NeTS-NBD: Internet Routing Forensics -- A Framework for Understanding, Monitoring and Detecting Abnormal Border Gateway Protocol Events

University Of Oregon Eugene, Eugene OR

Investigators

Abstract

While the Internet continues to thrive, the behavior of abnormal routing events are not well understood, nor are their symptoms and how they can be detected. Although numerous studies have created systems for detecting intrusions and anomalies by investigating traffic at the Internet data plane, no similar systems have been created for routing at the control plane. This leaves a wide range of critical basic and applied research questions unanswered, particularly for routing based on the Border Gateway Protocol (BGP) -- the de facto inter-domain routing protocol on the Internet. This research -- Internet Routing Forensics (IRF) -- will provide a systematic means for understanding and detecting networking anomalies from the Internet control plane by investigating a huge amount of routing data. As its first step, IRF focuses on abnormal BGP events, such as Internet worms or large-scale electricity outages that may affect the normal operation of BGP. With detection speed, accuracy and usability as the major goals, this research will build a reliable but flexible framework that can systematically process large archives of BGP data, observe and learn the patterns and effects of abnormal BGP events as well as those of normal behavior, discover rules of abnormal BGP events, and apply these rules to detect the occurrence of these events -- even if they are yet unknown. While IRF research lies primarily in the area of networking, it is inter-disciplinary. Besides leveraging modeling techniques, mathematical methods and statistical analysis, this research will in particular leverage data mining techniques to explore the huge data space from the global and local levels, devise a novel rule processor to optimize rules produced from the data mining process, and adopt supervised machine learning and other techniques to more accurately identify abnormal routing events within a given context. Broader Impact: By providing a crucial but currently lacking service, the research is expected to advance the service that the Internet provides to the society. Network operators, for example, will be in close contact with the research team to share their experience with the system. Methods, tools and discoveries from this research will be disseminated. Furthermore, this research will promote an energetic education plan. By using the IRF framework to observe and analyze real events happening on the Internet, students will be actively involved in the understanding and discovery of the structure and complexity of the Internet. Minorities and women will especially benefit from and contribute to this research project through internships, workshops, presentations, and other opportunities.