Improving internet security through traffic analysis and examination of the internet`s basic properties

通过流量分析和检查互联网的基本属性来提高互联网的安全性互联网可以说是最大的人造实体。这是一个非常复杂的网络，不是中央控制的，而且还在不断增长。这种增长方式使网络运营和管理复杂化。然而，如果最终目标是建立一个像互联网那样促进交流的网络，那么它将不可避免地变得如此复杂。这种复杂性导致了Internet在流量模式、逻辑和物理拓扑以及节点的地理位置方面实际如何工作的问题。本研究计划的目的是通过利用互联网流量及其基本属性的知识来提高互联网安全。Internet的基本属性是指其拓扑结构以及地理位置与Internet地址分布和管理方式的关系。这是一个双重目标：第一个是更好地理解和获得互联网流量和基本属性的知识。第二是将这些知识应用于构建新的网络安全体系结构、应用程序和协议，以及保护现有协议和应用程序。拟议的研究计划将集中于以下研究方向：1-流量分析存在于互联网流量中的模式和结构。2-恶意活动的特征。（如垃圾邮件，拒绝服务）3-将网络元素（主机和路由器）与地理位置联系起来。4-启用一类新的安全应用程序，这些应用程序基于对互联网工作原理的实际了解，而不是仅仅依赖于建模和模拟。

Improving Internet Security through Traffic Analysis and Examination of the Internet's Basic PropertiesThe Internet is arguably the biggest man-made entity. It is a very complex network that is not centrally controlled and that is continuously growing. This fashion of growth complicates network operation and management. However, if the end-goal is to have a network that facilitates communication the way the Internet does, it is inevitable that it will be that complex. This complexity led to questions on how the Internet actually works in terms of traffic patterns, logical and physical topologies, and geographical location of nodes.The objective of this research program is to improve Internet security through exploiting knowledge of Internet traffic and of its basic properties. The basic properties of the Internet refer to its topology and to the relation of  geographic location to the way Internet addresses are distributed and managed.  This is a twofold objective: the first is to better understand and gain knowledge of Internet traffic and basic properties. The second is to apply this knowledge in building new network security architectures, applications, and protocols, as well as in securing existing protocols and applications. The proposed research program will focus on the following lines of research:1- Traffic analysis of the patterns and structures that exist in Internet traffic.2- Characterization of malicious activities. (e.g. SPAM, Denial-of-Service)3- Relating network elements (hosts and routers) to geographical location.4- Enabling a new class of security applications that are based on actual knowledge of how the Internet works rather than relying solely on modeling and simulation.