Cyber Trust: Real-Time Internet Routing Anomaly Detection and Mitigation

网络信任：实时互联网路由异常检测与缓解该项目研究路由异常的检测与缓解。路由异常的广义定义是任何意外的互联网路由行为，导致数据包无法以合理的性能到达实际目的地或没有按照宣布的路由到达目的地。这项工作涉及设计一种新型的分布式路由入侵检测系统（Router IDS），用于实时路由异常检测和缓解。Router IDS通过结合来自多个有利位置的公开可用路由数据来检测路由异常，以检查一致性并识别与过去路由行为的偏差。它通过将路由数据与被动收集的流量数据以及主动触发的轻量级探测数据包相关联来消除不确定性。当检测到路由异常时，可以修改路由策略或过滤可疑的路由更新。覆盖路由也可以用来绕过路由器使用不正确的路由。该项目正在构建一个原型，以测试检测和缓解算法的有效性。原型可以部署在任何网络域，以实现对外部路由异常的保护。该项目涉及与研究实验室、行业和运营商社区的研究人员的持续合作，以提供实用的见解。

Cyber Trust: Real-Time Internet Routing Anomaly Detection and MitigationZhuoqing Mao, University of Michigan Ann ArborAward 0430204AbstractThis project is investigating the detection and mitigation of routing anomalies, defined broadly to be any unexpected Internet routing behavior resulting in data packets unable to reach the actual destination with reasonable performance or not following the advertised routes to reach the destination. This work involves designing a novel distributed routing Intrusion Detection System (Router IDS) for performing real-time routing anomaly detection and mitigation. The Router IDS detects routing anomalies by combining publicly available routing data from multiple vantage points to check consistency and identify deviations from past routing behavior. It disambiguates uncertainties by correlating routing data with both passively collected traffic data as well as actively triggered lightweight probe packets. In response to detected routing anomalies, routing policies are modified or the suspicious routing updates are filtered. Overlay routing can also be used to bypass the router using the incorrect route.This project is building a prototype to test the effectiveness of the detection and mitigation algorithms. The prototype can be deployed at any network domain to achieve protection from external routing anomalies. The project involves ongoing collaboration with researchers at research labs, industry, and the operator community, in order to provide practical insights.