CICI:TCR:STARNOVA: Scalable Technology to Accelerate Research Network Operations Vulnerability Alerts

Cyberinfrastructure plays a crucial role in performing computational and data-intensive scientific tasks across various disciplines, including data science, physics, bioinformatics, health IT, and Internet analytics. Targeted cyber attacks, such as ransomware, malware, and denial-of-service attacks, can severely impact the infrastructure’s security, reliability, and robustness, leading to significant disruptions to scientific workflows. Timely and customized threat intelligence facilitates development of strategies for network operators defending against emerging attacks. This project designs and implements the Sustainable Technology to Accelerate Research Network Operations Vulnerability Alerts (STARNOVA) platform. STARNOVA leverages unsolicited Internet traffic to provide early-warning indicators of new attacks targeted to cyberinfrastructure at the San Diego Supercomputer Center (SDSC). The newly developed infrastructure extends the visibility of the UCSD network telescope to monitor unsolicited traffic toward SDSC's equipment IP address spaces. The platform applies novel machine learning-based time series analytics methods to detect anomalies in traffic patterns. The analysis results of each anomaly will automatically generate near real-time alerts for SDSC operators to make informed defensive actions against potential threats. The published software and results from this project facilitates traffic data collection and information exchange across the network security and scientific CI community, contributing to affordable community-based solutions, especially critical at under-resourced institutions. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.