Enterprise security

从科学到娱乐，从政府到工业，从经济到我们的文化，互联网已经成为现代生活几乎所有方面不可或缺的一部分，这是一个不言而喻的事实。但是，虽然互联网的开放架构一直是其爆炸式增长的主要推动力，但同样的开放性，加上安装在终端主机上的大量不安全商业软件，为攻击者提供了几乎取之不尽的易受攻击的主机，这些主机要么是主要受害者，要么是攻击链中的中间步骤。这些威胁危及互联网上商业和活动的安全性和完整性。

It is a truism that the Internet has become integral to nearly all aspects of modern life, from science to entertainment, from government to industry, from the economy to our culture. But while the open architecture of the Internet has been the chief enabler of it's explosive growth, this same openness, combined with the abundance of insecure commercial software installed in end-hosts, has provided attackers with a nearly inexhaustible supply of vulnerable hosts to exploit, either as primary victims or as intermediate steps in a chain of exploits. These threats comprimise the safety and integrity of commerce and activity on the Internet. We propose here research into techniques and tools for enterprises to better secure their networks, hosts, and data resources. Two themes recur throughout this research. The first is an emphasis on the anomaly detection approach rather than the misuse detection approach. In the later, models are made of illegitimate traffic and alarms are raised when traffic or behaviour matches a model. In the former, a model is made of legitimate traffic and an alarm is raised when traffic or behaviour deviates from the model. The majority of security tools rely on misuse detection as there is a wide-spread belief that the behaviour of computing systems are too complex to model for use in anomaly detection. Two of the projects described in this proposal involve modelling complex domains. The second theme is an emphasis on measuring and improving the tradeoff between security and usability/availability.