Division of Computer and Network Systems (CNS)

The goal of this project is to design, implement, and test an internetwork architecture called the Accountable Internet Protocol (AIP). AIP retains much of the elegance and simplicity of IP, but is far better equipped to thwart malicious adversaries. To provide this protection, AIP incorporates three kinds of accountability: source accountability, control-plane accountability, and dataplane accountability. Together, these three forms of accountability ensure that any host, router, and autonomous network can identify misbehaving components.

Policy-based access control is one of the most fundamental and widely used mechanisms for achieving privacy and security at both application and network levels. Given the high importance and delicacy of security policies, ensuring the correctness of these policies is important, and yet difficult. A tiny error in security policies could lead to irreparable, if not tragic, consequences. Therefore, identifying discrepancies between policy specifications and their intended function is a crucial task.

Malicious activity on the Internet is a significant threat to both individuals and institutions. Over the past few years, network honeypots have emerged as an important tool for measuring and understanding the details of cyber attacks. The objective of the proposed research is to stimulate the development of next generation Internet security systems and forensic tools based on automated, indepth analysis of malicious activity and malicious software (malware) observed in network honeypots.

Anyone with a moderate amount of skill can intercept Internet mail messages and private web pages to see what they say; can modify messages in transit, changing their content without any trace; and can send fake messages that are indistinguishable from legitimate messages. Cryptography responds to these threats by scrambling and unscrambling packets to protect against forgery and against espionage. An attacker who forges a message can't scramble it in the right way; when legitimate users' computers unscramble the message, they see that it's a forgery and that it should be thrown away.

Network intrusion prevention systems (IPSes) play an important role in protecting computers against attacks originating from thenetwork. Signature matching is a performance-critical operation that each IPS must perform: after storing a reassembled TCP-level byte stream or a field of a higher level protocol in a buffer, the IPS needs to decide whether it matches any of the signatures that describe known attacks. This project investigates methods for representingsignatures that allow fast matching, require little memory, and can support complex signatures expressed as regular expressions.