TWC: Small: Managing User-Level Compromises in Enterprise Networks

组织需要保护他们的计算机系统免受攻击者的攻击。他们通常将自己的计算机分组到风险池中，以减少威胁传播并监视这些组之间的通信。遗憾的是，这种边界监控无法看到组内的流量，而且由于每个监控器都是分段的，它们不能形成整个网络的整体图景。最后，现代方法必须孤立地检查网络流量，而不能知道原始计算机上的什么操作导致了网络流量。该项目通过为所有网络流量创建一个集中的访问控制系统来解决网络控制和理解方面的这些限制。通过每台计算机上的监控软件，访问控制器可以了解发起主机的操作环境和发起网络流量的应用程序。这使访问控制器能够做出明智的决策。为了实现这些目标，该项目研究了三个方向：1)它监视计算机请求，以便将人类可读的主机名转换为计算机可路由地址；2)它强制所有流量，即使是在风险池中，也必须得到路由器和访问控制器的批准；3)它为每台计算机配备监控每个应用程序的网络流量和与人工操作员的交互的软件，以向访问控制器提供上下文。该项目将提高计算机系统和网络的安全性，这将对政府、军事、教育和工业组织产生直接影响。该项目将改善研究生和本科生的教育实验，同时还支持课外教育活动，如网络安全竞赛。

Organizations need to protect their computer systems from attackers. They often group their own computers into risk pools to reduce threat propagation and monitor the communication between these groups. Unfortunately, this boundary monitoring is unable to see traffic within groups and, since each monitor is segmented, they cannot form a holistic picture of the entire network. Finally, modern approaches must examine network traffic in isolation, without the ability to know what action on the originating computer caused it.This project addresses these limitations in network control and understanding by creating a centralized access control system for all network traffic. With monitoring software on each computer, the access controller learns about the originating host's operating context and the application that initiated the network traffic. This empowers the access controller to make informed decisions.To achieve these goals, the project investigates three directions: 1) it monitors computer requests to translate human-readable host names into computer-routable addresses, 2) it forces all traffic, even within a risk pool, to receive approval from a router and access controller, and 3) it instruments each computer with software that monitors each application's network traffic and interactions with the human operator to provide a context to the access controller. This project will increase the security of computer systems and networks, which will have a direct impact on government, military, educational, and industrial organizations. The project will improve educational experiments at both the graduate and undergraduate levels while also supporting extracurricular educational activities, such as cyber security competitions.