用于抢先防御针对超级计算基础设施攻击的安全测试平台
Security Testbed for Preempting Attacks against Supercomputing Infrastructure
AI总结：
针对HPC环境中真实攻击易被掩盖、难以及时防御的问题，本文在NCSA超级计算机中部署安全测试平台，结合200多起历史安全事件总结攻击模式，配套可视化工具，并验证了用因子图模型抢先防御勒索软件的有效性。
摘要：
保护高性能计算（HPC）安全面临独特的威胁模型。与公共云中隔离良好的虚拟机租户不同，利用集中计算能力的不可信恶意代码，可能会对HPC中共享的开放网络环境造成格外严重的影响。因此，在损害发生前抢先防御针对超级计算系统的攻击，仍是安全工作的首要任务。主要挑战在于，嘈杂的攻击尝试和不可靠的警报往往会掩盖真实攻击，导致系统完整性受损、数据泄露等永久性损害。\n本文介绍了一个嵌入在美国国家超级计算应用中心（NCSA）某超级计算机实时流量中的安全测试平台，其目标是验证攻击抢先防御能力，即在千万亿次级超级计算机上阻止系统被攻破和数据泄露。我们在NCSA部署该测试平台后取得了以下核心成果：\n1) 通过梳理NCSA过去二十年间收录的200多起安全事件的真实安全日志，总结出独特攻击模式的特征，带来了相关洞见。\n2) 部署了一款攻击可视化工具，用于说明在HPC环境中识别真实攻击的难点，并为安全运维人员开展交互式攻击分析提供支持。\n3) 通过运行基于因子图（Factor-Graph）的模型等新型模型，验证了该测试平台的效用，可实现对某真实勒索软件家族的抢先防御。
英文摘要：
Securing HPC has a unique threat model. Untrusted, malicious code exploiting the concentrated computing power may exert an outsized impact on the shared, open-networked environment in HPC, unlike well-isolated VM tenants in public clouds. Therefore, preempting attacks targeting supercomputing systems before damage remains the top security priority. The main challenge is that noisy attack attempts and unreliable alerts often mask \emph{real attacks}, causing permanent damages such as system integrity violations and data breaches. This paper describes a security testbed embedded in live traffic of a supercomputer at the National Center for Supercomputing Applications (NCSA). The objective is to demonstrate attack \textit{preemption}, i.e., stopping system compromise and data breaches at petascale supercomputers. Deployment of our testbed at NCSA enables the following key contributions: 1) Insights from characterizing unique \textit{attack patterns} found in real security logs of more than 200 security incidents curated in the past two decades at NCSA. 2) Deployment of an attack visualization tool to illustrate the challenges of identifying real attacks in HPC environments and to support security operators in interactive attack analyses. 3) Demonstrate the utility of the testbed by running novel models, such as Factor-Graph-based models, to preempt a real-world ransomware family.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
