Collaborative Research: NeTS-NBD: SCAN: Statistical Collaborative Analysis of Networks

通信网络越来越依赖于强大、准确的监控系统来帮助网络运营商检测中断、错误配置和故障。 准确的监控技术可以在中断发生时检测到中断（错误警报的数量可以忽略不计），并识别中断的来源，例如，故障网络元件，不必要流量的来源。 当测量可能存在噪声、不完整或攻击者主动试图掩盖其存在时，强大的监控可以检测到中断。 网络监视在分布式时是最准确的;也就是说，当它从大量的Vantage位置进行观察时。当监控是网络级的时候，也就是说，当它可以依赖于网络流量的属性，而不是流量内容等其他功能时，监控会更加可靠。研究人员正在开发分布式网络级监控技术，并将这些技术整合到分布式数据管理系统中，以检测两个方面的网络中断：内部网络故障和失效，以及外部威胁和不必要的流量。（2）使用被动测量作为基线的知情致动，明智地选择主动测量以发布以支持被动测量，（3）将这些技术应用到实际系统中，以评估这些方案的实用性及其在实际网络监控环境中的适用性。 我们将在两种情况下评估我们的算法：检测内部网络中断（例如，故障、故障和配置错误）;以及快速检测全球威胁（例如垃圾邮件、僵尸网络）。

Communications networks increasingly rely on robust, accurate monitoring systems to help network operators detect disruptions, misconfigurations, and failures. Accurate monitoring techniques detect disruptions when they occur (with a negligible number of false alarms), and identify the source of the disruption, for example, the faulty network element, the source of unwanted traffic. Robust monitoring detects disruptions when measurements may be noisy, incomplete, or when attackers are actively trying to disguise their presence. Network monitoring is most accurate when distributed; that is, when it draws upon observations from a large number of vantage points. Monitoring is more robust when it is network-level; that is, when it can rely on properties of the network traffic, rather than on other features such as traffic content. The researchers are developing techniques for distributed, network-level monitoring and incorporating these techniques into a distributed data management system for detecting network disruptions in two areas: internal network faults and failures, and external threats and unwanted traffic.The research has three themes: (1) Online, distributed, detection algorithms; (2) Informed actuation that uses passive measurements as a baseline, judiciously choosing active measurements to issue in support of the passive measurements, (3) Incorporating these techniques into real-world systems to evaluate the practicality of the schemes and their applicability in realistic network monitoring settings. We will evaluate our algorithms in two settings: detection of internal network disruptions (e.g., failures, faults and misconfigurations within a single network, such as a campus or enterprise network); and fast detection of global threats (e.g. spam, botnets).