Intelligent Automation, Inc. — Department of Energy SBIR Phase II: 03b

Description

Software protection and its associated tools can be regarded as a first line of defense for run-time integrity in an High Performance Computing (HPC) system, but cannot be easily extended to provide security solution beyond the software level. Hence, it is also essential to build a system-wide security analysis tool to assess the entire HPC system’s security. The major challenges for building such a tool include efficient data processing under limited resource and performance constraint, customized feature extraction for security assessment, and the balance between security and overhead/usability. Statement of How this Problem or Situation is Being Addressed: To address this need, a machine learning based security assessment tool is being developed to ensure system-wide security monitoring and assessment in HPC systems. The overall approach is to leverage existing/future HPC profiling and tracing tools to provide real-time data collection and then use this information combined with HPC program behavioral knowledge, system logs and network traffic data for cyber security assessment using big data analytics and machine learning techniques. What was done in Phase I: During the Phase I period, to meet the project objectives, the following has been performed: literature study, system architecture design, machine learning algorithms design and development, preliminary system implementation, and initial performance evaluation of our proposed solution. The final goal is to provide a software tool that can efficiently collect system-wide data (user, application, and network) in HPC systems, perform analysis to detect security related events and generate effective alerts. What is planned for the Phase II project: In Phase II, this security assessment tool will be further developed to provide better data analytics for system-wide security monitoring and assessment. Its core functionalities include data collection and pre-processing, classification of HPC applications and phases, network anomaly detection and security assessment, and synthetic data generation of normal and abnormal datasets. Commercial Applications and Other Benefits: The proposed security tool has a significant impact on the cyber security enhancement for HPC systems to improve HPC security at the entire system level and raise global operational security awareness for system administrators. It can be applied to and benefit a broad range of HPC centers and Large-Scale Distributed Computer Systems in industry (such as IT, various science applications, finance/economics, etc.), university/academic, and government agencies (such as defense and government labs).