초록 ▼

- 빅데이터 분석을 통해 새로운 보안 위협을 이해하고, 이를 효과적으로 다룰 수 있는 측정 알고리즘을 개발하고, 이를 새로운 보안 분석도구에 통합한다.
- 딥러닝을 포함한 여러 가지 발전된 기계학습 기법을 이용해서, 다양한 공격 기법을 정확하고 확고하게 모델링한다.
- 공격자 중심의 빅데이터 분석 접근 방법을 통해 Advanced Persistent DDoS 공격(APDDoS)과 같은 새로운 보안 위협에 대한 방어 체계를 개발한다.
- 개발한 방어체계의 효과적인 평가를 위해 APDDoS를 시뮬레이션 할 수 있는 도구

- 빅데이터 분석을 통해 새로운 보안 위협을 이해하고, 이를 효과적으로 다룰 수 있는 측정 알고리즘을 개발하고, 이를 새로운 보안 분석도구에 통합한다.
- 딥러닝을 포함한 여러 가지 발전된 기계학습 기법을 이용해서, 다양한 공격 기법을 정확하고 확고하게 모델링한다.
- 공격자 중심의 빅데이터 분석 접근 방법을 통해 Advanced Persistent DDoS 공격(APDDoS)과 같은 새로운 보안 위협에 대한 방어 체계를 개발한다.
- 개발한 방어체계의 효과적인 평가를 위해 APDDoS를 시뮬레이션 할 수 있는 도구를 개발하고 이를 관련 연구그룹과 공유한다.
- 이 연구 과제를 통해 한미 양국의 두 우수한 연구실의 국제적 협력 관계를 더욱 더 공고히 할 수 있을 것으로 기대한다.

(출처 : 보고서 요약서 3p)

Abstract ▼

Purpose
The research goal of this proposal is multi-fold: 1) understanding the potential of big data tools for understanding emerging security threats via data analytics. 2) exploring advanced machine learning techniques, including multi-layered machine learning models for accurately and robustly

Purpose
The research goal of this proposal is multi-fold: 1) understanding the potential of big data tools for understanding emerging security threats via data analytics. 2) exploring advanced machine learning techniques, including multi-layered machine learning models for accurately and robustly modeling adversaries, 3) Use an attacker-centric and big-data approach to developing defenses against emerging threats (namely, advanced and persistent DDoS attacks), and 4) Produce tools to the domestic and international research community for simulating DDoS attacks and their features for understanding the effectiveness of devised defenses. A byproduct of the proposed research is fostering a global collaboration between the two research labs building on prior research collaboration.

contents
* Big data approach to threat measurements and analysis: we propose an in-depth big data-driven analyses of botnet-based DDoS characteristics, including attack protocols, attack frequency, attack duration, attack magnitude, attack source, targeted organizational and geographical distributions, intra- and inter-attack family collaborative attacks, etc. We design a set of algorithms that accurately measure in real-time various attributes of big data. We focus on new findings that will lead to directly or indirectly in devising DDoS defenses.
* Statistical Analysis and Machine learning for attack(er) modeling: We explore learning and statistical techniques to modeling of attackers, their characteristics, and strategies. Today's threat actors use very sophisticated techniques to launch attacks, and each characteristic is modeled and predicted via a layer of learning. We aim to study the underlying strategies of botmasters and construct models to characterize them. We expect such models to allow us to accurately predict some properties of DDoS attacks and aid accurate and robust mitigation.
* Big Data-Driven DDoS Defenses: By having a finer understanding of the characteristics of adversaries, we plan to pursue adversary centric and data-driven DDoS mitigation and defense strategies that are effective and efficient.
* Tool Development: We will use models for DDoS patterns and their prediction to develop DDoS simulation tools. Most of existing tools are based on high-level or simplified models for attackers' characteristics, attack duration, attack magnitude, etc. Thus, the traffic generated loses many properties of real-world attack traffic. We propose to build our findings into simulators that can provide more fine-grained details for the broader research community to research DDoS attacks.

Developement results
International conference papers: 28 / SCI papers : 9

Expected Contribution
The potential research outcomes of this proposal are as follows (i) Using big data and analytics tools, the proposed research will provide a better understanding of critical operational issues for one of the most prevalent security threats, the distributed denial of service attacks by advanced malicious actors. (ii) The mathematical models and associated tools will help improve Internet DDoS attack defenses. (iii) The developed techniques and tools will provide state-of-the-art artifacts to the research and industrial community for defenses. (iv) Anonymized data used in this project and all data artifacts from models and simulations will be shared with the research community in ways that facilitate reproducibility of results. (v) The PIs will enhance network and system security courses taught at their institutes, enhance research partnership through mutual exchange programs and activities.

(출처 : SUMMARY 5p)

목차 Contents

• 표지 ... 1
• 제출문 ... 2
• 보고서 요약서 ... 3
• 요 약 문 ... 4
• SUMMARY ... 5
• 목차 ... 6
• 1. 연구개발 목표 및 내용 ... 7
• 가. 최종 목표 ... 7
• 나. 단계목표(당초 목표 및 수정․보완 목표) ... 8
• 다. 당초 목표의 수정․보완(중요 연구변경) 사유 ... 8
• 라. 1단계 연차별 연구목표 및 내용 ... 9
• 2. 연구 추진전략 및 방법 ... 12
• 3. 주요 연구개발 결과 ... 15
• 가. 목표달성도 ... 15
• 나. 대표적 연구업적 ... 42
• 4. 연구결과의 활용계획 ... 46
• 5. 연구개발성과 현황 ... 47
• 6. 국가과학기술종합정보시스템에 등록한 연구시설․장비 현황 ... 56
• 7. Final report for 1st Phase of GRL ... 57
• 끝페이지 ... 94