SaTC: CORE: Small: Scalable Cyber Attack Investigation using Declarative Queriesand Interrogative Analysis

最近利用多重漏洞的网络攻击甚至困扰着保护最严密的公司。这导致了这样的解决方案：无处不在地监视作为一系列系统事件的系统活动，并通过将事件及其对攻击的依赖关系重构为依赖关系图，应用因果关系分析来揭示攻击步骤。然而，现有的技术主要利用事件时间来识别依赖关系。这将包括许多不重要的依赖关系，这些依赖关系是由不相关的系统活动带来的。此外，由于有限的可扩展性，这些技术不能很容易地合并来自安全分析人员的专业知识，并且为安全分析人员积极探索依赖关系提供很少的支持。该项目预计将通过使用系统审计日志加强攻击调查，并提供上下文信息，帮助入侵检测系统更好地优先考虑警报，从而对系统安全产生重大的积极影响。该项目积极让少数民族和代表性不足群体的学生参与研究和培训经验。该建议的目标是开发一个通用的查询框架，通过从系统审计日志中构造攻击相关事件的小图来表达和提取上下文攻击信息。该项目主要集中在以下研究任务上：(1)建立一个通用的基础设施，根据系统事件的各种属性计算依赖关系的判别权重，以识别与攻击相关的事件和攻击的入口点；(2)开发一种声明性图查询语言，提供专门的语言结构来表达各种格式的因果关系分析；(3)设计一个可扩展的疑问分析框架，该框架可以通过跟踪验证和假设场景的表达性因果结构来自动澄清因果分析，并采用新的“为什么”和“如果”语义。该项目将推动从复杂系统中揭示攻击来源的最新技术，使安全分析人员参与到交互式和可解释的安全分析管道中，并更好地理解构建有效攻击调查系统的基本和实际挑战。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Recent cyber-attacks that exploit multiple vulnerabilities plague even the most protected companies. This has led to the solutions that ubiquitously monitor system activities as a series of system events, and apply causality analysis to reveal the attack steps through reconstructing the events and their dependencies on the attack as dependency graphs. Nevertheless, existing techniques mainly exploit event time to identify dependencies. This will include many less-important dependencies brought by irrelevant system activities. Moreover, these techniques cannot easily incorporate expert knowledge from security analysts due to limited extensibility, and provide little support to engage security analysts to actively explore the dependencies. The project is expected to make a major positive impact on system security by enhancing attack investigation using system audit logs, and provide contextual information to help intrusion detection systems better prioritize alerts. The project actively involves students from minority and underrepresented groups for research and training experiences. The goal of this proposal is to develop a general query framework to express and extract contextual attack information, by constructing small graphs of attack-relevant events from system audit logs. The project is focused on the following research tasks: (1) build a general infrastructure that computes discriminative weights for dependencies based on various properties of system events to identify attack-relevant events and entry points for attacks; (2) develop a declarative graph query language that provides specialized language constructs to express various formats of causality analysis; (3) devise a scalable interrogative analysis framework that can automatically clarify causality analysis by tracking expressive causal structures for both verified and hypothetical scenarios, enabled by new ``Why'' and ``What-if'' semantics. This project will advance the state of the art in revealing attack provenance from complex systems, on engaging security analysts to interactive and explainable security analytical pipelines, and to gain better understanding of the fundamental and practical challenges for building an effective attack investigation system.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.