ATD: Collaborative Research: Extremal Dependence and Change-Point Detection Methods for High-Dimensional Data Streams with Applications to Network Cybersecurity

该项目的动机是需要开发先进的网络监测工具以及自动统计方法，以便快速检测由于持续的攻击或迫在眉睫的网络安全威胁而导致的互联网流量异常。重点是检测网络安全威胁，如高度分布式的恶意软件感染，这些恶意软件可以对国家的互联网基础设施发起协调的、严重的分布式拒绝服务攻击。这将通过研究所谓的暗网流量数据来实现。网络中的恶意攻击者系统地探测互联网空间中易受攻击或配置错误的设备。在这样做时，它们会自动将数据发送到整个Internet地址空间，其中包括未使用的Internet地址空间。这种去往任何地方的流量表示恶意软件感染企图或秘密漏洞扫描。调查人员的目标是开发和部署专门的工具，使网络安全分析师能够有效地分析暗网流量数据。这项研究涉及一个由计算机工程师和统计学家组成的团队，他们将密切合作，实施一个原型系统，用于检测、绘制和识别全球范围的互联网恶意活动。该项目将创建一套简单易懂的风险指数，并向公众传达，这些指数总结了当前的暗网威胁活动。这一努力将潜在地预防和缓解网络安全网络流量威胁。由于互联网参与者的动态性质和物联网生态系统的快速扩展，潜在的互联网威胁不断演变，需要在细粒度的空间和时间尺度上提供足够的数据。项目组可以访问在Merit Network，Inc.收集的独特网络安全数据，这些数据捕获互联网范围内的活动，包括网络扫描、恶意软件传播、拒绝服务攻击和网络中断。这些数据由未经请求的互联网流量组成，这些流量发往一个已路由但未使用的互联网地址空间，称为暗网。这个项目将开发算法和软件基础设施，将暗网数据收集和组织成高维、多变量数据流，并将研究基于(I)极端相关性、(Ii)变点检测和/或(Iii)高维稀疏信号检测和恢复的统计方法，以便为构建互联网威胁指数提供信息，这些指数量化恶意扫描的风险、网络脆弱性、拒绝服务攻击的风险等。高维环境中的极端情况的统计是一个具有挑战性的问题，因为它需要对无限维参数--频谱测量--进行建模/估计。利用多变量规则变化，这个项目将研究新的超图模型，这些模型量化并为高维中同时出现的极端情况提供可解释的抽象。使用因变量极大值的极限理论，项目组将解决有关高维极端依赖超图和稀疏信号检测的特征的公开理论问题。这种分析将导致开发新的威胁指数，这些指数表现出空间相关性，并将使用快速、可扩展的变化点检测算法进行分析。新的变点方法旨在实现与标准方法相比的巨大计算收益，而不会影响统计精度，并将对大型数据流的分析做出重大贡献。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The project is motivated by the need to develop advanced network monitoring tools coupled with automated statistical methods for the quick detection of Internet traffic anomalies due to ongoing attacks or impending cybersecurity threats. Emphasis is placed on detecting cybersecurity threats such as highly distributed malware infections, which can launch coordinated and crippling distributed denial of service attacks on the nation's Internet infrastructure. This will be achieved through a study of the so-called darknet traffic data. Malicious actors in the network systematically probe the Internet space for vulnerable or misconfigured devices. In doing so, they automatically send data to the entire Internet address space, which includes the space of unused Internet addresses. This destined-to-nowhere traffic is indicative of malware infection attempts or stealthy vulnerability scanning. The investigators aim to develop and deploy specialized tools that allow cyber-security analysts to efficiently analyze darknet traffic data. The research involves a team of computer engineers and statisticians, who will work closely together to implement a prototype system for detecting as well as mapping and identifying world-wide malicious activity in the Internet. The project will create and communicate to the public a set of simple-to-interpret risk indices that summarize the current darknet threat activity. This effort will potentially enable the prevention and mitigation of cybersecurity network traffic threats.Understanding Internet threats, which continue to evolve due to the dynamic nature of Internet actors and the rapid expansion of the Internet of Things ecosystem, requires adequate data at fine-grained spatial and temporal scales. The project team has access to unique cyber-security data collected at Merit Network, Inc. that capture Internet-wide activity including network scanning, malware propagation, denial of service attacks, and network outages. This data consists of unsolicited Internet traffic destined to a routed but unused Internet address space, referred to as a darknet. This project will develop algorithmic and software infrastructure to collect and organize darknet data into high-dimensional, multivariate data streams, and will study statistical methods based on (i) extremal dependence, (ii) change-point detection, and/or (iii) high-dimensional sparse signal detection and recovery to inform the construction of Internet threat indices that quantify the risk of malicious scanning, degree of network vulnerability, risk of denial of service attacks, etc. Statistics of extremes in high-dimensional setting is a challenging problem since it requires the modeling/estimation of an infinite-dimensional parameter---the spectral measure. Using multivariate regular variation, this project will study novel hyper-graphical models that quantify and provide interpretable abstractions for the simultaneous occurrence of extremes in high-dimensions. Using limit theory for maxima of dependent variables, the project team will address open theoretical problems on the characterization of extremal dependence hyper-graphs and sparse signal detection in high-dimension. This analysis will lead to the development of novel threat indices that exhibit spatial dependence that will be analyzed with fast, scalable change-point detection algorithms. The new change-point methodology is designed to achieve large computational gains vis-a-vis standard approaches without compromising statistical accuracy and would be a significant contribution to the analysis of large data streams.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.