business Innovation Research Phase I project is directed toward fulfilling the need of business and Government organizations to more effectively monitor and protect their electronic networks. Network security devices (NSDs) such as Antivirus, Intrusion Detection/Prevention, spam/phishing filtering, and bandwidth anomaly detection systems have become an integral part of our networks as they provide invaluable services in maintaining data integrity and confidentiality, while protecting the availability of our computing resources. This research aims at significantly increasing the timeliness, accuracy and cost-effectiveness of NSDs in combating fast changing and ever more sophisticated network security attacks. If successful, this effort will provide an effective subscription service to update the security policies based on global information and MetaFlows will increase the usability of NSDs by reducing false positives. This will have the effect of improving network security and cost-effectiveness as a whole. The programming and maintenance of NSDs is today a significant obstacle to their wider adoption. The most common and significant complaints are (1) too many false positive events (events that should not be generated) and (2) the tremendous expertise required in the management of these devices. These obstacles limit NSDs' adoption by many smaller companies that cannot afford to hire network security experts. This research effort will improve the manageability, accuracy and return on investment of many existing NSDs. Future extension of this technology will generalize this subscription-based approach to all other types of NSDs. Besides improving the objective security of networks, these services and their future extensions will also promote a wider adoption of network security products.