CRII: OAC: Inferring, Attributing, Mitigating and Analyzing the Malicious Orchestration of Internet-scale Exploited IoT Devices: A Network Telescope Approach

尽管在消费者市场和关键基础设施中广泛采用和部署各种支持互联网的设备（如电话和智能家居组件）（所谓的物联网（IoT）设备）带来了好处，但安全问题正在上升，因为这些设备也引入了新的漏洞，攻击者可能会利用这些漏洞发动破坏性的网络攻击。 该项目的目标是通过探索应用于原始网络安全数据的创新数据分析来探索物联网范式的固有不安全性。 获得的见解将允许近实时地检测、表征和归因互联网规模的受损物联网设备及其恶意活动。 一些技术挑战阻碍了物联网安全的解决，包括物联网设备的过度多样性以及互联网范围内的部署，缺乏物联网相关数据以及缺乏特定于物联网的可操作攻击特征。 在这种情况下，该项目服务于NSF的使命，旨在通过对受损物联网设备的规模进行首次大规模分析来促进科学进步。 该项目还促进了对少数民族的网络安全研究和培训，因为它将在指定的西班牙裔服务机构范围内执行。 此外，该项目还将通过开发实时存储和共享物联网相关威胁信息的能力，为运营网络安全做出贡献。该项目将利用从网络望远镜实时收集的宏观、大规模被动测量数据，突出物联网范式不安全的严重性。 网络望远镜，通常被称为暗网，构成了一组可路由的，已分配但未使用的IP地址。 该项目将设计和开发实时算法，能够通过探索暗网数据来推断互联网规模的物联网设备。 此外，该项目还将研究基于物联网相关被动测量和恶意软件样本之间随机数据结构的正式相关方法，以帮助确定归因，从而实现补救目标。 该项目将进一步探索看似独立的物联网活动的编排行为，这些活动在协调良好的物联网僵尸网络中运行。 为此，该项目将基于三角插值技术、递归最优随机估计器和位图匹配算法来创新时间序列分析，以通过采用被动测量来推断此类物联网僵尸网络。 该项目还将（1）通过自动化提出的算法，技术和方法为物联网网络威胁索引开发独特的网络基础设施，（2）通过采用分段哈希技术生成物联网特定的签名，以及（3）基于API机制和Elasticsearch促进的前端服务创建访问方法，以允许共享以物联网为中心的经验数据，威胁情报和签名。 该奖项反映了NSF的法定使命，并被认为是值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估的支持。

Despite the benefits provided by the widespread adoption and deployment of diverse Internet-enabled devices such as phones and smart home components in consumer markets and critical infrastructure - the so called Internet of Things (IoT) devices, security concerns are rising as such devices also introduce new vulnerabilities that could be leveraged by attackers to launch disrupting cyber-attacks. The objective of this project is to enable exploration of the inherent insecurity of the IoT paradigm by exploring innovative data analytics as applied to raw cyber security data. Insights gained will allow detection, characterization and attribution of Internet-scale compromised IoT devices, coupled with their malicious activities, in near real-time. Several technical challenges impede addressing IoT security at large, including, the excessive diversity of IoT devices in addition to their Internet-wide deployment, the lack of IoT-relevant data and the shortage of IoT-specific actionable attack signatures. In this context, this project serves NSF's mission to promote the progress of science by aiming to generate a first-of-a-kind, large-scale analysis of the magnitude of compromised IoT devices. The project also promotes cyber security research and training for minorities, given that it will be executed within the boundaries of a designated Hispanic-serving institution. Moreover, the project will contribute to operational cyber security by developing a real-time capability for storing and sharing IoT-relevant threat information.The project will draw-upon macroscopic, large-scale passive measurement data collected in real-time from a network telescope to highlight the severity of the insecurity of the IoT paradigm. Network telescopes, most commonly known as darknets, constitute a set of routable, allocated yet unused IP addresses. The project will design and develop real-time algorithms that are capable of inferring Internet-scale exploited IoT devices by exploring darknet data. Furthermore, the project will investigate formal correlation approaches rooted in stochastic data structures between IoT-relevant passive measurements and malware samples to aid in the attribution and thus the remediation objective. The project will further explore the orchestration behavior of seemingly independent IoT activities, which operate within well-coordinated IoT botnets. To this end, the project will innovate time series analytics based upon trigonometric interpolation techniques, recursive optimal stochastic estimators, and bitmap matching algorithms to infer such IoT botnets by employing passive measurements.  The project will also (1) develop a unique cyberinfrastructure for IoT cyber threat indexing by automating the proposed algorithms, techniques and methods, (2) generate IoT-specific signatures by employing piecewise hashing techniques, and (3) create access methods based on an API mechanism and a front-end service facilitated by Elasticsearch to allow the sharing of IoT-centric empirical data, threat intelligence and signatures.  This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.