Researchers at the University of Oregon and Argonne National Laboratory Tap NSF Grant to Advance Cybersecurity Research Leveraging the Link Oregon Network
November 4, 2026
Modern scientific research rarely happens in isolated labs. Today, it often relies on a massive web of distributed supercomputers, datasets, storage systems, and instruments linked by high-speed fiber-optic networks. These ecosystems are commonly referred to as scientific cyberinfrastructure (CI).
A perfect example of CI right here in Oregon is the Center for Biomedical Data Science. A joint initiative between the University of Oregon’s Knight Campus and the OHSU Knight Cancer Institute, it brings together scientists collaborating via advanced data platforms, machine learning, and Link Oregon’s network.
Why Cyber Defense for Cyberinfrastructure (CI) Needs an Urgent Upgrade
The impact of cyberattacks on scientific cyberinfrastructure can ripple through multiple research institutions. Because these systems rely on public internet connections, they are especially vulnerable to sophisticated network-based threats. In the most extreme scenarios, these institutions face the risk of lost or compromised scientific results, as well as reputational damage.
As the footprint of these cyber threats continues to expand, how do we go beyond existing detection capabilities to further fortify our CI?
Armed with a New NSF Grant, a Team of Researchers Looks to Discover “A New Dimension of Defense Agility”
A team of researchers at the University of Oregon (UO), working with Argonne National Laboratory, is tackling this head-on. Their work, funded by a National Science Foundation (NSF) grant, tests a bold new hypothesis.
Most cybersecurity defenses examine traffic behavior: data volume, connection frequency, or known attack patterns. However, modern attackers can easily disguise malicious traffic as legitimate activity. The UO researchers are investigating a different source of “attack evidence”: the mathematical structure of the IP addresses involved in network communication. Their hypothesis is that this structure contains distinctive properties that are difficult for attackers to reproduce without leaving detectable traces.
As Ram Durairajan, associate professor at UO and chief scientist at Link Oregon, and co-principal investigator on the NSF grant, describes it, “This funding will enable us to explore a new dimension of defense agility that, unlike existing defenses, relies on intrinsic knowledge.”
Augmenting Existing Cyber Defenses with New “Intrinsic Knowledge”
What exactly does intrinsic knowledge mean?
Prof. Durairajan explains it this way: “Think of network traffic as having two distinct signatures. One comes from how devices communicate—their behavior. The other comes from the structure of the addresses participating in that communication. Even when an attacker succeeds in making malicious traffic look behaviorally normal, they may still disturb this underlying structure. Our research investigates whether those structural disturbances can reveal attacks that conventional defenses miss. We call this novel method Multifractal Address-structure Anomaly Detection (MAAD). It’s based on intrinsic knowledge that can help supercharge our existing behavioral and intelligence-based methods of detection.”
New Cybersecurity Research Aims to Broaden Impact Statewide (and beyond)
The award-winning NSF proposal outlines a broader vision with three goals for this cybersecurity research that goes well beyond UO. They include:
- Deploy MAAD Locally: Working hand-in-hand with UO Information Systems and Link Oregon, the team will integrate MAAD into live network operations to protect scientific cyberinfrastructure across Oregon institutions—including UO, Oregon State University, and Portland State University.
- Make MAAD tools accessible statewide: Make MAAD easily accessible for any operators of networks supporting scientific CI across the nation to enhance their cybersecurity defenses.
- Advance the future of security research: the UO team plans to release the datasets and insights captured by this NSF-funded work. This would aid future efforts by researchers in understanding advanced address-based techniques.
The core research team includes UO postdoc and principal investigator; Chris Misa; Reja Rejaie, UO computer science professor and associate director of the Oregon Cybersecurity Center of Excellence; and Rakesh Shankaran, R&D leader at Argonne National Laboratory. Link Oregon and UO Information Services will serve as translational partners for real-world deployment.
“Deploying MAAD into our network operations is a great example of NSF-funded research breakthroughs making an impact in the real world,” said Dr. Jackie Wirz, Executive Director, Link Oregon. “We’re excited to participate in member institution-led scientific innovation in cybersecurity. This will deepen our shared understanding of evolving threat behaviors and how to fortify our statewide network against them to benefit all our member institutions.”