CICI: TCR: Realizing the Potential of Multifractal Address-Structure Anomaly Detection to Secure Scientific Cyberinfrastructure Against Unsolicited Internet Traffic

Modern science depends on geo-distributed cyberinfrastructure connected through the public Internet. While this connectivity enables resource sharing, collaboration, and distributed experiments, it also exposes cyberinfrastructure to malicious traffic and unsolicited connections from attackers anywhere on the Internet. To mitigate the induced risks, operators of cyberinfrastructure are forced to restrict the types of connectivity allowed (e.g., allow lists) which limits the infrastructure's scientific potential. This project investigates new tools for detecting malicious and unsolicited connections based on the addresses from which they originate, thus enabling operators to deploy finer-grained security policies and to realize new connectivity potential. The project's core approach uses recently developed statistical methods to quantify the structure of addresses connecting to particular science cyberinfrastructure resources. Normal users of the resource induce a distinctive structure. When new, potentially malicious addresses first connect, they induce changes in this structure that the statistical methods can detect. The novel contributions of this project include a security analysis of address-structure-based malicious connection detection, a real-world evaluation through integration with the Sage Grande testbed, and new integrations with Link Oregon and the University of Oregon network to protect multiple science projects sharing common infrastructure. Project outcomes will improve malicious connection detection and flexible security policy support for collaborating science cyberinfrastructure operators. The project also serves as a model, providing real-world experience, evaluation, and functional tools, to enable other operators of science cyberinfrastructure across the Nation to leverage the benefits of the proposed statistical detection method. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria. NSF Award ID: 2613540 | Program: 01002627DB NSF RESEARCH & RELATED ACTIVIT | Principal Investigator: Christopher Misa | Institution: University of Oregon Eugene, EUGENE, OR | Award Amount: $1,200,000 View on NSF Award Search: https://www.nsf.gov/awardsearch/show-award/?AWD_ID=2613540 View on Research.gov: https://www.research.gov/awardapi-service/v1/awards/2613540.html