SaTC: CORE: Small: Empowering Network Attack Detection with Complex Graph Modeling

现代恶意软件和网络攻击利用广泛的攻击技术和活动来瞄准和利用受害者机器。然而，大型网络（例如企业网络、校园网）在检测不断演变的攻击方面面临着巨大的挑战，特别是每天都有大量的网络流量。本项目利用复杂图建模为大型网络开发新的攻击检测方法。该项目的新颖之处在于(i)构建一个复杂的图形模型，用新技术来表示网络流量，以丰富图形，以及（ii）开发新的基于图形的学习算法，以最小的地面真值数据来检测异常。该项目更广泛的意义和重要性在于(i)广泛传播研究成果，以帮助社区（如安全运营中心）打击复杂的网络攻击，以及（ii）开发课程，为研究生和本科生提供分析真实网络攻击的经验。具体而言，该项目(i)使用新的图精化框架构建复杂图模型，以丰富图结构和选择性标记技术，为给定资源约束的目标节点/边创建标签；（ii）设计一套基于图的半监督检测算法，以利用标记和未标记的数据来检测静态和动态网络图中的攻击；ss（iii）开发了新的基于图的弱监督框架，仅依赖于有限的标记数据，甚至没有任何标签来检测攻击。该项目使用在校园网中收集的大规模网络流量日志来评估新检测方法在实际场景中的有效性和准确性。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Modern malware and cyber attacks utilize a wide range of attack techniques and campaigns to target and exploit victim machines. However, large networks (e.g., enterprise networks, campus networks) face enormous challenges in detecting evolving attacks especially with the sheer amount of network traffic each day. This project develops new attack detection approaches for large networks using complex graph modeling. The project’s novelties are (i) constructing a complex graph model to represent network traffic with new techniques to enrich the graph, and (ii) developing novel graph-based learning algorithms to detect anomaly with minimum ground truth data. The project's broader significance and importance are (i) wide dissemination of research results to help the community (e.g., the Security Operations Center) combat complex cyber attacks, and (ii) curriculum development to provide graduate and undergraduate students with experience on analyzing attacks in real-world networks.Specifically, the project (i) constructs the complex graph model with a new graph refinement framework to enrich graph structure and selective labeling techniques to create labels for targeted nodes/edges given resource constraints; (ii) designs a suite of graph-based semi-supervised detection algorithms to take advantage of both labeled and unlabeled data to detect attacks in both static and dynamics network graphs; and ss(iii) develops novel graph-based weakly-supervised frameworks that only rely on limited labeled data or even without any labels to detect attacks. The project uses large-scale network traffic logs collected at a campus network to evaluate the effectiveness and accuracy of the new detection methods in a practical real-world scenario.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.