CAREER: Exterminating Large Scale Internet Attacks

蠕虫和分布式拒绝服务（DDoS）攻击等大规模互联网攻击的规模和复杂性不断增加，对我们的社会、政府、经济和关键基础设施构成了越来越大的威胁。因此，设计针对蠕虫和DDoS攻击的防御措施是最紧迫的研究挑战之一。本研究提出新的方法和技术来防御这些大规模的互联网攻击。首先，本研究提出了一种新的方法来自动防御蠕虫。通过设计新的自动化方法来快速准确地检测软件漏洞攻击，并生成和分发准确的过滤器/签名，该方法旨在保护易受攻击的主机，并提供一个易于部署和有效的防御破坏性的新蠕虫爆发，包括零日漏洞攻击。第二，本研究提出了设计一个DDoS弹性的互联网基础设施。本研究不仅针对当前的互联网，更重要的是针对下一代互联网，探讨防止DDoS攻击所需的设计特征和安全机制，为防御大规模的互联网攻击提供基础性的新技术，并为构建抵御攻击的通信基础设施奠定基础，具有广泛的影响。

Large-scale Internet attacks such as worms and Distributed Denial-of-Service (DDoS) attacks are increasing in scale and sophistication, and are posing an escalating threat to our society, government, economy, and critical infrastructures. Designing defenses against worm and DDoS attacks is thus one of the most urgent research challenges. This research proposes novel approaches and techniques to defend against these large scale Internet attacks.First, this research proposes a new approach for automatic defense against worms. By designing novel automatic methods to detect software exploit attacks quickly and accurately, and to generate and disseminate accurate filters/signatures, this approach aims to protect vulnerable hosts and provide an easy-to-deploy and effective defense against devastating new worm outbreaks, including zero-day exploit attacks.Second, this research proposes to design a DDoS-resilient Internet infrastructure. This research will investigate the design characteristics and security mechanisms necessary to prevent DDoS attacks not only in the current Internet, but more importantly, in the next generation Internet.This project will provide fundamental new techniques for defending against large-scale Internet attacks, and will have broad impact in providing foundations for building an attack-resilient communication infrastructure.