CICI: TCR: Realizing the Potential of Multifractal Address-Structure Anomaly Detection to Secure Scientific Cyberinfrastructure Against Unsolicited Internet Traffic
Funding source: NSF CICI-2613540. Period of performance: 07/01/2026 -- 06/30/2029.Project Overview
Modern science depends on geo-distributed cyberinfrastructure connected through the public Internet. While this connectivity enables resource sharing, collaboration, and distributed experiments, it also exposes cyberinfrastructure to malicious traffic and unsolicited connections from attackers anywhere on the Internet. To mitigate the induced risks, operators of cyberinfrastructure are forced to restrict the types of connectivity allowed (e.g., allow lists) which limits the infrastructure's scientific potential. This project investigates new tools for detecting malicious and unsolicited connections based on the addresses from which they originate, thus enabling operators to deploy finer-grained security policies and to realize new connectivity potential.
The project's core approach uses recently developed statistical methods to quantify the structure of addresses connecting to particular science cyberinfrastructure resources. Normal users of the resource induce a distinctive structure. When new, potentially malicious addresses first connect, they induce changes in this structure that the statistical methods can detect. The novel contributions of this project include a security analysis of address-structure-based malicious connection detection, a real-world evaluation through integration with the Sage Grande testbed, and new integrations with Link Oregon and the University of Oregon network to protect multiple science projects sharing common infrastructure. Project outcomes will improve malicious connection detection and flexible security policy support for collaborating science cyberinfrastructure operators. The project also serves as a model, providing real-world experience, evaluation, and functional tools, to enable other operators of science cyberinfrastructure across the Nation to leverage the benefits of the proposed statistical detection method.
People
- Lead PI: Chris Misa
- Co-PIs: Ram Durairajan (Co-PI), Reza Rejaie (Co-PI), Rajesh Sankaran (Co-PI), Kevin Bohan (Co-PI)
- Ph.D. Students: TBD
- B.S. Students: TBD