Defending Against Multi-Step Network Intrusions in large-scale computer networks

从长远来看，拟议的研究计划旨在开发自动解释和预测攻击者在保护计算机网络免受入侵方面的进展、策略和意图的技术。在短期内，研究将集中在可扩展和有效的知识表示和算法，以及在大规模分布式计算机系统中防御多步骤入侵的实用系统的设计、实现和评估上。更具体地说，拟议的研究计划将确定当前知识表示的可扩展性差的根本原因，并通过提出有关漏洞和网络连接的知识表示的新方法来消除限制。该研究将设计启发式算法，以寻找最低成本的解决方案来强化网络，并通过广泛的实验评估设计的算法。它还将提出在集成框架中衡量风险、成本、抵抗攻击的安全指标，并设计基于所提议指标优化网络配置的有效算法。最后，研究攻击图的分布式计算和分析，同时考虑潜在的本地安全策略，可能会禁止向其他方泄露漏洞信息。

In the long term, the proposed research program aims to develop techniques for automatically interpreting and predicting attackers' progress, strategies, and intentions in defending computer networks against intrusions. In the short term, the research will be focused on scalable and efficient knowledge representations and algorithms, and on the design, implementation, and evaluation of practical systems for defending against multi-step intrusions in large-scale, distributed computer systems. More specifically, the proposed research program will identify root causes to the poor scalability of current knowledge representation and remove the limitation by proposing novel ways of representing knowledge about vulnerabilities and network connectivity. The research will devise heuristic algorithms for finding minimum-cost solutions to harden a network and evaluate the devised algorithms through extensive experiments. It will also propose security metrics for measuring risks, costs, resistance to attacks in an integrated framework and design efficient algorithms for optimizing network configurations based on the proposed metrics. Finally, it will study the distributed computation and analysis of attack graphs while taking into consideration potential local security policies that may prohibit the disclosure of vulnerability information to other parties.