CRII: SaTC: Empowering Elastic-honeypot as Real-time Malicious Content Sniffers for Social Networks

垃圾信息、错误信息、虚假信息和彻头彻尾的欺诈在社交网络上猖獗。为了从良性和有用的内容中分离出这种恶意内容并保护社交网络，需要鲁棒的内容分类系统。然而，在设计这样的系统之前，需要训练分类器的数据。蜜罐是一个很好的方法来获得这些数据的恶意攻击者的行为。传统的蜜罐依赖于手动创建的人工用户帐户作为诱饵来诱捕攻击活动。然而，这样的蜜罐通常很容易被聪明的攻击者识别。它们还缺乏部署灵活性、功能可变性、网络可扩展性和系统可移植性。该项目开发了一个新颖的，轻量级的基于蜜罐的恶意内容捕获系统，不能被攻击者轻易绕过。然后，蜜罐用于智能地收集内容并将其自动分类为可能的恶意内容和可能的良性内容。其目标是减轻恶意内容的不利影响，净化社交环境，显著提升社交网络的安全性和信任度。研究数据集和软件工具包与更广泛的研究界共享。研究结果以书籍章节和实践课堂材料的形式转化为教育材料，交付给路易斯安那大学拉斐特分校的学生，并与世界各地的其他大学分享。该项目还涉及本科生和代表性不足的学生的研究经验。本计画提出一种新颖且轻量的蜜罐式恶意内容侦测系统，名为弹性蜜罐式侦测器，以克服传统蜜罐式侦测系统的缺点。弹性蜜罐嗅探器由两个核心组件组成：（1）实时数据收集和（2）弹性蜜罐检测器。该项目在现有的垃圾邮件数据集上使用强大的学习技术，识别被发现是垃圾邮件发送者有利可图的目标的用户的特征和行为概况。为了实时收集数据，弹性蜜罐根据学习到的易受攻击的用户配置文件动态部署人工用户帐户作为诱饵，以智能地捕获攻击者。与传统蜜罐技术相比，蜜罐技术的主要优点是节点可用性、部署灵活性、功能可变性、网络可扩展性和系统可移植性。 弹性蜜罐嗅探器捕获的数据用于设计强大的分类技术，以区分恶意和良性内容，这些内容可以抵御对抗性攻击。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Spam messages, misinformation, disinformation and outright fraud are rampant on social networks. To separate out such malicious content from benign and useful content and protect social networks, there is a need for robust content classification systems. However, before such systems can be designed, there is a need for data that train the classifiers. Honeypots are a good way to obtain such data about malicious attacker behavior. Conventional honeypots rely on manually created artificial user accounts as lures to trap attack activities. However, such honeypots are often identified easily by smart attackers. They also suffer from lack of deployment flexibility, feature variability, network scalability, and system portability. This project develops a novel and lightweight honeypot-based malicious content capturing system that cannot be easily bypassed by attackers. The honeypot is then used to intelligently gather and automatically classify contents into likely malicious and likely benign. The goal is to mitigate the adverse effects of malicious contents and sanitize social environments, significantly elevating the security and trust of social networks. Research datasets and software toolkits are shared with the broader research community. The research findings are transitioned into educational materials in the form of book chapters and hands-on classroom materials, delivered to students at the University of Louisiana at Lafayette and also shared with other universities worldwide. The project also involves undergraduate and under-represented students for research experience. This project develops a novel and lightweight honeypot-based malicious content sniffing system, named the elastic-honeypot sniffer, to overcome drawbacks in conventional honeypot-based solutions. Two core components constitute the elastic-honeypot sniffer: (1) real-time data gathering and (2) elastic-honeypot detector. Using robust learning techniques on existing spam datasets, the project identifies features and behavior profiles of users who are found to be lucrative targets for spammers. For real-time data gathering, the elastic-honeypot dynamically deploys artificial user accounts as lures based on the learnt vulnerable user profiles to trap attackers intelligently. The main advantages over conventional honeypot technology are node availability, deployment flexibility, features variability, network scalability, and system portability. The data captured by the elastic-honeypot sniffer is used to design robust classification techniques to differentiate between malicious and benign content that are resilient against adversarial attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.