EAGER: Exploring Security Issues in Next-Generation Networking Infrastructure

互联网提供了商业、个人通信、电子政务和娱乐所必需的数据通信。我们的社会对广泛可用的数据通信网络的依赖使这些系统成为当今基础设施的关键部分。支持新兴技术和网络范例的需求导致了许多持续不断的努力，以开发能够改进和取代现有网络系统的新型网络体系结构。许多新的网络设计使用虚拟网络基础设施，在该基础设施上可以实例化具有不同协议堆栈的网络。为了实现这种数据通信网络的动态部署，使用了带有嵌入式分组处理系统的可编程路由器。将这些新系统引入网络将为使用网络或以网络本身为目标的新网络攻击打开大门。这项工作将研究在这种新的虚拟化和可编程网络环境中出现的安全问题，并开发可用于识别、缓解和可能避免攻击的技术。研究人员将研究如何在下一代网络中表征攻击，以及如何开发新的异常检测算法。这些算法将使用协议层之间的协作以及节点和自治系统之间的分布式检测机制来实现高检测能力，以帮助防御网络基础设施。这项工作的智力价值在于对新兴网络设计中的漏洞和可能的防御提供洞察，这些设计与当今的互联网有着根本的不同。这项工作的更广泛影响旨在提供必要的技术，以保护下一代互联网免受网络攻击。

The Internet provides data communication that is essential for business, personal communication, E-Government, and entertainment. Our society's reliance on the broad availability of data communication networks makes these system a critical part of today's infrastructure. The need to support emerging technologies and networking paradigms has led to numerous ongoing efforts to develop novel network architectures that can improve and replace existing network systems. Many new network designs use a virtualized network infrastructure on which networks with different protocol stacks can be instantiated. To implement such dynamic deployment of data communication networks, programmable routers with embedded packet processing systems are used. The introduction of these new systems into the network opens the doors for new cyber attacks that use the network or target the network itself.This work will study the security issues that arise in this new virtualized and programmable networking environment and develop techniques that can be used to identify, mitigate, and possibly avoid attacks. The researchers will study how attacks can be characterized in next-generation network and how novel anomaly detection algorithms can be developed. The algorithms will use cooperation between protocol layers and distributed detection mechanisms between nodes and autonomous systems to achieve high detection capabilities that aid in defending the network infrastructure. The ability of programmable nodes to aid in the detection process will be leveraged.The intellectual merit of this work lies in providing insights on vulnerabilities and possible defenses in emerging network designs, which are fundamentally different from today's Internet.The broader impact of this work aims at providing the technology necessary to protecting the next-generation Internet from cyber attacks.