TWC: Small: Understanding Network Level Malicious Activities: Classification, Community Detection and Inference of Security Interdependence

该项目的目标是开发一种正式的方法来定量评估大型网络的安全态势，并为它们分配一个数值分数。大型网络是由一组单独的机器组成的，这些机器作为一个组比在IP级别上表现出更稳定的行为和功能，在IP级别上每个主机都被单独检查。因此，聚合级别的网络具有更强的预测能力，能够实现更强大和更准确的策略设计。对网络数据的大规模统计分析构成了两组指标的基础。第一种是将网络作为一个独立的实体，与同一生态系统中的其他网络无关。第二个问题涉及作为许多互连网络之一的网络。第二组是至关重要的，因为一个网络的行为会影响其邻居网络。如果一个网络容忍恶意行为，它的网络邻居就会受到影响。该项目使网络运营商能够设计网络安全策略，这些策略可以在网络或组织层面上有意义地应用，例如互联网服务提供商之间的对等安排、流量路由决策和激励机制（例如，网络保险），旨在鼓励组织采取更好的安全做法和投资。因此，预计该项目的成果将对整个互联网核心的安全和激励政策设计产生重大影响。

This goal of this project is development of a formal method to quantitatively assess the security posture of large networks and assign them a numeric score. Large networks are made up of a collection of individual machines, which exhibit more stable behavior and features as a group than at the IP level, where each host is inspected separately. Networks at an aggregate level thus carry more predictive power, enabling a more robust and accurate policy design. A large-scale statistical analysis of network data forms the basis of two sets of metrics. The first concerns a network as a standalone entity irrespective of other networks in the same ecosystem. The second concerns a network as one of many inter-connected networks. This second set is crucial due to the fact that the actions of one network affect its neighbor networks. If a network tolerates malicious behavior, its network neighbors feel the impact.This project enables network operators to design network security policies that can be meaningfully applied at a network or organizational level, for example peering arrangements between Internet Service Providers, traffic routing decisions, and incentive mechanisms (e.g., cyber insurance) aimed at encouraging better security practices and investment by organizations. The outcome of this project is thus expected to have significant impact on security and incentive policy design across the very core of the Internet.