CICI:TCR:STARNOVA: Scalable Technology to Accelerate Research Network Operations Vulnerability Alerts

CICI:TCR:STARNOVA：可扩展技术加速研究网络运营漏洞警报

• 批准号: 2319959
• 负责人: Ka Pui Mok
• 金额: $ 120万
• 依托单位: University of California-San Diego
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-08-15 至 2026-07-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2319959&HistoricalAwards=false
• 关键词: CICI; TCR; STARNOVA; Scalable; Technology

Cyberinfrastructure plays a crucial role in performing computational and data-intensive scientific tasks across various disciplines, including data science, physics, bioinformatics, health IT, and Internet analytics. Targeted cyber attacks, such as ransomware, malware, and denial-of-service attacks, can severely impact the infrastructure’s security, reliability, and robustness, leading to significant disruptions to scientific workflows. Timely and customized threat intelligence facilitates development of strategies for network operators defending against emerging attacks.This project designs and implements the Sustainable Technology to Accelerate Research Network Operations Vulnerability Alerts (STARNOVA) platform. STARNOVA leverages unsolicited Internet traffic to provide early-warning indicators of new attacks targeted to cyberinfrastructure at the San Diego Supercomputer Center (SDSC). The newly developed infrastructure extends the visibility of the UCSD network telescope to monitor unsolicited traffic toward SDSC's equipment IP address spaces. The platform applies novel machine learning-based time series analytics methods to detect anomalies in traffic patterns. The analysis results of each anomaly will automatically generate near real-time alerts for SDSC operators to make informed defensive actions against potential threats. The published software and results from this project facilitates traffic data collection and information exchange across the network security and scientific CI community, contributing to affordable community-based solutions, especially critical at under-resourced institutions.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

网络基础设施在执行各种学科的计算和数据密集型科学任务方面发挥着至关重要的作用，包括数据科学、物理学、生物信息学、健康信息技术和互联网分析。有针对性的网络攻击，如勒索软件、恶意软件和拒绝服务攻击，会严重影响基础设施的安全性、可靠性和稳健性，导致科学工作流程的严重中断。及时定制的威胁情报有助于网络运营商制定防御新出现的攻击的策略。该项目设计并实施了加速研究网络操作漏洞警报（STARNOVA）平台的可持续技术。STARNOVA利用未经请求的互联网流量，为针对圣地亚哥超级计算机中心（SDSC）网络基础设施的新攻击提供预警指标。新开发的基础设施扩展了UCSD网络望远镜的可见性，以监控针对SDSC设备IP地址空间的未经请求的流量。该平台采用新颖的基于机器学习的时间序列分析方法来检测交通模式中的异常情况。每个异常的分析结果将自动生成接近实时的警报，供SDSC运营商针对潜在威胁做出明智的防御行动。该项目发布的软件和成果促进了整个网络安全和科学CI社区的流量数据收集和信息交换，有助于提供负担得起的社区解决方案，对资源不足的机构尤其重要。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。