Resources
The General Compute Cluster provides a versatile, large-scale computing environment for cybersecurity and privacy research. With 190 server-class nodes featuring a diverse range of AMD, Intel, and ARM processors, the cluster supports experiments involving network and system security, architecture-specific vulnerabilities, and confidential computing.
Empowering privacy-centric experimentation, the 200 general-compute nodes integrate specialized processor architectures like Intel TDX and AMD SEV, enabling researchers to conduct large-scale security measurements and trustworthy computing investigations.
The General Compute Cluster supports a wide range of cybersecurity research and education, particularly experiments involving network threats, architecture-specific vulnerabilities, and trusted computing environments.
- Network Security and Threat Defense: Emulating network threats and evaluating defenses against them in controlled experimental environments.
- Architecture-Specific Security Research: Exploring security vulnerabilities across AMD, Intel, and ARM processor architectures.
- Confidential Computing: Investigating trusted execution environments (TEEs), including AMD SEV, Intel TDX, and AmpereOne Hardware Memory Tagging.
- Large-Scale Security Experimentation: Using physical machines and customizable virtual machines to conduct experiments across different hardware configurations, operating systems, and network environments.
- Cybersecurity Education: Supporting introductory and advanced cybersecurity classes through hands-on security experimentation and practical exercises.
General Compute Cluster Resources
The General Compute Cluster consists of 190 server-class nodes at USC Information Sciences Institute (USC-ISI), offering a heterogeneous computing environment with AMD, Intel, and ARM processors.
The cluster includes the following hardware resources:
| Count | CPU | Memory | Storage |
|---|---|---|---|
| 46 | AMD Epyc Rome | 256 GB | 11.4 TB |
| 96 | AMD Epyc Genoa | 192 GB | 3.2 TB |
| 24 | Intel Xeon 6 | 256 GB | 3.2 TB |
| 24 | AmpereOne | 512 GB | 6.4 TB |
SPHERE's Machine Learning Cluster consists of 14 GPU-equipped server-class nodes designed to support cybersecurity research involving artificial intelligence and machine learning. The cluster provides resources for investigating AI/ML-based security defenses and threats targeting AI/ML systems.
The nodes feature NVIDIA Turing Quadro and Ada Lovelace GPUs and are currently allocated as physical machines. All 14 nodes are operational and support active research involving GPU-intensive AI/ML security workflows.
The Machine Learning Cluster supports AI/ML security workflows, providing GPU-enabled computing resources for cybersecurity research.
- AI/ML for Security: Developing and evaluating machine learning-based cybersecurity solutions.
- Machine Learning Model Security: Investigating attacks against machine learning models and evaluating defensive techniques.
- Research Artifact Evaluation: Reproducing and evaluating compute artifacts that require server-class nodes or GPU-enabled resources.
Machine Learning Cluster Resources
| Count | CPU | GPU | Memory | Storage |
|---|---|---|---|---|
| 4 | Intel Xeon Gold | Nvidia Turing Quadro | 192 GB | 2.74 TB |
| 2 | AMD Epyc Turin | Nvidia Ada Lovelace (x2) | 384 GB | 17.35 TB |
| 8 | AMD Epyc Turin | Nvidia Ada Lovelace (x2) | 1.5 TB | 17.35 TB |
The SPHERE Embedded Compute Cluster provides specialized computing resources for cybersecurity research involving embedded systems, edge computing, and resource-constrained devices. The cluster is designed to include 88 nodes across five types of devices, featuring ARM, RISC-V, and x86-64 processor architectures.
These heterogeneous resources support research on distributed threats involving embedded devices, security defenses implemented on constrained hardware, and AI/ML applications at the edge. The cluster enables researchers to investigate security challenges across diverse hardware architectures and computing environments.
The Embedded Compute Cluster provides specialized hardware for security research involving embedded systems, edge computing, and diverse processor architectures.
- Embedded Device Security: Raspberry Pis are valuable for security research because of their ARMv64 architecture and their presence in devices such as audio controllers, vending machines, and networking equipment. These devices also include TPM9670 modules, supporting confidential computing workflows.
