FMitF: Track I: Synthesis of Quantitative Network Analytics: From Left-of-Launch to Right-of-Boom

网络安全分析目前是一项冗长而详细的工作，首先是分析人员从不同来源（如网络流量、服务器历史和单个计算机状态）收集数据，然后将这些信息与攻击数据（如恶意主机名或恶意软件描述）进行交叉比较。然后，分析人员通过手动检查这些数据集并寻找罕见但危险的事件来做出安全决策。不出所料，这是一个容易出错的过程，由于不断增长的流量、复杂的网络结构和诸如代理和网络地址转换（NAT）盒等混淆因素，这一过程变得更加复杂。这个项目的目标是使用受形式化方法启发的想法来开发一个新的框架来自动化网络流量分析。通过更好地放置传感器和分析敌对事件的来源来改进数据收集，该项目的影响是改进安全分析，更好的态势感知和缩短响应时间。该项目开发了一种查询语言，允许网络分析师描述网络的结构和期望的分析目标，假设整个网络的完全可观察性。为了解释混淆这种分析的因素，该项目研究了在部分可观察性下测试分析可行性的自动方法。如果不成立，它确定统计上相关的替代量，可以用来给出高概率的近似正确的结果。该框架还允许自动合成必要的监视器及其最佳位置，以便最大限度地减少错误和资源开销。该系统配备了跟踪所有部署传感器测量来源的机制，从而使研究人员能够在触发警告或发现攻击后诊断根本原因。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Network-security analysis is currently a tedious and detailed exercise that starts with analysts collecting data from diverse sources (such as network traffic, server histories and individual computer states), and then cross-comparing this information against attack data, such as malicious host names or malware descriptions. Analysts then make security decisions by manually inspecting these data sets and looking for rare but dangerous events. Unsurprisingly, this is an error-prone process, which is further complicated by rising traffic volumes, complex network structures, and confounding factors such as proxies and Network Address Translation (NAT) boxes. This project's goal is to use ideas inspired by formal methods to develop a novel framework to automate network-traffic analysis. By improving data collection through better sensor placement and by analyzing the provenance of hostile events, the project's impacts are an improvement in security analysis, better situational awareness and lowered response times.The project develops a query language that allows network analysts to describe the structure of the network and the desired analysis objective assuming complete observability across the network. To account for elements that confound such analyses, the project investigates automatic methods to test feasibility of analysis under partial observability. If this does not hold, it identifies statistically correlated alternative quantities that can be used to give approximately correct results with high probability. The framework also allows for the automatic synthesis of necessary monitors and their optimal placement so as to minimize errors and resource overheads. The system is equipped with mechanisms to track the provenance of measurements from all deployed sensors, thus enabling researchers to diagnose root causes after warnings are triggered or attacks uncovered.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.