Unified System- and Network-Level Monitoring for AI-Driven Anomaly Detection on Chameleon Cloud

​

Arin Rahman

arahman6@miners.utep.edu

The University of Texas at El Paso

Project Overview

• Traditional monitoring often relies solely on network data
• System metrics (LDMS), hardware counters (PAPI), and network telemetry (tcpdump) using Docker Swarm on Chameleon Cloud
• Eight attack categories
• Narrowed down 2600 features to 369 features (303 system-based and 66 network-based )using Gain Ratio based selection
• Combining system and network data outperforms single-source monitoring (0.93 accuracy with Gradient Boosting)

Feature Ranking using Gain Ratio and Feature Subset generation

1. Start with all LDMS + PAPI features.
2. Measure how useful each feature is for classification to ATTACK and NORMAL traffic.
3. Rank features from most informative to least informative.
4. Create several candidate subsets:

top 10%

top 12%

top 14%

…

top 20%

1. Train models on each subset and see which percentage gives the best performance.

Gain Ratio

F-1 Score vs PAPI + LDMS feature subset

Best Model Performance Comparison Across Feature Sets

Infrastructure Requirements and Usage

​

• Bare-Metal Necessity
• Orchestration & Topology
• Controlled Adversary
• Lightweight Signals
• Reproducible Stack

Challenges and Insights

• Managing thousands of raw metrics creates noise
• Feature selection is critical for efficient AI training
• Models relying on either network or system data alone achieve lower recall
• Network data effectively detects traffic spikes
• System data reveals hardware-level reactions to intrusions.
• Synchronizing sampling and port registration across distributed nodes requires high-level expertise in container orchestration.
• Commercial clouds (e.g., AWS/Azure) often restrict the low-level hardware access necessary for deep security research.

​

Services, Tools, and Workflow Support

• The workflow seamlessly links LDMS , PAPI, tcpdump and machine learning pipelines.
• Metasploit is integrated directly into the containerized environment to enable realistic and repeatable adversarial simulations.
• There is a notable gap in "out-of-the-box" pipelines for transitioning from raw telemetry collection to trained machine learning models.
• Pre-configured AI security templates would significantly lower the barrier to entry for new researchers.
• Current reproducibility depends heavily on manual processes for dataset versioning and experiment tracking.

​

Recommendations for AI Research Testbeds

Hardware Visibility: Testbeds must provide persistent access to low-level hardware performance counters.

Native Orchestration: Providing container-native templates (like Docker Swarm or Kubernetes) simplifies complex security experiments.

Integrated Pipelines: A need exists for "telemetry-to-ML" pipelines to bridge the gap between raw data collection and AI evaluation.

​

Publications

1.Rahman, A., Moore, S. V., & Tosh, D. K. (2026). Design of a unified monitoring tool for detecting anomalies in high performance computing systems. In 2026 IEEE 23rd Consumer Communications & Networking Conference (CCNC) (pp. 1–2). IEEE.

2. Rahman, A., Moore, S. V., & Tosh, D. K. Unified System- and Network-Level Monitoring for AI-Driven Anomaly Detection on Chameleon Cloud. Manuscript under review at IEEE ClusterCom.

Acknowledgement

This research was supported by the National Science Foundation (NSF) under award #2346423.

Questions?

Email: arahman6@miners.utep.edu