- AI and Machine Learning at the Edge: Nvidia Jetson devices use ARMv64 architecture and include a GPU with 1024 CUDA cores, enabling parallel processing, AI, machine learning, and vision workflows relevant to security and edge computing.
- RISC-V Security Research: StarFive VisionFive 2 uses the emerging RISC-V architecture, a license-free platform with growing cybersecurity relevance.
- Security on Resource-Constrained Devices: Silicom RCC-VE nodes use low-power x86-64 Intel Atom processors for studying security workflows on constrained devices.
- Vehicular Security and Real-Time Systems: AMD Zynq ZCU104 features a heterogeneous MPSoC with Arm A53 and R5 processors plus a Mali 400 GPU, making it useful for vehicular security and real-time systems research.
Planned Nodes
The Edge-Compute Cluster is planned to contain 84 edge-compute nodes across five types of devices.
| Count | Device |
|---|---|
| 24 | Raspberry PI 5 (64-bit ARM) with TPM |
| 20 | StarFive VisionFive 2 (RISC64) |
| 20 | Nvidia Jetson Orin Nano (64-bit ARM, NVIDIA Ampere GPU) |
| 20 | 20 RCC-VE (multiple NICs, Intel Atom) |
| 4 | 4 AMD Zynq MPSoc ZCU104 (64-bit ARM, Mali MP2 GPU, ARM Cortex R5, and an FPGA) |
SPHERE's Software-Defined Networking Cluster provides programmable networking resources for cybersecurity research and education. Co-located with the General Compute Cluster, it comprises 32 planned Smart NIC-equipped nodes, including eight with AMD Alveo U45N Smart NICs and 24 planned to incorporate NVIDIA BlueField 3 Smart NICs.
The cluster supports the evaluation of SDN-based security solutions and hands-on education in programmable network security.
The Software-Defined Networking Cluster supports cybersecurity research involving programmable networks, network security, and software-defined networking technologies.
- SDN-Based Security Solutions: Evaluating security solutions that leverage programmable networking capabilities.
- Programmable Network Security: Exploring how programmable network interfaces can support the development and evaluation of network security mechanisms.
- Network Defense Experimentation: Investigating security approaches using software-defined networking resources in controlled experimental environments.
- Cybersecurity Education: Supporting classes that teach programmable network security.
Software-Defined Networking Cluster Resources
The SDN Cluster co-resides with SPHERE's General Compute Cluster and incorporates programmable Smart NIC resources.
| Count | Equipment | |
|---|---|---|
| 8 | AMD Alveo U45N Smart NICs | |
| 24 | NVIDIA BlueField 3 Smart NICs |
The cluster also supports VM-based use, allowing users to reprogram Smart NICs without hard rebooting the host machine so that Smart NIC experiments can coexist with general computing experiments.
The SPHERE Industrial Control Systems (ICS) Cluster provides remotely accessible, programmable environments for cybersecurity experimentation involving industrial control systems and critical infrastructure. The cluster combines physical programmable logic controllers (PLCs), software-defined controllers, process simulations, and operator interfaces to support research on cyber-physical security.
Its experimental environments span four critical infrastructure domains: water treatment, water distribution, hydropower generation, and industrial/chemical process control. By supporting repeatable experiments across software-defined and hardware-backed configurations, the cluster enables researchers to investigate attacks, evaluate defenses, and study their effects on industrial processes.
The ICS Cluster supports cybersecurity research involving industrial control systems, cyber-physical processes, and the evaluation of attack and defense mechanisms.
- Water Treatment Security: Studying industrial water treatment processes, including raw water intake, chemical treatment, filtration, tanks, pumps, and valves. Example experiments include tank-level spoofing and pump/valve behavior.
- Water Distribution Security: Investigating water distribution systems, including distribution grids, pumps, valves, and storage tanks, with experiments involving pressure and flow consistency.
- Hydropower System Security: Exploring cybersecurity scenarios involving reservoirs, turbines, generators, breakers, trips, and alarms.
