CT-ISG: Collaborative Research: Router Models and Downscaling Tools

美国国家科学基金会网络信任计划提案编号：0831068主要研究者：乔治凯西迪斯机构：宾夕法尼亚州立大学提案标题：CT-ISG：合作研究：路由器模型和缩减工具的可扩展的安全实验项目摘要保护互联网免受攻击，如拒绝服务，和攻击域间路由是至关重要的。虽然已经提出了几种防御措施，但实际部署有限。缺乏部署的主要原因是大多数防御措施尚未在现实条件下或足够大的规模下进行验证。许多攻击还具有尚未很好理解的二阶效应。这是因为很难将所有涉及的协议以任何合理的规模纳入分析、模拟或仿真模型或测试平台。该项目包括两个互补的努力，通过设计以下内容来解决安全实验中的保真度和规模挑战：（1）路由器模型：路由器和其他设备的高保真但可扩展的模型将基于一些精心制作的场景下的简单设备测量而设计。将考虑数据平面中的共享行为和控制平面中的资源消耗两者。(2)降尺度工具：技术将被开发，以简化实验方案，然后再研究他们使用模拟，仿真，或试验台实验。将设计出可以缩小实验场景的规模，同时仍然保留该场景的重要路由或路由特性的算法。更广泛的影响：将开发和公开传播通用实验工具、大规模测试技术、使用测试框架的方法以及相关的研究生级课件。计划对模拟和试验台小组进行重大外联，例如，ns-3、C-BGP和DETER（基于Emulab），以及业界，特别是Cisco、Intel和AT T。来自计算机科学和电气工程领域代表性不足的少数群体的学生将积极参与。

National Science FoundationNSF Cyber Trust ProgramProposal Number: 0831068Principal Investigator: George KesidisInstitution: Pennsylvania State UniversityProposal Title: CT-ISG: Collaborative Research: Router Models and Downscaling Tools for Scalable Security ExperimentsProject Summary It is critical to protect the Internet from attacks such as denial of service, and attacks on inter-domain routing. Although several defenses have been proposed, actual deployments have been limited. A primary reason for this lack of deployment is that most defenses have not been validated under realistic conditions, or at sufficiently large scales. Many attacks also have second-order effects that are not well understood. This is because it is difficult to incorporate all the protocols involved at any reasonable scale in analytical, simulation, or emulation models or testbeds. This project includes two complementary efforts to address both the fidelity and scale challenges in security experiments by designing the following: (1) Router models: High-fidelity yet scalable models for routers and other devices will be designed that are based on simple device measurements under a few well-crafted scenarios. Both the queueing behavior in the data plane and resource consumption in the control plane will be considered. (2) Downscaling tools: Techniques will be developed to simplify experimental scenarios before studying them using simulation, emulation, or testbed experiments. Algorithms that can downscale an experimental scenario while still preserving the important queueing or routing characteristics of this scenario will be devised. Broader Impact: Development and public dissemination of general- purpose experimental tools, large-scale testing techniques, methodologies for the use of testing frameworks, and related graduate- level courseware will be undertaken. Significant outreach is planned to simulation and testbed teams, e.g., ns-3, C-BGP, and DETER (based on Emulab), and to industry, specifically Cisco, Intel, and AT&T. Students from under-represented minority groups in computer science and electrical engineering will be actively involved.