SaTC: CORE: Medium: After the Breach: Detecting Lateral Movement, Reconnaissance, and Exfiltration in Enterprise Networks

大规模数据泄露和勒索软件攻击已成为政府机构和企业面临的紧迫威胁。然而，区分这些事件的因素很少是最初获得未经授权访问的技术机制，而是获得这种访问后采取的有条理的行动。因此，虽然防止初始入侵的努力仍然很重要，但开发合理的方法来检测和阻止已经在组织内部运行的攻击者的行为显然同样重要。 该项目正是解决了这个问题：如何通过组织内部的操作来检测，识别和修复恶意行为者。为了实现这一目标，该项目的新奇之处在于开发了一个网络分析系统，以模拟计算机和网络事件的因果关系-在这种方式中，一台机器上发生的动作可以解释为攻击者从另一台机器转向，以追求组织中的更多访问。该项目更广泛的意义和重要性在于为评估检测和减轻企业规模数据泄露的最佳做法提供了一个有充分依据的严格基础。调查人员使用此类活动的推断因果图，开发和评估检测器，以获得内部侦察，横向移动和外部通信的证据。使用经验数据源和模拟器来测试一系列企业网络模型，研究人员探索了这种因果框架可以在多大程度上区分已知的攻击和发生的广泛的良性活动。 最后，该项目还评估了此类框架在分类和事故后响应方面的价值，消除了识别哪些机器和帐户可能受到损害的人工工作。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

Large-scale data breaches and ransomware attacks have become a pressing threat for government agencies and corporations alike. However, what distinguishes these events is rarely the technical mechanisms by which unauthorized access was first obtained, but rather the methodical actions taken after gaining such access. Thus, while efforts to protect against initial intrusions remain important, it is clearly every bit as important to develop sound approaches for detecting and subduing the actions of attackers already operating inside an organization. This project tackles precisely this problem: how to detect, identify and remediate malicious actors via their operational actions inside an organization. To address this goal, the project’s novelty is in developing a network analysis system to model the causality of computer and network events – ways in which an action that occurred on one machine can be explained as an attacker pivoting from another machine in pursuit of increased access in an organization. The project’s broader significance and importance are in providing a well-founded rigorous basis for evaluating best practices for detecting and mitigating enterprise-scale data breaches.Using an inferred causal graph of such activities, the investigators develop and evaluate detectors for evidence of internal reconnaissance, lateral movement and external communication. Using both empirical data sources and a simulator for testing a range of enterprise network models, the investigators explore the extent to which this causal framework can distinguish known attacks from the broad range of benign activities that take place. Finally, the project also evaluates the value of such frameworks for both triage and post-incident response, removing the manual work involved in identifying which machines and accounts may have been compromised.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.