Cici: TCR: making network telescopes dynamically adaptable through network programmability

This federal Project Grant award, funded by the National Science Foundation's (NSF) Computer and Information Science and Engineering (CISE) Program (CFDA 47.070), supports the development of a novel "Dynamic Network Telescope" system. The $1.2 million grant aims to deploy and evaluate this experimental system at the Merit Network Telescope, one of the largest network telescopes available to the research community.

The project will enable the Merit Network, a nonprofit regional research and education network, to host and configure the Dynamic Network Telescope infrastructure, including a switch and server, to capture and analyze unsolicited internet traffic. This will help overcome challenges faced by traditional network telescopes, such as address space scarcity and malicious actors avoiding detection. The grant includes a $153,000 sub-award to Merit Network to support their role in hosting, configuring, and evaluating the Dynamic Network Telescope system over the 3-year project period ending July 31, 2027. The goal is to enhance the research and cybersecurity capabilities of network telescopes through this novel programmable approach.

Abstract

A network telescope is a research infrastructure also used for cybersecurity operations. IT monitors traffic reaching internet address space that is not assigned to any hosts. This traffic is therefore unsolicited?a sort of pollution?and is constituted of an evolving mix of diverse traffic components originating from across the whole internet. For more than two decades, network telescope instrumentation has enabled research breakthroughs by allowing global visibility into a wide range of internet phenomena: from the automated spread of malicious software such as internet viruses to internet blackouts. Measurement and analysis of such macroscopic phenomena are of key relevance for the security and reliability of the internet infrastructure but also provide data and inspire progress in interdisciplinary studies. However, due to the increasing scarcity of IPV4 address space, the size of telescopes has been progressively eroding over the years, to the point that some organizations stopped operating them or reduced their size, which lessens their research and educational utility. Another new issue with this research infrastructure is that malicious actors have been learning to ?blacklist? Network telescopes and can avoid them when scanning the internet. A novel methodology, called dynamic network telescopes, overcomes these issues. A dynamic telescope is based on deploying programmable switches at the border of the organization?s network to continuously discover utilization of internal space and adaptively adjust the scope of traffic capture. This project deploys the very first implementation of such novel solution at the merit network telescope, one of the largest network telescopes available to the research community. Merit is an independent nonprofit governed by michigan?s public universities, which owns and operates america?s longest-running regional research and education network. In addition, through workshops and collaborations this project engages the research community to discuss the new research opportunities and benefits observed through its deployment at merit and to identify strategies to extend its deployment to other research and education organizations. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are planned for this award.