Collaborative Research: NeTS-NBD: SCAN: Statistical Collaborative Analysis of Networks

协作研究：NeTS-NBD：SCAN：网络统计协作分析

• 批准号: 0721591
• 负责人: Carlos Guestrin
• 金额: $ 26.1万
• 依托单位: Carnegie-Mellon University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-01-01 至 2011-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0721591&HistoricalAwards=false
• 关键词: Collaborative; Research; NeTS; NBD; SCAN

Communications networks increasingly rely on robust, accurate monitoring systems to help network operators detect disruptions, misconfigurations, and failures. Accurate monitoring techniques detect disruptions when they occur (with a negligible number of false alarms), and identify the source of the disruption, for example, the faulty network element, the source of unwanted traffic. Robust monitoring detects disruptions when measurements may be noisy, incomplete, or when attackers are actively trying to disguise their presence. Network monitoring is most accurate when distributed; that is, when it draws upon observations from a large number of vantage points. Monitoring is more robust when it is network-level; that is, when it can rely on properties of the network traffic, rather than on other features such as traffic content. The researchers are developing techniques for distributed, network-level monitoring and incorporating these techniques into a distributed data management system for detecting network disruptions in two areas: internal network faults and failures, and external threats and unwanted traffic.The research has three themes: (1) Online, distributed, detection algorithms; (2) Informed actuation that uses passive measurements as a baseline, judiciously choosing active measurements to issue in support of the passive measurements, (3) Incorporating these techniques into real-world systems to evaluate the practicality of the schemes and their applicability in realistic network monitoring settings. We will evaluate our algorithms in two settings: detection of internal network disruptions (e.g., failures, faults and misconfigurations within a single network, such as a campus or enterprise network); and fast detection of global threats (e.g. spam, botnets).

通信网络越来越多地依赖于稳健，准确的监视系统来帮助网络运营商检测破坏，配置错误和失败。 准确的监视技术在发生时检测到这些干扰（具有可忽略的错误警报），并确定破坏的来源，例如，有故障的网络元素，不需要的流量来源。 强大的监视检测到何时嘈杂，不完整，或者攻击者正在积极试图掩盖其存在时的干扰。 分发时网络监视最准确。也就是说，当它从大量有利位置进行观察时。当网络级时，监视更加可靠；也就是说，当它可以依靠网络流量的属性而不是其他功能（例如流量内容）时。研究人员正在开发用于分布式，网络级监视的技术，并将这些技术纳入分布式数据管理系统中，以检测两个领域的网络中断：内部网络故障和故障，外部威胁和不必要的流量。研究具有三个主题：（1）在线，分布式，检测算法； （2）将被动测量用作基线，明智地选择主动测量以支持被动测量的驱动力，（3）将这些技术纳入现实世界系统中，以评估该方案的实用性及其在现实网络监控设置中的实用性。 我们将在两个设置中评估我们的算法：内部网络中断的检测（例如，在单个网络中，例如校园或企业网络等单个网络中的故障，故障和错误配置）；并快速检测全球威胁（例如垃圾邮件，僵尸网络）。