NSF Invests $50 Million in Research to Secure Our Nation's Cyberspace

Multiple awards include two large "Frontier" collaborative projects totaling $15 million

The National Science Foundation (NSF) today awarded $50 million for research projects to build a cybersecure society and protect the United States' vast information infrastructure.

The investments were made through the NSF's Secure and Trustworthy Cyberspace (SaTC) program, which builds on the agency's long-term support for a wide range of cutting edge interdisciplinary research and education activities to secure critical infrastructure that is vulnerable to a wide range of threats that challenge its security.

"Securing cyberspace is key to America's global economic competitiveness and prosperity," said NSF Director Subra Suresh. "NSF's investment in the fundamental research of cybersecurity is core to national security and economic vitality that embraces efficiency while also maintaining privacy."

In response to the SaTC call for proposals, more than 70 new research projects were funded, with award amounts ranging from about $100,000 to $10 million. This SaTC funding portfolio invests in state-of-the-art research in incentives that reduce the likelihood of cyber attacks and mitigate the negative effects arising from them. Together, these SaTC awards aim to improve the resilience of operating systems, software, hardware and critical infrastructure while preserving privacy, promoting usability and ensuring trustworthiness through foundational research and prototype deployments.

Two of the SaTC funded projects are Frontier awards, which are large, multi-institution projects that aim to provide high-level visibility to grand challenge research areas.

The SaTC program supports research from a number of disciplinary perspectives with investments from NSF's Directorates for Computer and Information Science and Engineering (CISE); Mathematical and Physical Sciences; and Social, Behavioral and Economic Sciences, as well as the Office of Cyberinfrastructure.

"We are excited that the SaTC award portfolio contains many interdisciplinary projects, including these two Frontier projects at the scale and complexity of research centers," said Farnam Jahanian, assistant director of NSF's CISE directorate. "The challenges they address--the technical and economic elements of Internet security and the issues associated with sharing of data in cyberspace while protecting individual privacy--are fundamental; addressing them will help establish a scientific basis for developing and operating computing and communications infrastructure that can resist attacks and be tailored to meet a wide range of technical and policy requirements."

What follows are descriptions of the two Frontier awards.

Beyond Technical Security: Developing an Empirical Basis for Socio-Economic Perspectives

University of California-San Diego - Stefan Savage

International Computer Science Institute - Vern Paxson

George Mason University - Damon McCoy

This project will receive a five-year grant totaling $10 million to tackle the technical and economic elements of Internet security: how the motivations and interactions of attackers, defenders and users shape the threats we face, how they evolve over time and how they can best be addressed.

While security is mediated by the technical workings of computers and networks, a commensurate level of scrutiny is driven by conflict between economic and social issues. Today's online attackers are commonly profit-seeking, and the implicit social networks that link them together play a critical role in fostering underlying cybercrime markets. By using a socio-economic lens, this project seeks to gain insights for understanding attackers, as well as victims, in order to help consumers, corporations and governments make large investments in security technology with greater understanding of their ultimate return-on-investment.

Security research has tended to focus only on the technologies that enable and defend against attacks. This project also emphasizes the economic incentives that motivate the majority of Internet attacks, the elaborate marketplaces that support them, and the relationships among cyber criminals who rely upon each other for services and expertise.

Grappling with both the economic and technical dimensions of cybersecurity is of fundamental importance for achieving a secure future information infrastructure, and developing a sound understanding requires research grounded in observation and experiment. Accordingly, the research will focus on four key components to:

1.Pursue in-depth empirical analyses of a range of online criminal activities.

2.Map out the evolving attacker ecosystem that preys on online social networks, and the extent to which unsafe online behavior is itself adopted and transmitted.

3.Study how relationships among these criminals are established, maintained and evolve over time.

4.Measure the efficacy of today's security interventions, both at large and at the level of individual users.

Consequently, this research has the potential to dramatically benefit society by undermining entire cybercrime ecosystems by, for example, disrupting underground activities, infrastructure and social networks.

Privacy Tools for Sharing Research Data

Harvard University - Salil Vadhan

A multi-disciplinary team of researchers at Harvard University will receive a four-year grant totaling nearly $5 million to develop tools and policies to aid the collection, analysis and sharing of data in cyberspace, while protecting individual privacy.

Today, information technology, advances in statistical computing and the deluge of data available through the Internet are transforming all areas of science and engineering. However, maintaining the privacy of human subjects is a major challenge. Given the complexities involved in ensuring privacy for shared research data, Vadhan will be joined by a team of professors with expertise in areas such as mathematics and statistics, government, technology and law. Together they will engage in a multi-disciplinary approach to refine and develop definitions and measures for privacy and data utility. They will also design an array of technological, legal and policy tools that can be used when dealing with sensitive data.

These tools will be tested and deployed at the Harvard Institute for Quantitative Social Science's Dataverse Network, an open-source digital repository that offers the largest catalogue of science datasets in the world. The ideas and tools developed in this project will have a significant broad impact on society since the issues addressed in the work arise in many other important domains, including public health and electronic commerce.

 -NSF-