Cici:rssd: scope-x optimizing merit's network telescope for high-quality large-scale datasets

The National Science Foundation Office of Advanced Cyberinfrastructure awarded Merit Network Inc. $545,269 on September 1, 2026, under the Computer and Information Science and Engineering program (CFDA 47.070) to advance the cyberinfrastructure of ORION, a network telescope operated by Merit that provides visibility into unsolicited and potentially malicious Internet traffic and supports cybersecurity research through both live traffic feeds and a 20-year archive.

The project, titled SCOPE-X (Scalable Cyberinfrastructure for Observatory Pipeline Enhancement), develops three integrated activities to address rising traffic volumes, extreme bursts, and evolving attack behaviors. Resilient capture improves high-speed packet collection using adaptive, multi-threaded processing architectures that maintain data fidelity during large traffic bursts and dynamic attack patterns. Artificial intelligence-ready curation creates high-quality research-grade datasets through improved cleaning, feature engineering, partial labeling, and enrichment with contextual metadata and external threat intelligence. FAIR-aligned access modernizes dataset delivery using application programming interfaces, code-to-data environments, and sustainable release mechanisms that improve reproducibility, accessibility, and long-term stewardship.

The resulting datasets, software, and access mechanisms will broaden access to real-world security data, support student training, and strengthen national cybersecurity through earlier detection and analysis of Internet threats. The project advances scalable passive network monitoring and machine learning-ready cybersecurity datasets for detecting rare and emerging threats.

Performance occurs at Merit Network's location in Ann Arbor, Michigan, from September 1, 2026, through August 31, 2029.

Abstract

Scope-x (scalable cyberinfrastructure for observatory pipeline enhancement) advances the cyberinfrastructure of orion (observatory for cyber-risk insights and outages of networks), one of the oldest and largest operational network telescopes in the united states, operated by merit network. Orion provides visibility into unsolicited and potentially malicious internet traffic and supports shared cybersecurity research through both its live traffic feed and its 20-year archive. Rising traffic volumes, extreme bursts, and evolving attack behaviors require transformation of the end-to-end pipeline to preserve data fidelity, operational reliability, and long-term usability. This project develops transferable methods for modern network telescope operations through three integrated activities. First, resilient capture to improve high-speed packet collection using adaptive, multi-threaded processing architectures that maintain fidelity during large traffic bursts and dynamic attack patterns. Second, artificial intelligence-ready curation to create high-quality research-grade datasets through improved cleaning, feature engineering, partial labeling, and enrichment with contextual metadata and external threat intelligence. Third, fair-aligned access to modernize dataset delivery using application programming interfaces, code-to-data environments, and sustainable release mechanisms that improve reproducibility, accessibility, and long-term stewardship. The project advances scalable passive network monitoring, machine learning-ready cybersecurity datasets, and methods for detecting rare and emerging threats in semantic-guided and partially labeled data. The resulting datasets, software, and access mechanisms will broaden access to real-world security data, support student training, and strengthen national cybersecurity through earlier detection and analysis of internet threats. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are planned for this award.