NeTS-NBD: Internet Routing Forensics -- A Framework for Understanding, Monitoring and Detecting Abnormal Border Gateway Protocol Events

在互联网继续蓬勃发展的同时，人们对异常路由事件的行为还没有很好的了解，也没有很好地了解它们的症状和如何检测它们。虽然许多研究已经创建了通过调查Internet数据平面的流量来检测入侵和异常的系统，但还没有创建类似的系统来在控制平面进行路由。这使得许多关键的基础和应用研究问题没有得到解答，特别是基于边界网关协议(BGP)的路由，BGP是Internet上事实上的域间路由协议。这项研究--Internet Routing Forensics(IRF)--将通过调查大量的路由数据，为从Internet控制平面了解和检测网络异常提供系统的手段。作为第一步，IRF重点关注可能影响BGP正常运行的互联网蠕虫或大规模停电等异常BGP事件。以检测速度、准确性和可用性为主要目标，本研究将建立一个可靠而灵活的框架，能够系统地处理大量的BGP数据，观察和学习异常BGP事件以及正常行为的模式和影响，发现异常BGP事件的规则，并应用这些规则来检测这些事件的发生--即使这些事件的发生尚不清楚。除了利用建模技术、数学方法和统计分析外，本研究还将特别利用数据挖掘技术从全局和局部层面探索海量数据空间，设计一种新颖的规则处理器来优化数据挖掘过程中产生的规则，并采用有监督的机器学习等技术来更准确地识别给定上下文中的异常路由事件。广泛影响：通过提供关键但目前缺乏的服务，该研究有望推进互联网为社会提供的服务。例如，网络运营商将与研究团队密切联系，分享他们使用该系统的经验。这项研究的方法、工具和发现将被传播。此外，这项研究将促进一个充满活力的教育计划。通过使用IRF框架观察和分析互联网上发生的真实事件，学生将积极参与理解和发现互联网的结构和复杂性。少数群体和妇女将通过实习、研讨会、演讲和其他机会特别受益于这一研究项目，并为其做出贡献。

While the Internet continues to thrive, the behavior of abnormal routing events are not well understood, nor are their symptoms and how they can be detected. Although numerous studies have created systems for detecting intrusions and anomalies by investigating traffic at the Internet data plane, no similar systems have been created for routing at the control plane. This leaves a wide range of critical basic and applied research questions unanswered, particularly for routing based on the Border Gateway Protocol (BGP) -- the de facto inter-domain routing protocol on the Internet.This research -- Internet Routing Forensics (IRF) -- will provide a systematic means for understanding and detecting networking anomalies from the Internet control plane by investigating a huge amount of routing data. As its first step, IRF focuses on abnormal BGP events, such as Internet worms or large-scale electricity outages that may affect the normal operation of BGP. With detection speed, accuracy and usability as the major goals, this research will build a reliable but flexible framework that can systematically process large archives of BGP data, observe and learn the patterns and effects of abnormal BGP events as well as those of normal behavior, discover rules of abnormal BGP events, and apply these rules to detect the occurrence of these events -- even if they are yet unknown.While IRF research lies primarily in the area of networking, it is inter-disciplinary. Besides leveraging modeling techniques, mathematical methods and statistical analysis, this research will in particular leverage data mining techniques to explore the huge data space from the global and local levels, devise a novel rule processor to optimize rules produced from the data mining process, and adopt supervised machine learning and other techniques to more accurately identify abnormal routing events within a given context.Broader Impact: By providing a crucial but currently lacking service, the research is expected to advance the service that the Internet provides to the society. Network operators, for example, will be in close contact with the research team to share their experience with the system. Methods, tools and discoveries from this research will be disseminated. Furthermore, this research will promote an energetic education plan. By using the IRF framework to observe and analyze real events happening on the Internet, students will be actively involved in the understanding and discovery of the structure and complexity of the Internet. Minorities and women will especially benefit from and contribute to this research project through internships, workshops, presentations, and other opportunities.