Defending Against Multi-Step Network Intrusions in large-scale computer networks

从长远来看，拟议的研究计划旨在开发自动解释和预测攻击者在保护计算机网络免受入侵方面的进度、策略和意图的技术。在短期内，研究将集中在可扩展和高效的知识表示和算法，以及用于防御大规模、分布式计算机系统中的多步骤入侵的实用系统的设计、实现和评估。更具体地说，拟议的研究计划将确定当前知识表示可扩展性差的根本原因，并通过提出表示有关漏洞和网络连接的知识的新方法来消除这一限制。这项研究将设计启发式算法来寻找加固网络的最小成本解决方案，并通过广泛的实验对设计的算法进行评估。它还将在一个集成框架中提出用于衡量风险、成本和抗攻击能力的安全指标，并根据建议的指标设计高效的算法来优化网络配置。最后，它将研究攻击图的分布式计算和分析，同时考虑可能禁止向其他方泄露漏洞信息的潜在本地安全策略。

In the long term, the proposed research program aims to develop techniques for automatically interpreting and predicting attackers' progress, strategies, and intentions in defending computer networks against intrusions. In the short term, the research will be focused on scalable and efficient knowledge representations and algorithms, and on the design, implementation, and evaluation of practical systems for defending against multi-step intrusions in large-scale, distributed computer systems. More specifically, the proposed research program will identify root causes to the poor scalability of current knowledge representation and remove the limitation by proposing novel ways of representing knowledge about vulnerabilities and network connectivity. The research will devise heuristic algorithms for finding minimum-cost solutions to harden a network and evaluate the devised algorithms through extensive experiments. It will also propose security metrics for measuring risks, costs, resistance to attacks in an integrated framework and design efficient algorithms for optimizing network configurations based on the proposed metrics. Finally, it will study the distributed computation and analysis of attack graphs while taking into consideration potential local security policies that may prohibit the disclosure of vulnerability information to other parties.