CICI:TCR:STARNOVA: Scalable Technology to Accelerate Research Network Operations Vulnerability Alerts

网络基础设施在跨各个学科执行计算和数据密集型科学任务方面发挥着至关重要的作用，包括数据科学，物理学，生物信息学，健康IT和互联网分析。有针对性的网络攻击，如勒索软件、恶意软件和拒绝服务攻击，可能严重影响基础设施的安全性、可靠性和鲁棒性，导致科学工作流程严重中断。及时和定制的威胁情报有助于网络运营商制定防御新兴攻击的策略。该项目设计并实施了可持续技术加速研究网络运营漏洞警报（STARNOVA）平台。STARNOVA利用未经请求的互联网流量提供针对圣地亚哥超级计算机中心（SDSC）网络基础设施的新攻击的预警指标。新开发的基础设施扩展了UCSD网络望远镜的可见性，以监控向SDSC设备IP地址空间发送的未经请求的流量。该平台应用了新的基于机器学习的时间序列分析方法来检测流量模式中的异常。每个异常的分析结果将自动生成接近实时的警报，以便SDSC运营商针对潜在威胁采取明智的防御行动。该项目发布的软件和成果促进了网络安全和科学CI社区之间的流量数据收集和信息交换，有助于提供负担得起的基于社区的解决方案，特别是对资源不足的机构至关重要。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Cyberinfrastructure plays a crucial role in performing computational and data-intensive scientific tasks across various disciplines, including data science, physics, bioinformatics, health IT, and Internet analytics. Targeted cyber attacks, such as ransomware, malware, and denial-of-service attacks, can severely impact the infrastructure’s security, reliability, and robustness, leading to significant disruptions to scientific workflows. Timely and customized threat intelligence facilitates development of strategies for network operators defending against emerging attacks.This project designs and implements the Sustainable Technology to Accelerate Research Network Operations Vulnerability Alerts (STARNOVA) platform. STARNOVA leverages unsolicited Internet traffic to provide early-warning indicators of new attacks targeted to cyberinfrastructure at the San Diego Supercomputer Center (SDSC). The newly developed infrastructure extends the visibility of the UCSD network telescope to monitor unsolicited traffic toward SDSC's equipment IP address spaces. The platform applies novel machine learning-based time series analytics methods to detect anomalies in traffic patterns. The analysis results of each anomaly will automatically generate near real-time alerts for SDSC operators to make informed defensive actions against potential threats. The published software and results from this project facilitates traffic data collection and information exchange across the network security and scientific CI community, contributing to affordable community-based solutions, especially critical at under-resourced institutions.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.