MRI: Development of iSNARLD (Instrument for Situational Network Awareness for Real-time and Long-term Data)

University Of Tennessee Knoxville, Knoxville TN

Investigators

Abstract

In partnership with Alliance Technology Group (Alliance), The University of Tennessee (UT) proposes to develop an instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD). Developing this unique instrument enables network packet capture coupled with a powerful analytics engine capable of providing insights into the characteristics of network traffic, breadth of traffic flows, detection of potential attacks or unauthorized data exfiltration, sources of inefficiencies or incorrect behaviors, and the behaviors of user or automated traffic. This instrument will enable, for the first time, analysis that can focus on a specific point in time (such as for real-time analysis), across a range of time spanning months to years, or both. Leveraging the respective strengths in the current the partnership will greatly enhance the prospects for developing an effective instrument with unprecedented capabilities and versatility. Furthermore, the collected network traffic data and associated analytics capabilities will provide information enabling revolutionary new insight into a spectrum of exciting new research thrusts, such as cyber security in forensics and intrusion detection, real-time network situational awareness, operations research into network performance and bottleneck identification, as well as a limitless panoply of other possibilities that heretofore have been impossible. Ergo, the project has extraordinary potential impact on the broad research community as well as to society as a whole. Moreover, the system will impact national cyberinfrastructure and local research as well as the educational mission at UT. Finally, the proposed system has excellent prospects for wide commercial adoption through the partnership with Alliance Technology. The proposed instrument for Situational Network Awareness for Real-time and Long-term Data (iSNARLD) will fundamentally transform networking and security research through its packet capture and impressive analytics capability. The instrument is the next major step in the evolution of networking infrastructure that provides high bandwidth coupled with security capabilities to detect intrusion and protect computational and data assets. The instrument will build upon a 20Gb/sec SentryWire Sentry 250 system from Alliance with an effective capacity of up to 4 PB (sufficient for months of network data, depending on specific traffic patterns). The proposed system will provide: (1) high-bandwidth, lossless packet capture; (2) metadata extraction to summarize and aggregate packet data to enable efficient analytics; (3) (near) real-time data analytics to support situational awareness of flows and performance along with security applications such as intrusion detection and prevention of data exfiltration; (4) batch or off-line analytics for machine-learning-based discovery; (5) visualization support for enhanced situational awareness and network usage insight; and (6) unprecedented scale of network data (months to years) for analysis. The proposed system presents dramatically improved capabilities for providing situational awareness and understanding network usage in real-time or across periods spanning months to years, providing revolutionary opportunities across a broad spectrum of networking research, operations, and even social science.