- Industrial and Chemical Process Control: Studying industrial control processes involving reactor variables, valves, pressure, level, and composition signals.
- Attack Detection and Defense Evaluation: Evaluating whether cyberattacks affect controller behavior and produce meaningful physical consequences in industrial processes.
ICS Cluster Interaction Interfaces
| Type | Automated Interface | Example Resources |
|---|---|---|
| Process controller | PLC logic and process control | Rockwell ControlLogix Process PLC, Studio 5000 projects, PlantPAx control modules |
| Simulator controller | Instrumentation and process feedback | Rockwell ControlLogix I/O Simulator PLC, mirrored input/output logic, simulated field-device status |
| Containerized PLC runtime | Rapid testing and software-defined controller/simulator experimentation | OpenPLC runtime, Dockerized deployments, Modbus TCP mappings, mirrored controller/simulator hooks |
| Signal interface | Analog and digital process signals | I/O modules, scriptable signal injection, manual analog signal simulators, signal-validation scripts |
| Operator interface | Process monitoring and control views | FactoryTalk View/PanelView-style HMI, FUXA-based HMI views, process diagrams and overlays |
| Engineering interface | PLC programming and diagnostics | Windows engineering workstation, Studio 5000, FactoryTalk Linx, controller identity checks, tag snapshots |
| Network evidence | Traffic and protocol observations | Modbus/CIP communication, optional packet captures, protocol-analysis artifacts |
| Experiment evidence | Replayable process behavior | Run bundles, time-series tag traces, event logs, invariant reports, attack/defense tool outputs |
The SPHERE Internet of Things (IoT) Cluster provides a shared, remotely accessible environment for cybersecurity and privacy research involving real, off-the-shelf consumer IoT devices. Designed to scale to approximately 500 devices, the cluster supports experiments involving smart speakers, TVs, cameras, home automation systems, and other connected devices.
Through programmable device handlers, configurable network infrastructure, and automated experiment controls, researchers can remotely interact with physical devices, capture network traffic and multimedia data, and conduct repeatable experiments in isolated environments. The cluster enables research involving heterogeneous IoT systems, multi-device interactions, and multi-vendor deployments without requiring researchers to build and maintain their own physical IoT laboratories.
The IoT Cluster supports cybersecurity and privacy research involving consumer IoT devices, smart environments, and connected-device interactions.
- IoT Device Security and Privacy: Investigating security vulnerabilities and privacy risks associated with consumer IoT devices and connected environments.
- Smart TV and Media Device Security: Conducting experiments involving smart TVs, streaming devices, and multimedia interactions.
- Smart Home Security: Studying connected devices such as smart plugs, bulbs, thermostats, sensors, and home automation systems.
- IoT Network Security: Examining device communication and network traffic in isolated, dynamically configurable IoT environments.
- Multi-Device and Multi-Vendor Experimentation: Investigating interactions among heterogeneous IoT devices from different manufacturers.
- Automated Device Interaction: Using programmable handler devices to reproduce physical interactions, collect observable outputs, and support repeatable experiments.
IoT Cluster Subject Devices
The IoT Cluster includes a diverse collection of consumer IoT devices across six categories. According to Building SPHERE, the cluster has 323 operational subject devices and is designed to expand to approximately 500 devices.
| Category | Example Devices | Count |
|---|---|---|
| Smart Speakers | Amazon Echo, Google Nest | 35 |
| Smart TVs and Media Devices | Samsung TVs, Chromecast, Fire TV, Apple TV | 63 |
| Cameras and Doorbells | Ring doorbells, IP cameras | 76 |
| Home Automation | Smart plugs, bulbs, thermostats, sensors | 135 |
| Smart Gateways and Hubs | Matter hubs, Zigbee gateways, vendor-specific hubs | 7 |
| Other Devices | Appliances, gaming devices, health devices, etc. | 7 |
In addition to subject devices, the cluster incorporates programmable handler devices for physical interaction, sensing, and multimedia capture; managed switches, Wi-Fi access points, and Zigbee hubs for networking; and server-based control infrastructure for experiment management and automation.
