Abstract

Network-security analysis is currently a tedious and detailed exercise that starts with analysts collecting data from diverse sources (such as network traffic, server histories and individual computer states), and then cross-comparing this information against attack data, such as malicious host names or malware descriptions. Analysts then make security decisions by manually inspecting these data sets and looking for rare but dangerous events. Unsurprisingly, this is an error-prone process, which is further complicated by rising traffic volumes, complex network structures, and confounding factors such as proxies and Network Address Translation (NAT) boxes. This project's goal is to use ideas inspired by formal methods to develop a novel framework to automate network-traffic analysis. By improving data collection through better sensor placement and by analyzing the provenance of hostile events, the project's impacts …

Date

2021

Authors

Mukund Raghothaman, Srivatsan Ravi, Jyotirmoy V Deshmukh, Michael P Collins

Journal

NSF Award

Volume

21

Issue

2124431

Pages

24431