Research in the Network Management Laboratory

Transcription

1 Research in the Network Management Laboratory Adarsh Sethi Professor Department of Computer & Information Sciences University of Delaware

2 About Myself PhD Indian Institute of Technology (IIT) Kanpur On UD Faculty Since 1983 Visiting/Sabbatical Positions Washington State University, Pullman, WA IBM Research Labs, Zurich, Switzerland Army Research Labs, Aberdeen, MD

3 Research Interests Network Management Management Protocols and Architectures Fault Management and Diagnosis Quality of Service Management Management of Wireless Networks Funding Sources Army Research Laboratory s CTA (Collaborative Technology Alliance) on Communications & Networking CERDEC / Telcordia

4 What is Network Management? Monitoring and control of networks Objectives: optimize performance meet service-level requirements minimize operational costs Functions: Fault Configuration Accounting Performance Security Management Protocols: SNMP (Internet), CMIP (OSI)

5 Network Management Research at UD Fault Localization New Algorithms for Fault Localization Adaptive Probing Algorithms for Fault Localization Mobile Ad-Hoc Networks Application of Fault Localization to Intrusion Detection Stealthy Probing Techniques Manage Node Mobility

6 Fault Management Tasks Failure detection generates alarms/symptoms Fault localization analyzes symptoms to choose the most likely fault/set of faults determine location of fault usually achieved through alarm correlation Root cause analysis determines the actual fault/set of faults and the root cause/s for the faults Self-healing mechanisms for quick restoration of service

7 Adaptive probing: A promising technique for fault localization P1 P1 N1 N2 N3 N4 N5 N6 N1 N7 Failure detection N7 N2 N3 N4 N5 N6 P2 To minimize probe traffic, probe set is adapted to observed network conditions by sending less probes in healthy areas and more probes where a failure is detected Avoids difficulty of constructing probes for all possible problems Avoids wasteful probes Problem can be targeted quickly and effectively to the point of interest Fault localization P2

8 Probe selection Greedy search (Algorithm GFL) Min search Max search Binary search (Algorithm BSFL)

9 Max search to select probes to probe suspected nodes Select probes that cover maximum number of suspected nodes

10 Max search to select probes to probe suspected nodes Successful probes give a lot of information Failed probes do not give much information

11 Min search to select probes to probe suspected nodes For each suspected node, select a probe that visits least number of other suspected nodes

12 Min search to select probes to probe suspected nodes Successful probes do not give much information Failed probes significantly narrow down the search space Each probe path is analyzed in parallel

13 Binary search to select probes to probe suspected nodes {4,5,6,8} {4,5,6,8} 1 4 On each failed probe path, send additional probes in a binary search fashion till one node failure is found on the path Each probe path is analyzed in parallel 9 {5,6,8} {4} {6,8} {4} {5}

14 1 Fault localization (Min Search) > > Probe selection Build a set SuspectedNodes consisting of nodes with non-zero probability to be on the failed probe path Select a probe for each node n in SuspectedNodes that is Most likely to pass through the node n Least likely to pass through other suspected nodes Select a probe that maximizes the following metric:

15 Fault localization (Max Search) > > Probe selection Build a set SuspectedNodes consisting of nodes with non-zero probability to be on the failed probe path Select probes that are most likely to pass through maximum number of nodes in SuspectedNodes Select probes that maximize the following metric

16 Comparison of Probe Selection Algorithms Max_8 Min_8 Max_10 Min_10

17 Network Management Research at UD Fault Localization New Algorithms for Fault Localization Adaptive Probing Algorithms for Fault Localization Mobile Ad-Hoc Networks Application of Fault Localization to Intrusion Detection Stealthy Probing Techniques Manage Node Mobility

18 Application of Fault Localization to Intrusion Detection Intrusions and Faults in Networks have similar manifestations (symptoms), e.g. Increased End-to-End Delay n1->n2?? n1 n2

19 Application of Fault Localization to Intrusion Detection Intrusions and Faults in Networks have similar manifestations (symptoms), e.g. Increased End-to-End Delay n1->n2?? n1 n2 Poor link connectivity Poor performing router

20 Application of Fault Localization to Intrusion Detection Intrusions and Faults in Networks have similar manifestations (symptoms), e.g. Increased End-to-End Delay n1->n2?? n1 n2 Malicious routing, e.g. Wormhole Attack

21 Wormhole Attack Wormhole Mid-Node Wormhole End-Node Uncompromised Node Attack on Mobile Ad-hoc Network (MANET) routing protocols Attacking nodes attract traffic from other parts of the network In-band wormhole Does not use an external communication medium Establishes a covert overlay tunnel over the existing wireless medium Self-contained wormhole Advertises a false link between the attacker nodes themselves

22 Metrics for a wormhole attack Strength Number of end-to-end paths passing through the wormhole tunnel Attraction Decrease in the path length offered by the wormhole Robustness hops hops Ability of the wormhole to persist even in the presence of minor topology changes in the network

23 Simulation Results Effect of strength on DR 15 node topologies Network size 1500*1500 meters Classification of wormholes High Strength: number of paths passing through the wormhole >= 14 Medium strength: number of paths passing through the wormhole between 6 & 13 Low strength: number of paths passing through the wormhole <= 5 Topology Strength Detection Ratio (%) High (>=14) Medium (6-13) Low (<=5) High (>=14) Medium (6-13) Low (<=5) High (>=14) Medium (6-13) Low (<=5) High (>=14) Medium (6-13) Low (<=5) 41.49

24 Stealthy Probing Data traffic Smart Attackers drop data traffic but allow probe traffic to pass Probe traffic Normal Node Attacker Node

25 Stealthy Probing Problem: How to make probes stealthy so Intruder Node cannot distinguish them from normal application traffic

26 How to send probes? Should probes be separate from regular packets? The data should not look random. It should look like legitimate traffic Probe Probe n1 n2 n3 n4 Appl. Appl.

27 How to send probes? -- Should probes be piggybacked on regular application traffic? Destination should be able to extract probe information Embedding should not make the payload inconsistent with regular application payload We might still need to send out separate probe packets when regular traffic is infrequent Probe Probe n1 n2 n3 n4 Appl. Appl.

28 Probe identification at endpoints Using Packet stamping s5 s4 s3 s2 s1 n1 n2 s2 s1 Stamp probe packets with a ticket known to both source and destination nodes. The packet contains probe information at predefined place in packet Properties inconspicuous, dynamically changing, hard to predict, lightweight, robust to loss and reordering. Example : Probes inserted randomly using stamps s1,s2,s3,s4,s5..

29 Stealthy Probing Architecture

30 Managing Node Mobility Wireless nodes Obstacles Interference Motion Overall goal Distinguish between causes of signal degradation Technique Time Series Analysis on Signal-to-Noise Ratio

31 TimeSAFE Model Integrated Fault Correlator (or another fault management system) Symptoms Sensor1 Sensor2 Sensor3 Sensor4 Signal Analyzer Signal Analyzer Signal Analyzer Signal Analyzer Wireless Radio GPS Pattern Analyzer TimeSAFE Alarms TimeSAFE

32 32

33 Student Awards Allan P. Colburn Prize for Best Dissertation in Engg. and Mathematical Sciences, University of Delaware Malgorzata Steinder 2003 Maitreya Natu 2008 Best Dissertation Research Award, NOMS-2008, IFIP/IEEE International Symposium on Network Operations and Management, Salvador-Bahia, Brazil Maitreya Natu April 2008 Frank Pehrson Award for Outstanding Graduate Student, CIS Dept, University of Delaware Pramod Kalyanasundaram 1998 Malgorzata Steinder

34 Contact Info