User Portals
| Portal Name | Description | Demographic |
|---|---|---|
| GUI (Graphical User Interface) | This Graphical User Interface portal enables users to draw and annotate network topologies and workflows through intuitive visual tools, designed for accessibility by novice users. | Novice users |
| MAN (Manual) | The Manual portal provides advanced SSH-based access for expert users to directly control experimental nodes and conduct exploratory research with maximum flexibility in testbed resource manipulation. | Exploratory research |
| JUP (Jupyter) | Through the Jupyter portal, mature experimental workflows are documented and automated using notebook interfaces, ensuring research reproducibility and systematic execution. | Mature research |
| EDU (Education) | Serving as an Education portal, this platform empowers teachers to create student accounts, upload materials, and design cybersecurity assignments featuring attack-defense scenarios in contained network environments. | Teachers, students |
| HUM (Human User Studies) | Operating as a Human Study portal, this platform facilitates researcher deployment of innovations and systematic collection of participant feedback through structured interaction pathways on the SPHERE platform. | Researchers, study participants |
| AEC (Artifact Evaluation Committee) | Functioning as the Artifact Evaluation Committee portal, this system connects paper authors with reviewers on shared infrastructure, supporting the submission, assessment, and archival of research artifacts for community reuse. | Authors, evaluators |
Research Artifact Library
- SPHERE provides a research artifact library to support reproducibility, artifact evaluation, and reuse of cybersecurity research. The library contains 176 research artifacts acquired through artifact evaluation efforts, community contributions, and SPHERE's virtual internship program. These artifacts support researchers in reproducing, comparing, and extending prior work without recreating experimental environments and tools from scratch. Research artifacts can be shared within a project, an organization, or with all SPHERE users. The library supports one-click deployment and reuse of artifacts.
Research Areas
- The artifact collection covers research areas including censorship, federated learning, attacks on machine learning models, system-on-chip security, password and honeyword attacks, reverse engineering, and LLM-assisted cybersecurity research.
Dedicated Research Artifacts
- SPHERE also supports dedicated research artifacts from collaborating researchers, including:
| Research Artifact | Institution | Research Focus |
|---|---|---|
| Censorlab | University of Massachusetts Amherst | Censorship research |
| APT Scenario Reproduction | Northwestern University | Intrusion research |
| SPHERE-CAN | Colorado State University | Automotive security research |
Cybersecurity Educational Materials
- SPHERE provides access to 26 curated hands-on assignments for teaching cybersecurity. These educational materials support practical cybersecurity learning in controlled experimental environments.
- Students can use SPHERE for guided coursework, independent learning, and research-oriented exploration. The educational resources enable students to practice security concepts on realistic systems, reproduce research results, and develop practical cybersecurity skills. Teachers can contribute new educational materials to the public repository.
Introductory Labs
| Lab | Description | Prerequisites |
|---|---|---|
| Introduction to SPHERE | Introduction to the SPHERE testbed. | Basic understanding of the Unix command line and virtual machines. |
| Introduction to Unix/Linux | Introduction to the Unix command line interface and its utilities. | Basic understanding of programming. |
Distributed Denial of Service Labs
| Lab | Description | Prerequisites |
|---|---|---|
| DDoS: Hash Collisions | In this exercise, you will exploit and mitigate a has-collision denial-of-service (DOS) attack. | Basic understanding of hash tables (especially algorithmic complexity of its operations). |
| DDoS: Slowloris Attack | This exercise demonstrates the Slowloris attack and the resources it consumes. | Basic understanding of computer networking. |
| DDoS: TCP SYN Flood | This exercise demonstrates the TCP SYN (synchronize) flood. | Basic understanding of computer networking, TCP SYN flood attack logistics, and SYN cookies. |
Exploitative Labs
| Lab | Description | Prerequisites |
|---|---|---|
| Exploits: Buffer Overflow | Introduction to buffer overflows, their exploits, and their mitigation. | Basic understanding of the Unix command line, POSIX permissions, and basic programming (C and HTTP). |
