CRII: OAC: Inferring, Attributing, Mitigating and Analyzing the Malicious Orchestration of Internet-scale Exploited IoT Devices: A Network Telescope Approach

尽管在消费市场和关键基础设施-所谓的物联网(IoT)设备-广泛采用和部署各种支持互联网的设备(如手机和智能家居组件)带来了好处，但安全担忧正在上升，因为此类设备也引入了新的漏洞，攻击者可能会利用这些漏洞发动破坏性的网络攻击。该项目的目标是通过探索应用于原始网络安全数据的创新数据分析，来探索物联网范式的内在不安全性。所获得的洞察力将允许近乎实时地检测、表征和归因于互联网规模的受危害的物联网设备及其恶意活动。有几个技术挑战阻碍了整个物联网安全的解决，包括物联网设备的过度多样化以及互联网范围内的部署，缺乏与物联网相关的数据，以及缺乏针对物联网的可操作攻击签名。在这种背景下，该项目服务于NSF的使命，即通过旨在产生一种首创的、大规模的对受危害的物联网设备的规模的分析来促进科学进步。该项目还促进了对少数族裔的网络安全研究和培训，因为它将在指定的拉美裔服务机构的边界内执行。此外，该项目将通过开发存储和共享物联网相关威胁信息的实时能力，为运营网络安全做出贡献。该项目将利用从网络望远镜实时收集的宏观、大规模被动测量数据，以突显物联网范式不安全的严重性。网络望远镜，通常被称为飞镖，构成了一组可路由的、已分配但未使用的IP地址。该项目将设计和开发实时算法，能够通过探索暗网数据来推断互联网规模的被利用的物联网设备。此外，该项目将调查与物联网相关的被动测量和恶意软件样本之间植根于随机数据结构的正式关联方法，以帮助确定属性，从而实现补救目标。该项目将进一步探索看似独立的物联网活动的协调行为，这些活动在协调良好的物联网僵尸网络中运行。为此，该项目将创新基于三角内插技术、递归最优随机估计器和位图匹配算法的时间序列分析，通过使用被动测量来推断此类物联网僵尸网络。此外，该项目还将(1)通过自动化所提出的算法、技术和方法，为物联网网络威胁索引开发独特的网络基础设施，(2)通过采用分段散列技术来生成物联网特有的签名，以及(3)基于API机制和Elasticearch提供的前端服务来创建访问方法，以允许共享以物联网为中心的经验数据。威胁情报和签名。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Despite the benefits provided by the widespread adoption and deployment of diverse Internet-enabled devices such as phones and smart home components in consumer markets and critical infrastructure - the so called Internet of Things (IoT) devices, security concerns are rising as such devices also introduce new vulnerabilities that could be leveraged by attackers to launch disrupting cyber-attacks. The objective of this project is to enable exploration of the inherent insecurity of the IoT paradigm by exploring innovative data analytics as applied to raw cyber security data. Insights gained will allow detection, characterization and attribution of Internet-scale compromised IoT devices, coupled with their malicious activities, in near real-time. Several technical challenges impede addressing IoT security at large, including, the excessive diversity of IoT devices in addition to their Internet-wide deployment, the lack of IoT-relevant data and the shortage of IoT-specific actionable attack signatures. In this context, this project serves NSF's mission to promote the progress of science by aiming to generate a first-of-a-kind, large-scale analysis of the magnitude of compromised IoT devices. The project also promotes cyber security research and training for minorities, given that it will be executed within the boundaries of a designated Hispanic-serving institution. Moreover, the project will contribute to operational cyber security by developing a real-time capability for storing and sharing IoT-relevant threat information.The project will draw-upon macroscopic, large-scale passive measurement data collected in real-time from a network telescope to highlight the severity of the insecurity of the IoT paradigm. Network telescopes, most commonly known as darknets, constitute a set of routable, allocated yet unused IP addresses. The project will design and develop real-time algorithms that are capable of inferring Internet-scale exploited IoT devices by exploring darknet data. Furthermore, the project will investigate formal correlation approaches rooted in stochastic data structures between IoT-relevant passive measurements and malware samples to aid in the attribution and thus the remediation objective. The project will further explore the orchestration behavior of seemingly independent IoT activities, which operate within well-coordinated IoT botnets. To this end, the project will innovate time series analytics based upon trigonometric interpolation techniques, recursive optimal stochastic estimators, and bitmap matching algorithms to infer such IoT botnets by employing passive measurements.  The project will also (1) develop a unique cyberinfrastructure for IoT cyber threat indexing by automating the proposed algorithms, techniques and methods, (2) generate IoT-specific signatures by employing piecewise hashing techniques, and (3) create access methods based on an API mechanism and a front-end service facilitated by Elasticsearch to allow the sharing of IoT-centric empirical data, threat intelligence and signatures.  This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.