SAMPA: Security Analysis and Monitoring to Prevent Abuse of High Performance Computing Environments

HPC systems should not be used to carry out cybercrimes or execute improper jobs. Existing defense solutions such as fingerprint-based approaches require real-time data collection, which inevitably impacts the performance of HPC. Moreover, those solutions are ineffective against adversarial scenarios where malicious users intend to hide their behavior patterns. Hence, it is essential to build lightweight tools that can take preemptive action to prevent the misuse or abuse of HPC systems in adversarial scenarios. To address this critical need, IAI is developing a deep-learning-based program analysis toolkit dubbed SAMPA. The SAMPA tools scan program binaries submitted by users and perform program classification and similarity detection. In case that either the classified category or the category associated with the top similarity score is not the same as what described in the allocation request, SAMPA will stop the program. Thus, the abuse of HPC systems can be prevented without introducing runtime overhead to HPC systems. In Phase I, the team has been mainly focused on designing the SAMPA architecture and core components including program embedding and classifier, collecting data for training and validation, implementing a preliminary system prototype, and evaluating the system performance. During the Phase II development, the team will improve and extend the capabilities already demonstrated in Phase I. We will continue the development of the SAMPA architecture with the focus on optimizing the design and development, building a fully-fledged SAMPA architecture, and validating SAMPA performance under realistic scenarios. The resultant SAMPA will provide broad capabilities for executing applications securely and efficiently on HPC platforms. Commercial Applications and Other Benefits: The proposed techniques, tools and software will have a significant impact on the cyber security enhancement for HPC systems. In addition to the security analysis, the result of this effort can be applied to malware detection and benefit a broad range of HPC centers and Large-Scale Distributed Computer Systems in industry (such as IT, various science applications, finance/economics, etc.), university/academic, and government agencies (such as defense and government labs), as well as HPC Infrastructure as a Service and cloud computing environments.