基于互联网基础设施操控的高级持续网络攻击检测与防范

项目名称： 基于互联网基础设施操控的高级持续网络攻击检测与防范

项目编号： No.61472215

项目类型： 面上项目

立项/批准年度： 2015

项目学科： 自动化技术、计算机技术

项目作者： 段海新

作者单位： 清华大学

项目金额： 87万元

中文摘要： 互联网基础设施（本项目指BGP、DNS、PKI和CDN）的设计存在许多漏洞，且面临着来自政府级的高级持续威胁。中国互联网虽规模很大，但基础设施却处在边缘，依赖他国，面临着严重威胁。 我们提出两个问题：1）作为全球分布式系统（BGP、DNS、PKI、CDN）的子集，国家层面基础设施的攻击面（Attack Surface）在哪里？屡次发生的攻击（BGP、DNS）表明，一个子系统的边界是模糊的；2）这些系统的安全机制（如BGPSEC、DNSSEC）最终都依赖于少数信任权威，我们如何防止这些信任权威被滥用？ 围绕上述问题，我们将对上述四个系统开展四个环节的研究：1）攻击面分析和风险评估；2）新的攻击方法研究；3）操控行为（比如BGP或DNS劫持）的监测和预警；4）改进协议或系统的设计以杜绝攻击。我们将结合控制和数据平面、主动和被动测量方法，在已有经验的基础上从世界范围内开展多点、长期的监测或测量。

中文关键词： 网络空间安全；高级持续威胁；路由安全；域名系统安全；公钥基础设施

英文摘要： Internet Infrastracture(BGP, DNS, PKI and CDN) was designed with many security vulnerabilities, which could be manipulated by governmental attacker to initiate advanced persistent attacks. Particularly, Chinese Internet infrastructure faces very serious threats because of its edge position and it dependency on other part of the Internet. We present two problems: 1) As a subset of a global distributed system(BGP, DNS, PKI and CDN), where is the attack surface of a nation level infrastructure? Attacks in the history demostrated that the surface is blured. 2) Security mechanisms(such as DNSSEC and BGPSEC) finally depend on one or a few centralized trust authorities, but how can we be assured that these authorities will not be abused ? Focusing on these problems of four systems aforementioned, we will conduct our research from four phases: 1) attack surface analysis and risk assessment; 2) design of new attacking or exploiting vectors 3) monitoring and alert of manipulation attacks(such as BGP or DNS hijacking) 4) enhancment of the security for related protocols or systems to prevent the manipulation. We will lauch a long term probing and monitoring of the Internet infrastructure from many vantage points distrubted globally, combining the information from both control plane and data plane, active measurement and passive measurement method.

英文关键词： Cyberspace Security;BGP Security;DNS Security;PKI;Advanced and Persistent Threats