| Exploits: Computer Forensics | Introduction to basic forensic analysis theory and practice. Investigation of disk images, data recovery, and compromised systems. | Basic understanding of the Unix shell environment and common shell utilities (e.g., find, grep, strings, etc.). |
| Exploits: Cross-Site Scripting (XSS) | Introduction to XSS and Persistent Cross-Site Scripting. | Basic understanding of the Unix command line, POSIX permissions, and basic programming (C and HTTP). |
| Exploits: Pathname Attacks | Introduction to pathname attacks. | Basic understanding of the Unix command line, POSIX permissions, and basic programming (Perl and HTTP). |
| Exploits: SQL Injection | Introduction to SQL (Structured Query Language) Injection attacks. | Basic understanding of the Unix command line, POSIX permissions, and basic programming (PHP and SQL). |
Networking Labs
| Lab | Description | Prerequisites |
|---|---|---|
| Networking: IPv6 | Exercise that incorporates IPv6 internetworking. | Basic understanding of the Unix command line and networking. |
| Networking: Routing, Addressing, and Port Forwarding | In this exercise, you'll practice configuring IP addressing, route tables, private address prohibition, network address translation, and port forwarding. | Basic understanding of the Unix command line, networking, and configuration. |
Prevention Labs
| Lab | Description | Prerequisites |
|---|---|---|
| Passwords: Cracking | This exercises introduces password cracking and its ease. | Basic understanding of the Unix command line. |
| Prevention: OS Hardening | This exercise demonstrates how services are started and stopped in Linux. | Basic understanding of the Unix command line and operating systems. |
| Prevention: POSIX Perfmissions | Introduction to the filesystem and network access control schemes. | Basic understanding of the Unix command line and POSIX permissions. |
| Prevention: Setting up IPSec | This exercise demonstrates the installation, configuration, and testing of IPSec (Internet Protocol Security). | Basic understanding of the Unix command line, networking, and strongswan. |
| Prevention: Snort | Introduction to securing legacy systems and software. | Basic understanding of the Unix command line and networking. |
| Prevention: Stateful Firewalls | This exercise demonstrates network access control schemes and firewalls. | Basic understanding of the Unix command line and iptables. |
Attacks & Miscellaneous Labs
| Lab | Description | Prerequisites |
|---|---|---|
| BGP Prefix Hijack Attacks | Introduction to Border Gateway Protocol (BGP) and prefix hijacking. | Basic understanding of routing protocols, IP forwarding, and Unix command line. |
| Binary Analysis: Introduction to Dwarf | Review different types of compiled binaries and the structure of debugging information in binary programs. | Basic understanding of binary. |
| CCTF: Secure Server | This exercise allows students to practice setting up and monitoring a Web server. | This is a team exercise. |
| CCTF: Secure and Resilient Server | This exercise lets students practice monitoring and defending a Web server. | This is a team exercise. |
| DNS: Man-in-the-Middle Attacks | Introduction to Domain Name System (DNS) and Domain Name System Security (DNSSEC). | Basic understanding of TCP/IP, the client-server model, and the Unix command line. |
| Worms: Modeling the Spread | This exercise demonstrates worm attacks and mitigation. | Basic understanding of the Unix command line, SlammerWorm attacks, WiityWorm attacks, and TCP dumps. |
Upcoming Labs
We are currently developing Jupyterized (using Jupyter Notebook) versions
of these labs for a more user-friendly experience! Coming soon ~
Experiment Reproducibility
- SPHERE supports reproducibility through its research artifact library, distributed experimentation workflows, and artifact packaging capabilities. Researchers can begin with interactive experimentation and transition to scripted workflows using Jupyter notebooks. Experimental environments, supporting scripts, and documentation can be shared for reproduction and further research.
Artifact Packaging
- SPHERE currently supports virtual machine (VM) imaging. Additional automated artifact packaging capabilities, including recording installation and execution steps as reusable scripts, are under development and testing.
Distributed Experimentation Workflows
- SPHERE is testing distributed experimentation workflows designed to support flexible, portable, and scalable experiments. These workflows capture dependencies between experimental components to support efficient execution and troubleshooting.