Cheleby: Subnet Level Internet Topology

Transcription

1 Cheleby: Subnet Level Internet Topology Mehmet Hadi Gunes with Hakan Kardes and Mehmet B. Akgun Department of Computer Science and Engineering University of Nevada, Reno

2 Subnet Resolution A B C D genuine topology A B A B C D observed topology C D inferred topology Cheleby: Subnet-Level Internet Topology 2

3 [Observed] Degree vs. [Actual] Interfaces Degree: the number of one hop neighbors Interface: the number of links the system is attached to A B C D A B D C X 8 6 X Y Z Degree Distribution 8 6 Z Y Interface Distribution Cheleby: Subnet-Level Internet Topology 3

4 Hyper Graphs Networks modeled as graphs G=(V,E) Hyper graphs: H= (X,E) can accurately model multi access links also, bipartite (2 mode) graphs Cheleby: Subnet-Level Internet Topology 4

5 Cheleby System Overview PlanetLab Vantage Points Traces x - - L.2 - S.2 - y x - - A.1 - W.1 - -z y - S.1 - L.1 - -x y - S.1 U.1 - -C.1 - -z z - -C x z - -C U.2 - S.3 - y Raw Data Initial Pruner (IP) Structural Graph Indexer (SGI) SubNet Inferrer (SNI) y S U K C N L H A W x z Network Topology Graph Based Induction (GBI) Analytical IP Alias Resolver v2 (APARv2), iffinder Cheleby: Subnet-Level Internet Topology 5

6 Round Trip Time Analysis Hops (Trailing * s filtered) IPs Observed Unresponsive 213,303,135 17,537, % 7.60% CDF of IP addresses Round Trip Time (in msec) Cheleby: Subnet-Level Internet Topology

7 Unresponsive Routers Responsiveness to Direct Probes Responsiveness to Indirect Probes Cheleby: Subnet-Level Internet Topology 7

8 Team Analysis Cheleby: Subnet-Level Internet Topology 8

9 Resolution results Alias Resolution Subnet Inference Cheleby: Subnet-Level Internet Topology 9

10 Degree Distribution Exponents : 2.17, 2.02, 1.92, respectively Cheleby: Subnet-Level Internet Topology 10

11 Interface Distribution Exponents : 2.71, 2.69, 2.74, respectively Cheleby: Subnet-Level Internet Topology 11

12 Subnet Distribution Nodes in Subnets Exponents : 3.42, 3.62, respectively Cheleby: Subnet-Level Internet Topology 12

13 Synthetic Topology Generation Network Size ID SD Generate Nodes Generate Subnets Heterogeneous Swap Calculate Degree Distribution based on DD Satisfies Subnet & Interface Distributions!!! Match? no yes Final Topology Cheleby: Subnet-Level Internet Topology 13

14 Connectivity Analysis Relation between Interface Distribution and Number of Subnets Single connected component is feasible only when connectivity parameter <1 Feasible Region Cheleby: Subnet-Level Internet Topology 14

15 Subnet Distribution: ExploreNET CCDF [10 to 250] Number of Nodes in Subnets Estimating Network Layer Subnet Characteristics via Statistical Sampling, M. Engin Tozal and Kamil Sarac, IFIP/TC6 Networking, Prague, Czech Republic, May 12 Cheleby: Subnet-Level Internet Topology 15

16 TraceNET Destination Traceroute Path Source Destination TraceNET Path Source TraceNET: An Internet Topology Data Collector, M. Engin Tozal and Kamil Sarac, ACM Internet Measurement Conference, Melbourne, Australia, November 2010

17 Work in Progress AS 1 VP VP AS of Interest Alias Resolution AS 4 VP VP Subnet Resolution AS 2 VP VP AS 3 VP Cheleby: Subnet-Level Internet Topology Per Destination load balancers? 17

18 Network Traffic Analysis with Bing Li, Jeff Springer, George Bebis

19 Design Goals Real time network query near real time measurement and analysis Distributed system for data collecting, storing, accessing, measuring and analyzing NetFlow Models of detection and classification based on profiling and behavior Network Traffic Analysis 19

20 Design Components Network Traffic Analysis 20

21 Demonstration Model Host Roles Algorithms: On line Support Vector Machine Decision Tree Ground Truth: Host Information in Active Directory and vulnerability scanner Nessus database Network Traffic Analysis 21

22 Client vs Server Classification Network Traffic Analysis 22

23 Personal System vs Public System Network Traffic Analysis 23

24 Web Server vs Server Network Traffic Analysis 24

25 Classifying Two Different Colleges Network Traffic Analysis 25

26 Anonymizer Usage Anonymity network usage via Pig scripting 205 million packets about 1.44TB data Analyzed Anonymity Networks Network Servers Service Tor 61,798 General I2P 2,267 P2P JAP 11 General R ers 15 Proxies 7,246 General Commercial Anomymizer,Gotrusted General

27 Anonymity Network Geolocation

28 Thanks