Intelligent network survivability tools

大多数中型和大型网络基础设施包括到Internet的多个高速连接，并支持许多客户协作网络；成千上万的内部用户和各种web服务器。由于各种攻击和安全漏洞，这些系统中的许多都面临着不断增加的意外停机可能性。为了充分保护这些网络，迫切需要能够交付能够自动检测入侵模式和性能瓶颈并自动进行自我防御的系统。由于通信网络的规模、分布和复杂性呈指数级增长，当前的入侵检测/防御技术对新的攻击不是很有效，并且在性能、可伸缩性和灵活性方面存在严重的限制。此外，对这些系统的改进往往太慢、太少，跟不上攻击者的创新。当前入侵检测系统存在的主要缺陷有：1)误报量大；2)无法检测未知攻击；3)无法正确评估滥用的相对危险并提供适当的应对措施。人们普遍认为，入侵检测技术的主要重点必须是：a)降低误报率；B)开发非基于签名的入侵检测方法；c)注重预防而不是发现。我们研究工作的主要目标是确定一组模型/工具/技术，这些模型/工具/技术非常适合解决上述缺点。我们将专注于开发：1)自动检测流或事件流中的异常的算法；2)自动规则调整、学习和适应；3)针对多阶段攻击的预警关联和图形创建；4)自动发现网络应用；5)网络攻击仿真。一个工具，允许模拟攻击和“假设”和“你知道吗”的场景，以识别安全漏洞和评估准备情况，是网络管理员非常感兴趣的。

Most medium and large-scale network infrastructures include multiple high-speed connections to the Internet and support many customer collaborative networks; thousands of internal users and various web servers. Many of these systems are faced with an ever-increasing likelihood of unplanned downtime due to various attacks and security breaches. In order to adequately protect these networks there is a critical need to be able to deliver systems that can automatically detect intrusion patterns and performance bottlenecks, and automatically defend themselves. Due to the exponential growth in size, distribution, and complexity of communication networks, current intrusion detection/prevention technologies are not very effective against new attacks and have severe limitations as far as performance, scalability, and flexibility are concerned. Moreover, the improvements to these systems are often too slow and too little to keep up with the innovations by the attackers. The main drawbacks of the current intrusion detection systems are: 1) the large number of false positives; 2) the inability to detect unknown attacks; and, 3) the inability to properly assess the relative danger of the misuse and provide an appropriate response. There is a general consensus that the primary focus of the intrusion detection technologies must be: a) to reduce the rate of false positives; b) to develop non-signature-based intrusion detection methods; and, c) work on prevention instead of detection. The primary objective of our research work is to identify a bank of models/tools/techniques that are well suited to address the above shortcomings. We will focus on developing: 1) algorithms for automatically detecting anomalies in flow or event streams; 2) automated rules tuning, learning and adaptation; 3) alert correlation and creation of graphs for multi-stage attacks; 4) automatic discovery of network applications; and, 5) simulation of network attacks. A tool which allows simulation of attacks and `what-if' and `did you know' scenarios to identify security loopholes and assess preparedness, and is of great interest to network administrators.