CIPART: CLOUD INTELLIGENT PROTECTION AT RUN-TIME

组织，无论大小，都越来越依赖云环境来满足其ICT需求，因为云提供了更好的增量成本结构、资源弹性和更简单的管理。随着越来越多从移动设备和智能环境（包括家庭、基础设施和智能城市）收集的信息被上传并在云环境中处理，这一趋势将继续下去。交付给用户的服务也部署在云中，因为这提供了更好的可伸缩性，并且在某些情况下允许迁移到更靠近访问点的地方，以减少延迟。因此，云是有组织的、熟练的网络攻击的一个有吸引力的目标。它们也更容易受到攻击，因为它们托管的环境来自多个具有不同兴趣和不同风险规避特征的租户组织。然而，云也提供了更好的保护机会，无论是主动还是被动地应对持续的攻击。该项目旨在通过推进运行时系统建模、基于攻击场景的分析、选择对策和补救行动的新技术以及云环境再周界化的新技术，开发智能云保护的新技术。采用的方法将知识表示、概率分析和机器学习的基础研究与工业测试平台环境中的经验和实验研究相结合。此外，该项目还旨在根据成本、风险和价值的衡量标准，更好地了解云租户和托管组织在提供安全服务时所涉及的商业模式和激励措施，并提出促进风险分担和安全相关信息交换的新模式，从而简化安全管理并提供更好的保护。

Organisations, small and large, increasingly rely upon cloud environments to supply their ICT needs because clouds provide a better incremental cost structure, resource elasticity and simpler management. This trend is set to continue as increasingly information collected from mobile devices and smart environments including homes, infrastructures and smart-cities is uploaded and processed in cloud environments. Services delivered to users are also deployed in the cloud as this provides better scaleability and in some cases permits migration closer to the point of access for reduced latency. Clouds are therefore an attractive target for organised and skilled cyber-attacks. They are also more vulnerable as they host environments from multiple tenant organisations with different interests and different risk aversion profiles. Yet clouds also offer opportunities for better protection both pro-actively and reactively in response to a persistent attack. This project aims to develop novel techniques for intelligent cloud protection by advancing the state of the art in system modelling at run time, attack scenarios based analysis, novel techniques for selecting countermeasures and remedial actions and novel techniques for re-perimeterisation of the cloud environment. The methodology adopted combines fundamental research on knowledge representation, probabilistic analysis and machine learning with empirical and experimental studies in an industrial test-bed environment. Additionally, the project also aims to achieve a better understanding of the business models and incentives involved in the relationships between cloud tenants and hosting organisations in the provision of security services based on measures of cost, risk and value and to propose new models that facilitate sharing of risk and exchange of security relevant information, which would in turn allow to simplify security management and provide better protection.