CICI: TCR: Making Network Telescopes Dynamically Adaptable Through Network Programmability

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

A network telescope is a research infrastructure also used for cybersecurity operations. It monitors traffic reaching Internet address space that is not assigned to any hosts. This traffic is therefore unsolicited—a sort of pollution—and is constituted of an evolving mix of diverse traffic components originating from across the whole Internet. For more than two decades, network telescope instrumentation has enabled research breakthroughs by allowing global visibility into a wide range of Internet phenomena: from the automated spread of malicious software such as Internet viruses to Internet blackouts. Measurement and analysis of such macroscopic phenomena are of key relevance for the security and reliability of the Internet infrastructure but also provide data and inspire progress in interdisciplinary studies. However, due to the increasing scarcity of IPv4 address space, the size of telescopes has been progressively eroding over the years, to the point that some organizations stopped operating them or reduced their size, which lessens their research and educational utility. Another new issue with this research infrastructure is that malicious actors have been learning to “blacklist” network telescopes and can avoid them when scanning the Internet. A novel methodology, called dynamic network telescopes, overcomes these issues. A dynamic telescope is based on deploying programmable switches at the border of the organization’s network to continuously discover utilization of internal space and adaptively adjust the scope of traffic capture. This project deploys the very first implementation of such novel solution at the Merit network telescope, one of the largest network telescopes available to the research community. Merit is an independent nonprofit governed by Michigan’s public universities, which owns and operates America’s longest-running regional research and education network. In addition, through workshops and collaborations this project engages the research community to discuss the new research opportunities and benefits observed through its deployment at Merit and to identify strategies to extend its deployment to other research and education organizations. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.