SaTC: TTP: Small: STINGAR - Deployment of highly automated, reliable, and fast cybersecurity threat response systems

现代网络安全攻击通常是通过自动化的“机器人”或代理进行的，这些机器人或代理在几分钟内有系统地攻击网络。这使得组织争先恐后地采取防御措施，这些防御措施必须首先由人类验证或制定，因此需要时间来建立。机构再也承担不起用我们较慢的、有时容易出错的模拟(基于人的)响应来打击这些强大而快速的数字攻击。相反，该项目利用其独特的数字保护形式--既是自动化的，又是可扩展的--来实施对传入的恶意流量的实时阻止。该项目团队寻求将一个在杜克大学成功使用了两年的系统扩展到其他大学、学院和地区网络，特别关注为少数族裔服务的学院和较小的学院和大学的可用性，这些学院和大学的信息技术(IT)和安全人员可能缺乏时间或专业知识来开发类似的保护措施或购买昂贵的商业工具。该项目已经开发的工具套件利用了一系列“传感器”和“执行器”，可以自动阻止某些类型的恶意流量，从而提高网络安全威胁响应的速度、规模和可靠性。该项目将这些工具从杜克大学过渡到北卡罗来纳中央大学(NCCU)的生产使用，目的是确认它们的可用性，并确保杜克大学获得的价值可以在其他地方复制。然后，该项目将覆盖范围扩大到其他大学、学院和区域网络。该项目包括在参与的大学之间共享数据的机制，从而“众包”任何一个校园的积极攻击意识，以便所有其他校园可以在成为相同攻击的受害者之前主动实施保护。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Modern cybersecurity attacks are often carried out through automated "bots" or agents that systematically attack networks, at scale and in a matter of minutes. This has left organizations scrambling to respond with defenses that must first be validated or enacted by humans, and so take time to mount. Institutions can no longer afford to combat these powerful and rapid digital attacks with our slower and sometimes error-prone analog (human-based) responses. Instead, this project utilizes its own distinctive form of digital protections - which are both automated and scalable - to implement real-time blocks of incoming malicious traffic. The project team seeks to extend a system that has been used successfully for two years at Duke University to other universities, colleges and regional networks with special attention on usability by minority-serving and smaller colleges and universities, where Information Technology (IT) and security personnel may lack the time or expertise to develop similar protections or purchase expensive commercial tools. The suite of tools that the project has already developed utilizes a series of "sensors" and "actuators," which automatically block certain types of malicious traffic and as a result improve the speed, scale, and reliability of cybersecurity threat responses. This project transitions these tools from Duke to production use at North Carolina Central University (NCCU), with the intention of confirming their usability and ensuring the value derived at Duke is reproducible elsewhere. Then, the project expands coverage to other universities, colleges, and regional networks. The project includes mechanisms to share data among participating universities, thereby "crowdsourcing" awareness of an active attack on any one campus, so that all other campus may proactively enact protections before they fall victim to the same attack.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.