(NSF CNS-1059439) CRI-Telescope: A Real-time Lens into Dark Address Space of the Internet

| Project Summary Proposal |

Project Summary

In the last decade, network telescopes have been used to observe unsolicited Internet traffic ("background radiation") sent to unassigned address space ("darkspace"). Network telescopes are one of the few types of instrumentation that allow global visibility into and historical trend analysis of a wide range of security-related events, including scanning address space for vulnerable targets, random spoofed source denial-of-service attacks, the automated spread of malicious software such as Internet worms or viruses, and miscellaneous misconfigurations. In recent years, traffic destined to darkspace has evolved to include longer-duration, low-intensity events intended to establish and maintain botnets. We propose to expand our telescope instrumentation to enable researchers to exploit this unique global data source to improve our understanding of security-related events such as large-scale attacks and malware spread.

Three pervasive challenges in network traffic research, including the telescope traffic, guide our proposed expansion: collection and storage, efficient curation, and sharing large volumes of data. The volume of data captured by the telescope is expensive to store, limiting the number of researchers who can realistically download data sets. The situation is worse during malicious activity outbreaks when the data volumes increase sharply, yet rapid analysis and response are necessary. Perhaps the most challenging obstacles to sharing any kind of Internet traffic data (even data to unused addresses!) are the privacy and security concerns. Viruses and worms may involve the installation of backdoors that provide unfettered access to infected computers, and telescope data could advertise these especially vulnerable machines.

We propose to deploy and evaluate an innovative shift in network monitoring that explicitly addresses all three challenges: enable near-real-time sharing of traffic data, in a way that maximizes data utility for research and analysis while protecting user privacy. We will improve classification of traffic to use a more modern taxonomy, including classes of DoS attacks, vulnerability scans, and malware spread. A meaningful taxonomy will help to create triggers to detect and notify interested researchers of events that merit more comprehensive measurement and analysis. We will also build infrastructure to allow vetted researchers to run analysis programs approximately one hour after data collection. For safe and ethical data sharing, we will use our recent Privacy-Sensitive Sharing Framework (PS2) which integrates privacy-enhancing technology with a policy framework using proven and standard privacy principles and obligations of data seekers and data providers.

The intellectual merit of our proposal lies in our proposed methodology and instrumentation enhancements that will increase the utility of network telescope instrumentation, transforming it into a more accessible, practically useful source of security-relevant data. The results of this project will contribute to developing efficient early detection, reaction and mitigation strategies thus enabling more scientific pursuit of cybersecurity research and critical advances in the global fight against pervasive malware.

The broader impacts of this project are diverse. We will broadly disseminate the results of this project to academic and security experts community via conferences, web sites, blogs and by organizing the proposed workshop. By creating educational data kits out of samples of telescope data containing security event signatures, this project creates an immediate link between research and education. Most importantly, it promises convenient remote access to a wealth of data, high-level computing resources and expertise of CAIDA researchers, lowering barriers to engaging in network security research for institutions serving underrepresented minorities.

Management Plan

The schedule of work below shows how we plan to accomplish the three proposed tasks in two years of the project.

Subtask	Description	Year 1 (July 1, 2011 - June 30, 2012)	Year 2 (July 1, 2012 - June 30, 2013)	Status
Task 1: Enhance tools for telescope data analysis and visualization
1.1	Refine classification and reporting	full year	1st and 2nd quarters
1.2	Integrate reporting software with ongoing data collection	3rd and 4th quarters	1st and 2nd quarters
1.3	Write software documentation	3rd and 4th quarters	full year
1.4	Add geographic analysis to real-time report software		2nd, 3rd, and 4th quarters
1.5	Improve attribute-based classification after feedback at workshop		2nd, 3rd, and 4th quarters
Task 2: Enable real-time sharing of telescope data
2.1	Purchase a new server to collect data	3rd and 4th quarters
2.2	Create web pages announcing the availability of telescope data	3rd quarter
2.3	Purchase a new server to host user accounts	3rd quarter
2.4	Create user accounts and monitoring system to review requests	4th quarter
2.5	Invite selected researchers to evaluate our data and approach	4th quarter	1st quarter
Task 3: Community Development
3.1	Write and publish AUP for real-time telescope data access	2nd quarter
3.2	Organize the workshop	4th quarter
3.3	Publish the workshop report and recommentations		1st and 2nd quarters
3.4	Refine data-sharing frameworks using the feedback from researchers		2nd and 3rd quarters
3.5	Prepare annotated educational telescope data kits		full year