Norwich University Center for Advanced Computing and Digital Forensics

Research & Collaboration in Advanced Computing and Digital Forensic Technologies

NUACC Computing Infrastructure

The NUACC computing infrastructure consists of two VMWare vSphere 4.0 virtual clusters and a full-featured digital forensics teaching laboratory. The clusters are designated IWar (Information Warfare) and Primary. The clusters have individual Internet connections outside of the University's protected network infrastructure on the Norwich Research Network. The IWar cluster also contains the Norwich University Cyber Weapons Range, a purpose-designed virtual network for teaching and researching network-centric warfare.

The forensics laboratory accommodates 11 two-student teams with Dell towers specially configured for use as forensic computers and older Dell desktops as target or "suspect" computers. Each 2-student workstation has one Guidance Software FastBlock hardware write blocker and copies of Technology Pathways ProDiscover IR, Guidance Software enCase and Wetstone Technologies Gargoyle forensic tools. The forensics laboratory is networked within the classroom but does not touch the outside (only the instructor station has Internet connectivity to download tools and updates for classroom distribution). Additionally, the forensics laboratory can be connected directly to the virtual clusters for use as a programming laboratory or a war room for use during attack-defend exercises.

A new feature in the NUACC computing infrastructure is the High Performance Computing Cluster. This is an eight-server HPC cluster using Microsoft HPC operating system (see below).

NUACC Cyber Weapons Range Cluster

IWar Cluster

The Cyber Weapons Range consists of:

2 HP Proliant DL360 servers with dual 2GHz quad processors in each and 64GB or memory across the cluster
Cisco 24 port smart switch
Dell server used as the command and control center for access to the cluster
4TB Dell EqualLogic iSCSI Storage Area Network cluster
30 seats of Core Security Impact penetration testing software
Nitro Security NitroView SIEM
Nessus 3 vulnerability assessment tool
50+ penetration testing targets of various operating environments and applications

Cyber Weapons Range is designed primarily for teaching, researching and collaborating in information assurance (IA) classes and projects. It can support up to 75 student pods (virtual workstations) with about 45 on line simultaneously depending upon the classroom exercises in process.

Primary Cluster

The Virtual Labs Cluster consists of:

4 HP Proliant DL360 servers with dual 2GHz quad processors in each and 256GB or memory across the cluster
2 Cisco 48 Port smart switches
2 Cisco routers with VPN
Dell server used as the command and control center for access to the cluster
8TB Dell EqualLogic iSCSI Storage Area Network cluster
Mu Dynamics 8000 vulnerability testing tool, fully configured
NetClarity enterprise NACWall
Xyzel firewall

Virtual Labs Cluster provides the main infrastructure for supporting non-IA virtual laboratories for the University's many departments as well as virtual laboratories for various research projects undertaken by the NUACC Team and supporting partners. Much of the research on Cyber Weapons Range is high risk IA testing (bot nets, malware, etc.) so that type of work is not done on Virtual Labs.

High Performance Cluster (BABIE)

The NUACC recently added an eight-server high performance cluster using Microsoft's high performance computing (HPC) operating system. The cluster still is being configured so come back soon and see how we have set it up. It's first applications will be as a simulation environment for high performance graphics and compute capability applied to study and research in BIM (Building Information Modeling) technology including many-user appliction of solid modeling CAD systems, information management and more as well as HPC application to computer forensic analysis.

Virtual Organization of the Clusters

The NUACC virtual clusters are organized into two enclaves: general use and the Norwich University Cyber Weapons Range (NUCWR). General purpose environments are used to support non-IA laboratory applications which the NUCWR supports such operations as network attack and defend, malware research and teaching . The High Perfomance Cluster is primarily for high graphic/high compute requirements. All clusters can be accessed through a common remote desktop interface.