CAREER: Extracting Network Usage Information from Traffic

University Of Wisconsin-Madison, Madison WI

Investigators

Abstract

One of the main reasons for the success of the Internet is its great flexibility , people can use it in many ways: read email, browse the web, download patches for their computers, or spread viruses and worms. This extreme flexibility is often in conflict with the need of network operators to understand and to some extent control how their networks are used. Information on network usage is based on some analysis of the observable network traffic. Extracting useful information is hard because of the variety of concurrent network uses, the high volume of traffic, and sometimes the efforts of users to hide their activities. Many types of network usage information interest the network operator: the proportion of various applications, details about ongoing flooding attacks, worm epidemics and other malicious uses, as well as any information that can be used to filter out unwanted traffic. Unfortunately many types of important information cannot be extracted by current methods, and many of the proposed methods do not work with high-speed network links because the amount of traffic is too large. The proposed research will advance this field in three ways: by developing better methods of extracting useful information from network traffic, by developing solutions that work in real time under the ever tighter memory and processing constraints imposed by high speed links, and by developing information preserving data reduction techniques that allow network devices to produce traffic summaries that can be used to extract many types of information. Educational Plan Overview At the undergraduate level, class projects where students work in large groups will lead to a better understanding of the software engineering issues students are likely to face in their future jobs. At the graduate level, a new class about building fast networked devices will give a multi-area perspective covering concepts and techniques from operating systems, computer architecture, circuit design and algorithms. Intellectual Merit The proposed research will lead to fundamentally new ideas that result in new algorithms and new types of summaries for data. These ideas, algorithms and data structures are expected to have applicability beyond computer networking. The proposed research will also lead to a deeper understanding of how the Internet is used. Broader Impact Accurate information on network usage allows better-informed decisions by network operators and it enables systems that filter out many types of unwanted traffic. Success in the proposed research will contribute to a more reliable and more secure Internet.