SBIR Phase II: Global Correlation Service for Network Security Applications

这一小型企业创新研究第二阶段项目旨在满足企业和政府组织更有效地监控和保护其电子网络的需求。网络安全设备(如防病毒、入侵检测/防御、垃圾邮件/网络钓鱼过滤和带宽异常检测系统)已成为我们网络不可或缺的一部分，因为它们在维护数据完整性和保密性方面提供了宝贵的服务，同时保护了计算资源的可用性。这项研究旨在显著提高NSD在应对快速变化和日益复杂的网络安全攻击方面的及时性、准确性和成本效益。如今，NSD的编程和维护是其广泛采用的一个非常重要的障碍。现有国家可持续发展系统用户最常见和最重要的抱怨是：(1)假阳性事件过多(不应产生的事件)，难以分析安全事件；(2)对安全更新的及时性极为敏感，以发现新出现的威胁；(3)安装、维护和操作这些系统所需的专业知识。这些障碍限制了许多无力聘请专家系统管理员和网络安全分析师的小公司的采用。MetaFlows试图通过提供外包这种复杂性的方法来利用这些缺陷。如果成功，这项研究工作将以廉价和彻底的方式改善许多现有NSD的可管理性、准确性和投资回报。

This Small Business Innovation Research Phase II project is directed toward fulfilling the need of business and Government organizations to more effectively monitor and protect their electronic networks. Network security devices (NSDs) such as Anti-virus, Intrusion Detection/Prevention, spam/phishing filtering, and bandwidth anomaly detection systems have become an integral part of our networks as they provide invaluable services in maintaining data integrity and confidentiality, while protecting the availability of computing resources. This research aims at significantly increasing the timeliness, accuracy and cost-effectiveness of NSDs in combating fast-changing and ever-more sophisticated network security attacks.The programming and maintenance of NSDs is today a very significant obstacle to their wider adoption. The most common and significant complaints of existing NSDs users are (1) excessive amounts of false positive events (events that should not be generated) and the difficulty in analyzing security events (2) their extreme sensitivity to the timeliness of the security updates to catch emerging threats and (3) the expertise required in the installation, maintenance and operation of these systems. These obstacles limit adoption by many smaller companies that cannot afford to hire expert system administrators and network security analysts. MetaFlows seeks to capitalize on these deficiencies by providing ways to outsource this complexity. If successful, this research effort will inexpensively and thoroughly improve the manageability, accuracy and return on investment of many existing NSDs.