CAREER: Foundational Principles for Harnessing Provenance Analytics for Advanced Enterprise Security

现代数据中心面临着日益复杂的网络威胁带来的重大挑战。计算服务器由构建在复杂硬件上的多个软件层组成。威胁参与者可以利用硬件复杂性和多层软件方法来隐藏其活动并逃避检测。该提案引入了自动化技术，用于快速检测、调查和响应此类隐形威胁，重点是利用数据来源。数据来源涉及不断收集详细的数据历史，包括起源、处理和演变，以增强系统和应用程序的透明度。通过提高数据中心的可见性和安全性，我们的目标是保护关键基础设施和敏感信息，与国家安全目标保持一致。拟议的工作包括教育和扩大参与方面的举措，通过创新教学法、动手实验室和参与K-12研讨会，为不同的学生提供基本的网络安全技能。这种教育方法对于培养一支准备好应对未来网络安全挑战的熟练劳动力至关重要。该提案旨在对抗高级持续威胁（apt），并通过合并数据来源（一种跟踪数据对象的起源和演变的方法）来增强企业安全性。数据来源为理解系统操作提供了丰富的历史背景，是增强威胁检测和响应的关键。技术方法包括三个主要研究目标：第一，开发一个全面的系统，用于审计和统一跨各个系统层的数据来源；其次，利用数据来源提供的丰富历史背景，实现先进的图表示学习技术来提高威胁检测系统的准确性；第三，专注于构建人工智能驱动的自动事件响应框架，利用来自数据来源的见解来通知和简化响应行动。预期成果包括用于有效收集和集成数据来源的创新技术，用于威胁检测的可扩展模型的开发，以及用于快速和自动化事件响应的框架的创建。该提案有可能显著改变企业安全实践，从而更强大地防御复杂的网络威胁，并为更安全、更可靠的数字环境做出贡献。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Modern data centers face significant challenges from increasingly sophisticated cyber threats. Compute servers comprise multiple software layers built upon complex hardware. Both the hardware complexity and the multi-layer software approach can be leveraged by threat actors to conceal their activities and evade detection. This proposal introduces automated techniques for swift detection, investigation, and response to such stealthy threats, with a focus on leveraging data provenance. Data provenance involves continuously collecting detailed data histories, including origins, handling, and evolution, to enhance system and application transparency. By improving the visibility and security within data centers, we aim to protect critical infrastructure and sensitive information, aligning with national security goals. The proposed work includes initiatives in education and broadening participation that will equip diverse students with essential cybersecurity skills through innovative pedagogy, hands-on laboratories, and engaging K-12 workshops. This educational approach is crucial for developing a skilled workforce prepared to address future cybersecurity challenges.This proposal aims to counter Advanced Persistent Threats (APTs) and enhance enterprise security by incorporating data provenance, a method for tracking the origin and evolution of data objects. Data provenance provides a rich historical context for understanding system operations, key to enhancing threat detection and response. The technical methodology encompasses three primary research objectives: first, developing a comprehensive system for auditing and unifying data provenance across various system layers; second, implementing advanced graph representation learning techniques to enhance the accuracy of threat detection systems, leveraging the rich historical context provided by data provenance; and third, focusing on constructing an AI-powered automated incident response framework, utilizing insights from data provenance to inform and streamline response actions. Anticipated outcomes include innovative techniques for the efficient collection and integration of data provenance, the development of scalable models for threat detection, and the creation of frameworks for rapid and automated incident response. The proposal has the potential to significantly transform enterprise security practices, leading to more robust defenses against complex cyber threats and contributing to a safer and more secure digital environment.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.