Collaborative Research: NeTS-NBD: SCAN: Statistical Collaborative Analysis of Networks

通信网络越来越依赖于强大、准确的监控系统来帮助网络运营商检测中断、错误配置和故障。精确的监控技术在中断发生时检测到中断（错误警报的数量可以忽略不计），并确定中断的来源，例如，有故障的网络元素，不需要的流量的来源。当测量可能有噪声、不完整或攻击者积极地试图掩饰他们的存在时，健壮的监视可以检测中断。分布式时网络监控最准确；也就是说，当它从大量有利位置进行观察时。网络级别的监控更健壮；也就是说，它可以依赖于网络流量的属性，而不是依赖于流量内容等其他特征。研究人员正在开发分布式网络级监控技术，并将这些技术整合到分布式数据管理系统中，用于检测两个领域的网络中断：内部网络故障和故障，以及外部威胁和不必要的流量。本研究有三个主题：(1)在线、分布式、检测算法；(2)以被动测量为基准的知情驱动，明智地选择主动测量来支持被动测量，(3)将这些技术纳入现实世界的系统，以评估方案的实用性及其在现实网络监测设置中的适用性。我们将在两种情况下评估我们的算法：检测内部网络中断（例如，单个网络内的故障，故障和错误配置，例如校园或企业网络）；快速检测全球威胁（如垃圾邮件、僵尸网络）。

Communications networks increasingly rely on robust, accurate monitoring systems to help network operators detect disruptions, misconfigurations, and failures. Accurate monitoring techniques detect disruptions when they occur (with a negligible number of false alarms), and identify the source of the disruption, for example, the faulty network element, the source of unwanted traffic. Robust monitoring detects disruptions when measurements may be noisy, incomplete, or when attackers are actively trying to disguise their presence. Network monitoring is most accurate when distributed; that is, when it draws upon observations from a large number of vantage points. Monitoring is more robust when it is network-level; that is, when it can rely on properties of the network traffic, rather than on other features such as traffic content. The researchers are developing techniques for distributed, network-level monitoring and incorporating these techniques into a distributed data management system for detecting network disruptions in two areas: internal network faults and failures, and external threats and unwanted traffic.The research has three themes: (1) Online, distributed, detection algorithms; (2) Informed actuation that uses passive measurements as a baseline, judiciously choosing active measurements to issue in support of the passive measurements, (3) Incorporating these techniques into real-world systems to evaluate the practicality of the schemes and their applicability in realistic network monitoring settings. We will evaluate our algorithms in two settings: detection of internal network disruptions (e.g., failures, faults and misconfigurations within a single network, such as a campus or enterprise network); and fast detection of global threats (e.g. spam, botnets).