CRI: II-New: ORION: Observatory for Cyber-Risk Insights and Outages of Networks

提高互联网连接设备和网络的安全性需要实时检测和理解对抗行为的变化。因此，有必要开发方法和部署基础设施，以自动诊断互联网活动的宏观趋势，并为研究人员和安全分析师提供对僵尸网络感染、拒绝服务攻击、网络中断和恶意软件活动的可见性。网络望远镜是一种网络仪器，它收集和记录未经请求的互联网流量，这些流量被发送到路由但未使用的互联网地址空间，是检测全球互联网行为变化的一种途径。然而，虽然网络望远镜提供了一个强大的视角，但它们主要用于追溯性地理解互联网事件。该项目将设计和部署新的基础设施，使大型学术网络望远镜现代化，以便对恶意互联网活动和其他威胁提供独特的实时洞察。该项目将引入一个新的实时数据处理管道来解析传入的流量并检测单个网络事件。它将探索新兴的数据科学技术，以识别互联网范围内趋势的变化，并产生简洁，人类可读的互联网活动变化摘要。为了将这些事件置于环境中，该项目将把外部数据源集成到处理管道中，包括网络声誉数据、已知恶意软件的独特模式和其他以安全为重点的资源（即Censys搜索引擎）。此外，为了提高望远镜的可用性，这项工作将建立可访问的接口，使研究人员能够轻松地对望远镜探测到的事件提出问题。该基础设施将广泛提供给对理解、测量、建模和定义互联网演变感兴趣的计算机和信息科学与工程研究人员。它建立在Merit Network在以道德负责的方式操作大型网络望远镜方面长达十年的经验之上。它还将利用斯坦福大学、加州大学圣地亚哥分校和科罗拉多州立大学研究人员的专业知识。在教育方面，网络望远镜数据可以作为网络安全、计算机系统、数据科学和工程交叉领域未来劳动力跨学科培训的工具。即使在研究生阶段，网络望远镜数据分析仍然是一个相对未被探索的话题；该项目将提高数据的科学效用，并将提供独特的机会，以真实的、异构的网络安全数据来教育学生。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Advancing the security of Internet-connected devices and networks entails the detection and understanding of changes in adversarial behavior in real time. Hence, there is a need to develop methodologies and deploy infrastructure that can automatically diagnose macroscopic trends in Internet activity and provide to researchers and security analysts visibility into botnet infections, denial of service attacks, network outages, and malware campaigns. Network telescopes--networking instrumentation that collects and records unsolicited Internet traffic destined to a routed but unused Internet address space--are one avenue for detecting shifts in global Internet behavior. However, while network telescopes provide a powerful perspective, they have primarily been used for retroactively understanding Internet events. This project will design and deploy new infrastructure to modernize a large academic network telescope in order to offer unique real-time insights into malicious Internet activity and other threats. This project will introduce a new real-time data processing pipeline to parse incoming traffic and detect individual network events. It will explore emerging data science techniques to identify variations in Internet-wide trends and to produce terse, human-readable summaries of changes in Internet activity. To contextualize these events, this project will integrate external data sources into the processing pipeline including network reputation data, unique patterns of known malware and other security-focused resources (i.e., the Censys search engine). Furthermore, to boost the telescope's usability, this work will build accessible interfaces that would enable researchers to easily ask questions about telescope-detected events. The infrastructure will be broadly available to Computer and Information Science and Engineering researchers interested in understanding, measuring, modeling and defining Internet's evolution. It builds on Merit Network's decade-long experience in operating large-scale network telescopes in an ethically responsible manner. It will also leverage the expertise of researchers at Stanford University, University of California at San Diego, and Colorado State University. On the educational front, network telescope data can serve as a vehicle for inter-disciplinary training of the future workforce in areas that lie at the intersection of network security, computer systems, data science and engineering. Even at the graduate level, network telescope data analysis remains a relatively unexplored topic; this project will heighten the scientific utility of the data and will provide unique opportunities for educating students with real-world, heterogeneous network security data.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.