BEGIN:VCALENDAR
VERSION:2.0
PRODID:Linklings LLC
BEGIN:VTIMEZONE
TZID:America/Denver
X-LIC-LOCATION:America/Denver
BEGIN:DAYLIGHT
TZOFFSETFROM:-0700
TZOFFSETTO:-0600
TZNAME:MDT
DTSTART:19700308T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0600
TZOFFSETTO:-0700
TZNAME:MST
DTSTART:19701101T020000
RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTAMP:20260422T000710Z
LOCATION:DEF Concourse
DTSTART;TZID=America/Denver:20231114T100000
DTEND;TZID=America/Denver:20231114T170000
UID:submissions.supercomputing.org_SC23_sess289_spostg103@linklings.com
SUMMARY:Cray EX40 Cluster Intrusion Detection System
DESCRIPTION:Daniel Wild (Los Alamos National Laboratory (LANL), University
  of New Mexico)\n\nAnalysis of a High-Performance Computing cluster’s exte
 rnal network traffic provides the opportunity to identify security issues,
  cluster misuse, or configuration problems without reducing performance. T
 his project captured the external network traffic to and from a Cray EX40 
 cluster over three months and analyzed it utilizing two open-source intrus
 ion detection tools, Suricata and Zeek. The tool alerts were sent to Splun
 k via rsyslog for parsing and analysis. Several security concerns were ide
 ntified, including excessive failed authentication attempts and the use of
  four invalid certificates. Multiple cluster configuration issues were als
 o identified, including recurrent anomalous Domain Name Service (DNS) quer
 ies which comprised 97% of all DNS traffic and incorrectly routed outbound
  Hypertext Transfer Protocol traffic. The port mirror architecture combine
 d with network intrusion detection tools offered valuable insight into sec
 urity concerns and several configuration issues. Excessive failed authenti
 cation attempts and a switch DNS configuration issue were both resolved by
  this project.\n\nRegistration Category: Tech Program Reg Pass, Exhibits R
 eg Pass\n\n
END:VEVENT
END:VCALENDAR