CICI:TCR:STARNOVA: Scalable Technology to Accelerate Research Network Operations Vulnerability Alerts

网络基础设施在执行跨不同学科的计算和数据密集型科学任务方面发挥着至关重要的作用，这些学科包括数据科学、物理、生物信息学、卫生信息技术和互联网分析。勒索软件、恶意软件和拒绝服务攻击等定向网络攻击可能严重影响基础设施的安全性、可靠性和健壮性，导致科学工作流严重中断。及时和定制的威胁情报有助于网络运营商针对新出现的攻击制定防御策略。本项目设计并实现了可持续技术加速研究网络运营漏洞警报(STARNOVA)平台。STARNOVA利用未经请求的互联网流量提供针对圣地亚哥超级计算机中心(SDSC)网络基础设施的新攻击的早期预警指标。新开发的基础设施扩展了UCSD网络望远镜的可见度，以监控流向SDSC设备IP地址空间的未经请求的流量。该平台应用了新的基于机器学习的时间序列分析方法来检测交通模式中的异常。每个异常的分析结果将自动生成近乎实时的警报，供SDSC操作员针对潜在威胁采取知情的防御行动。该项目发布的软件和结果促进了整个网络安全和科学CI社区的流量数据收集和信息交换，为负担得起的基于社区的解决方案做出贡献，特别是对资源不足的机构至关重要。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Cyberinfrastructure plays a crucial role in performing computational and data-intensive scientific tasks across various disciplines, including data science, physics, bioinformatics, health IT, and Internet analytics. Targeted cyber attacks, such as ransomware, malware, and denial-of-service attacks, can severely impact the infrastructure’s security, reliability, and robustness, leading to significant disruptions to scientific workflows. Timely and customized threat intelligence facilitates development of strategies for network operators defending against emerging attacks.This project designs and implements the Sustainable Technology to Accelerate Research Network Operations Vulnerability Alerts (STARNOVA) platform. STARNOVA leverages unsolicited Internet traffic to provide early-warning indicators of new attacks targeted to cyberinfrastructure at the San Diego Supercomputer Center (SDSC). The newly developed infrastructure extends the visibility of the UCSD network telescope to monitor unsolicited traffic toward SDSC's equipment IP address spaces. The platform applies novel machine learning-based time series analytics methods to detect anomalies in traffic patterns. The analysis results of each anomaly will automatically generate near real-time alerts for SDSC operators to make informed defensive actions against potential threats. The published software and results from this project facilitates traffic data collection and information exchange across the network security and scientific CI community, contributing to affordable community-based solutions, especially critical at under-resourced institutions.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.