Research Initiation Award:Secure measurement-based IP geolocation for Cloud Auditing

田纳西州立大学的研究启动奖题为-基于安全测量的IP地理位置云审计-将通过调查云审计中的新安全问题来加强该大学的网络安全研究计划。教育目标包括将云审计研究整合到精选的本科课程中。云计算是最具诱惑力的技术之一，因为它可扩展、灵活且经济高效地访问计算资源。然而，业务数据和计算能力的日益集中也增加了安全风险。最近的安全担忧之一是云提供商的运营缺乏足够的透明度，导致云审计困难。本项目研究一种关键的网络映射和测量(NMM)技术，即安全IP地理位置，以促进可靠的云审计。总体目标是开发一种基于机器学习的方法，该方法将以比当前最先进的基于测量的IP地理定位技术更高的可靠性、稳健性和敏感度来确定包含用户数据的云节点的地理位置。提出了三个独立但协同的研究目标：1)开发一种基于机器学习的方法来估计复杂网络拓扑中任意主机对之间的跳距，该方法准确、可扩展、及时，并且不需要大量的测量基础设施；2)基于机器学习开发使用延迟测量和跳距的单节点分类器，以检测云网络中敌对客户端伪造的延迟结果；以及3)通过训练汇集来自多个目标节点的延迟和跳数数据，开发一种可扩展且独立于网络延迟水平的融合分类器，允许在任何延迟水平上进行足够数量的训练实例。

Tennessee State University's Research Initiation Award entitled - Secure measurement-based IP Geolocation for Cloud Auditing - will enhance the cyber security research program at the university by investigating novel security problems in cloud auditing. The educational goal involves the integration of cloud auditing research in select undergraduate courses. Cloud computing is one of the most enticing technologies due to its scalable, flexible, and cost-efficient access to computing resources. However, the increased concentration of business data and computing power scales security risks as well. One of the recent security concerns is attributed to the lack of sufficient transparency in the operations of the cloud provider, leading to difficulties in cloud auditing. This project investigates a critical network mapping and measurement (NMM) technique, Secure IP Geolocation, to facilitate reliable cloud auditing. The overarching goal is to develop a methodology based on machine learning that will determine the geolocations of the cloud nodes containing user data with higher reliability, robustness and sensitivity than the current state-of-the art measurement-based IP geolocation techniques. Three separate but synergistic research goals are proposed: 1) develop a machine learning based approach to estimate the hop distances between arbitrary host pairs in complex network topologies that is accurate, scalable, timely, and does not require a significant measurement infrastructure; 2) develop a single node classifier using delay measurements and hop distances based on machine learning to detect forged latency results by adversarial clients in a cloud network; and 3) develop a fusion classifier which is scalable and independent of the network latency levels by training to pool latency and hop count data from multiple target nodes, allowing sufficient number of training examples at any latency level.