Inferring the Purpose of Network Activities

针对计算机网络的攻击越来越复杂。最近，我们目睹了多起针对政府和企业的复杂针对性攻击。这种攻击与传统的网络攻击有很大的不同，因为攻击者几乎拥有无限的资源，并且可以根据受害者的网络定制他们的操作，这使得这些攻击很难被发现。事实上，目前最先进的检测技术不足以保护计算机网络免受针对性攻击。在这个提议中，我们的目标是使一些基本步骤能够可靠地检测计算机网络上的目标攻击。为此，我们计划将观察从攻击的实际表现中抽象化，转而关注网络活动背后的目的。我们认为，现代机器学习技术，如深度信念网络，可以用来从网络数据中自动学习高级特征。这些特征表明了执行网络活动的目的，而不是用于实现该目的的特定技术和工具。然后，这些高级特征可以用于传统的监督机器学习，以检测网络活动是出于恶意还是善意。

The sophistication of attacks targeting computer networks is constantly increasing. Recently, we have witnessed multiple sophisticated targeted attacks against governments and companies. Such attacks are much different than traditional network attacks, because attackers have virtually unlimited resources and can tailor their operation to the victim's network, making these attacks very difficult to detect. In fact, current state of the art detection techniques are inadequate to protect computer networks against targeted attacks.In this proposal, we aim to make some fundamental steps towards being able to reliably detect targeted attacks on computer networks. To this end, we plan to abstract the observation from the actual manifestation of an attack, and focus on the purpose behind network activities instead. We believe that modern machine learning techniques such as deep belief networks can be used to automatically learn high-level features from network data. Such features are indicative of the purpose for which the network activity is performed, rather than of the specific techniques and tools used to accomplish that purpose. These high-level features can then be used in traditional supervised machine learning to detect whether a network activity is being performed with a malicious intention or a benign one.