NeTS: Medium: Characterizing Enterprise Networks

互联网是一个全球性的“网络的网络”，将广泛的边缘网络连接成一个结构，每天丰富着数百万人的生活和业务。对互联网的研究——从路由行为到流量特征，从推断运营商策略到安全属性等等——在过去的二十年里蓬勃发展。目前存在着大量由研究界进行的研究文献，对互联网的运行产生了许多基于经验的见解。然而，互联网编织在一起的边缘网络——从蜂窝网络到企业网络，从住宅网络到数据中心网络——得到的实证研究要少得多。这些网络的复杂性不断增长，但我们的理解却未能跟上。尽管网络被广泛使用，并在促进现代经济生产力方面发挥了重要作用，但这种规模的网络在研究文献中最多只能得到短暂的检验。研究这些类型的网络的部分问题是，分析工具的一般可用性几乎不存在。虽然分析来自广域网的数据包跟踪数据的工具很多，但对于企业网络来说并非如此。例如，在企业网络中存在许多应用层协议，但很少传输共享的Internet，因为没有数据包跟踪分析工具。在这个项目中，我们将在Bro入侵检测系统的背景下开发这样的工具。这些工具将形成一种能力，使研究社区能够对企业网络进行深入分析。知识价值：企业网络是非常复杂的实体，社区对它的研究还远远不够。这个项目将极大地扩大和深化我们对这些关键网络进行合理测量的能力。更广泛的影响：通过将企业网络分析技术直接构建到开源的Bro网络监控系统中，我们将能够广泛访问这些新功能，帮助研究人员进行企业网络调查，以及部署Bro来保护其网络的安全运营商。由于Bro拥有数百名用户，为后者提供新的分析功能将对网络安全产生重大的现实影响。

The Internet is a global ``network of networks,'' connecting a broad range of edge networks together into a fabric that enriches the lives and businesses of millions of people every day. Study of the Internet---from routing behavior to traffic characteristics to inferring operator policies to security properties and beyond---has blossomed over the past two decades. A large literature now exists of studies undertaken by the research community, producing much empirically-based insight into the Internet's operation. However, the edge networks that the Internet weaves together---from cellular to enterprise to residential to data center networks---have received far less empirical study. The complexity of these networks grows ever-increasing, yet our understanding has failed to keep pace.Despite their widespread use and major roles in facilitating modern economic productivity, networks at this scale have received at best fleeting examination in the research literature. Part of the issue with studying these types of networks is that general availability of analysis tools is nearly non-existent. While tools to analyze packet trace data from wide-area networks are plentiful, this is not the case for enterprise networks. For instance, there are many application layer protocols that manifest inside enterprise networks, but rarely transit the shared Internet, for which no packet trace analysis tools exist. In this project we will develop such tools in the context of the Bro intrusion detection system.These tools will form a capability that enables deep analysis of enterprise networks by the research community at-large.Intellectual merit: Enterprise networks are vastly complicated entities that have been significantly understudied by the community. This project will dramatically broaden and deepen our capability to soundly measure these critical networks.Broader impact: By building enterprise network analysis techniques directly into the open-source Bro network monitoring system, we will enable broad access to these new capabilities, aiding both researchers conducting investigations of enterprise networks, and security operators who deploy Bro to protect their networks. As Bro has hundreds of users, providing this latter group with new analysis capabilities will have a significant real-world impact on network security.