Collaborative Research: NeTS-NBD: SCAN: Statistical Collaborative Analysis of Networks

通信网络越来越依赖强大、准确的监控系统来帮助网络运营商检测中断、错误配置和故障。准确的监控技术在中断发生时进行检测(错误警报的数量可以忽略不计)，并确定中断的来源，例如，故障网络元素，即不需要的流量的来源。强大的监控可在测量可能有噪音、不完整或攻击者主动试图掩盖其存在时检测到中断。网络监控在分布式时最准确；也就是说，当它利用来自大量有利位置的观察时。当监控处于网络级别时，即它可以依赖于网络流量的属性，而不是流量内容等其他功能时，监控更加可靠。研究人员正在开发分布式、网络级监控技术，并将这些技术整合到分布式数据管理系统中，用于检测两个领域的网络中断：内部网络故障和故障，以及外部威胁和不需要的流量。研究有三个主题：(1)在线、分布式、检测算法；(2)以被动测量为基准的知情激励，明智地选择主动测量来支持被动测量；(3)将这些技术整合到真实世界的系统中，以评估方案的实用性和它们在现实网络监控环境中的适用性。我们将在两个环境中评估我们的算法：检测内部网络中断(例如，单个网络中的故障、故障和错误配置)；快速检测全球威胁(例如，垃圾邮件、僵尸网络)。

Communications networks increasingly rely on robust, accurate monitoring systems to help network operators detect disruptions, misconfigurations, and failures. Accurate monitoring techniques detect disruptions when they occur (with a negligible number of false alarms), and identify the source of the disruption, for example, the faulty network element, the source of unwanted traffic. Robust monitoring detects disruptions when measurements may be noisy, incomplete, or when attackers are actively trying to disguise their presence. Network monitoring is most accurate when distributed; that is, when it draws upon observations from a large number of vantage points. Monitoring is more robust when it is network-level; that is, when it can rely on properties of the network traffic, rather than on other features such as traffic content. The researchers are developing techniques for distributed, network-level monitoring and incorporating these techniques into a distributed data management system for detecting network disruptions in two areas: internal network faults and failures, and external threats and unwanted traffic.The research has three themes: (1) Online, distributed, detection algorithms; (2) Informed actuation that uses passive measurements as a baseline, judiciously choosing active measurements to issue in support of the passive measurements, (3) Incorporating these techniques into real-world systems to evaluate the practicality of the schemes and their applicability in realistic network monitoring settings. We will evaluate our algorithms in two settings: detection of internal network disruptions (e.g., failures, faults and misconfigurations within a single network, such as a campus or enterprise network); and fast detection of global threats (e.g. spam, botnets).