CT-ISG: Collaborative Research: Router Models and Downscaling Tools

美国国家科学基金会网络信任项目提案号：0831068首席研究员：George kesidis机构：宾夕法尼亚州立大学提案标题：CT-ISG：合作研究：用于可扩展安全实验的路由器模型和缩减工具项目摘要保护互联网免受诸如拒绝服务和域间路由攻击等攻击至关重要。虽然提出了几种防御措施，但实际部署有限。缺乏部署的一个主要原因是，大多数防御措施没有在现实条件下或在足够大的规模上得到验证。许多攻击还会产生二阶效应，这一点目前还没有得到很好的理解。这是因为很难以任何合理的规模将所有涉及的协议合并到分析、仿真或仿真模型或测试平台中。该项目包括两项互补的工作，通过设计以下内容来解决安全实验中的保真度和规模挑战：(1)路由器模型：将根据一些精心设计的场景下的简单设备测量，设计路由器和其他设备的高保真度但可扩展的模型。数据平面上的排队行为和控制平面上的资源消耗都将被考虑。(2)降尺度工具：在使用模拟、仿真或试验台实验进行研究之前，将开发技术来简化实验场景。算法可以缩小实验场景的规模，同时仍然保留该场景的重要排队或路由特征。更广泛的影响：将进行通用实验工具、大规模测试技术、测试框架的使用方法和相关的研究生水平课件的开发和公共传播。计划向模拟和测试平台团队进行重大扩展，例如ns-3、C-BGP和DETER（基于Emulab），以及工业界，特别是思科、英特尔和at&t。来自计算机科学和电气工程专业少数族裔的学生将积极参与。

National Science FoundationNSF Cyber Trust ProgramProposal Number: 0831068Principal Investigator: George KesidisInstitution: Pennsylvania State UniversityProposal Title: CT-ISG: Collaborative Research: Router Models and Downscaling Tools for Scalable Security ExperimentsProject Summary It is critical to protect the Internet from attacks such as denial of service, and attacks on inter-domain routing. Although several defenses have been proposed, actual deployments have been limited. A primary reason for this lack of deployment is that most defenses have not been validated under realistic conditions, or at sufficiently large scales. Many attacks also have second-order effects that are not well understood. This is because it is difficult to incorporate all the protocols involved at any reasonable scale in analytical, simulation, or emulation models or testbeds. This project includes two complementary efforts to address both the fidelity and scale challenges in security experiments by designing the following: (1) Router models: High-fidelity yet scalable models for routers and other devices will be designed that are based on simple device measurements under a few well-crafted scenarios. Both the queueing behavior in the data plane and resource consumption in the control plane will be considered. (2) Downscaling tools: Techniques will be developed to simplify experimental scenarios before studying them using simulation, emulation, or testbed experiments. Algorithms that can downscale an experimental scenario while still preserving the important queueing or routing characteristics of this scenario will be devised. Broader Impact: Development and public dissemination of general- purpose experimental tools, large-scale testing techniques, methodologies for the use of testing frameworks, and related graduate- level courseware will be undertaken. Significant outreach is planned to simulation and testbed teams, e.g., ns-3, C-BGP, and DETER (based on Emulab), and to industry, specifically Cisco, Intel, and AT&T. Students from under-represented minority groups in computer science and electrical engineering will be actively involved.