TC: Medium: Collaborative Research: Towards Self-Protecting Data Centers: A Systematic Approach

TC：中型：合作研究：走向自我保护数据中心：系统性APOACHTC-0905189 Sushil Jajodia，乔治梅森大学TC-0905131，宾夕法尼亚州立大学刘鹏，TC-0905153，西伊利诺伊大学孟宇摘要该奖项由2009年美国复苏和再投资法案(公共法律第111-5条)资助。使用虚拟机(VM)整合的数据中心正在接管由个别公司运营的旧机房。但是，整合服务和资源不会自动整合安全性。为了满足现代数据中心的两大要求，即业务连续性和信息安全，本研究将采取系统化的方法，利用新兴的VM技术来整合系统安全研究的四个领域：冗余、微观入侵分析和检测、自动响应和多样性驱动的保护。我们将在安全整合的各个方面做出创新性的贡献，包括(1)基于多样化复制的体系结构和底层技术，以防御未知攻击；(2)用于因果关系记录、事件关联、损害评估和取证的新的跨层和跨VM方法；(3)基于独特的跨VM副本不一致性检查技术的新的入侵检测技术，以及新的跨层不一致性检查方法；(4)面向自动入侵响应的新的流水线方法；以及(5)动态数据中心入侵限制和恢复的新技术。我们的研究将在帮助任务/生命/业务关键型应用程序和信息系统降低风险、提高业务连续性并在出现严重网络攻击时提供数据保障方面取得重大进展。教育、外展和传播举措也将产生更广泛的影响。该项目的教育资源，包括课程单元和教学实验室设计，将通过一个专门的网站传播。关键词：自我保护；恢复；虚拟机监控；因果关系；可用性

TC: MEDIUM: COLLABORATIVE RESEARCH: TOWARDS SELF-PROTECTING DATA CENTERS: A SYSTEMATIC APPROACHTC-0905189 Sushil Jajodia, George Mason UniversityTC-0905131 Peng Liu, Pennsylvania State UniversityTC-0905153 Meng Yu, Western Illinois UniversityAbstractThis award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5). Data centers using virtual machine (VM) consolidation are taking over old computer rooms run by individual companies. However, consolidating services and resources does not consolidate security automatically. To meet the top two requirements for modern data centers, namely business continuity and information security, this research will take a systematic approach that leverages the emerging VM technologies to consolidate four areas of systems security research: redundancy, microscopic intrusion analysis and detection, automatic response, and diversity-driven protection. We will make innovative contributions on various aspects of security consolidation, including (1) An architecture and underlying techniques based on diversified replication towards defensive protection against unknown attacks; (2) Novel cross-layer and cross-VM methods for causal relation logging, event correlation, damage assessment, and forensics; (3) New intrusion detection techniques based on unique cross-VM-replica inconsistency checking techniques, and new cross-layer inconsistency checking methods; (4) A novel pipelining approach towards automated intrusion response; and (5) New techniques for on-the-fly data center intrusion confinement and recovery.Our research will result in significant advances in helping mission/life/business critical applications and information systems reduce risk, increase business continuity, and deliver data assurance in the presence of severe cyber attacks. Broader impact will also result from the education, outreach, and dissemination initiatives. Educational resources from this project, including course modules and teaching laboratory designs, will be disseminated through a dedicated Website. Key Words: self-protection; recovery; virtual machine monitor; causal relations; availability