A network telescope is a unique cyberinfrastructure that allows cybersecurity researchers and practitioners to study macroscopic Internet-wide events. Network telescopes receive and record network traffic destined to unused Internet address spaces. This "unsolicited" network traffic mainly originates from malicious activities such as denial-of-service attacks, incessant network reconnaissance aiming to identify exploitable weaknesses in network services and critical infrastructure, malware campaigns that attempt to propagate nefarious software into vulnerable devices, misconfigurations, etc. Thus, the data collected by large network telescopes offer cybersecurity analysts germane insights into Internet-wide scanning activities and attack trends, enabling them to obtain rich "threat intelligence" that could be used to inform decisions for the protection of critical infrastructure, organizations and citizens. 

This project enabled the complete renewal and redesign of one of the largest network telescopes in the nation. The ORION (Observatory of cyber-Risk Insights and Outages of Networks) network telescope has been re-engineered to obtain the necessary compute, storage and network capacity to handle high volumes of network traffic. More importantly, the ORION network telescope has been engineered to become amenable to processing incoming telescope traffic in near-real-time, extracting meaningful events, labeling the extracted events with useful metadata (e.g., geographic information of the incoming scanning requests), and uploading the annotated events into a cloud-based data warehouse for further efficient processing, analysis, pattern recognition and visualizations. 

The renewed ORION infrastructure is empowering new research and development opportunities due to its several desirable features. Its cloud-based data warehousing allows for efficient data integration with other important cybersecurity data streams that are also cloud-based. Further, security researchers are now available to easily process large volumes of longitudinal data in a matter of seconds or minutes. This unprecedented opportunity has enabled the research team to study and quantify, for instance, the impact on network resources imposed by persistent and "aggressive" network scanners, and to observe world-wide trends on voluminous  denial-of-service attacks.

ORION's capability for efficient analysis of large swaths of data can be combined with advances in other scientific areas such as the ones in the fields of machine learning and artificial intelligence to unleash the potential for understanding the complex activities observed in network telescopes and for providing rapid responses against future cyber-threats. As an example, aiming at the timely detection of novel (previously unseen) cyber-threats, ORION researchers have designed, developed and prototyped unsupervised machine learning techniques to cluster scanning activities appearing in the network telescope into meaningful groups, and then employed the identified groups to identify statistically significant temporal changes in their behavior. 

The educational and workforce development impacts of the ORION infrastructure have also been numerous. The renewed infrastructure allows for ORION datasets to be more easily shareable and more broadly available to the computer science community, hence enabling an array of training and educational opportunities in disciplines that lie at the intersection of networking, cybersecurity, data science, artificial intelligence, statistics and others. The project has offered hands-on experience to a plethora of undergraduate and graduate students at several universities and across multiple disciplines.

Last Modified: 02/02/2023
Modified by: Michael Kallitsis