Cyber Trust: Real-Time Internet Routing Anomaly Detection and Mitigation

Cyber Trust：实时互联网路由异常检测和缓解Zhuoqing Mao，密歇根大学安娜堡奖0430204摘要该项目正在研究路由异常的检测和缓解，路由异常广泛定义为导致数据包无法到达的任何意外互联网路由行为。以合理的性能到达实际目的地或不遵循广告路线到达目的地。 这项工作涉及设计一种新的分布式路由入侵检测系统（路由器IDS）进行实时路由异常检测和缓解。 路由器IDS通过结合来自多个Vantage位置的公开可用路由数据来检查一致性并识别与过去路由行为的偏差，从而检测路由异常。 它通过将路由数据与被动收集的流量数据以及主动触发的轻量级探测数据包相关联来消除不确定性。 响应于检测到的路由异常，修改路由策略或过滤可疑的路由更新。 覆盖路由也可以用来绕过使用错误路由的路由器。本项目正在构建一个原型来测试检测和缓解算法的有效性。 该原型可以部署在任何网络域，以实现对外部路由异常的保护。 该项目涉及与研究实验室，工业和运营商社区的研究人员进行持续合作，以提供实用的见解。

Cyber Trust: Real-Time Internet Routing Anomaly Detection and MitigationZhuoqing Mao, University of Michigan Ann ArborAward 0430204AbstractThis project is investigating the detection and mitigation of routing anomalies, defined broadly to be any unexpected Internet routing behavior resulting in data packets unable to reach the actual destination with reasonable performance or not following the advertised routes to reach the destination. This work involves designing a novel distributed routing Intrusion Detection System (Router IDS) for performing real-time routing anomaly detection and mitigation. The Router IDS detects routing anomalies by combining publicly available routing data from multiple vantage points to check consistency and identify deviations from past routing behavior. It disambiguates uncertainties by correlating routing data with both passively collected traffic data as well as actively triggered lightweight probe packets. In response to detected routing anomalies, routing policies are modified or the suspicious routing updates are filtered. Overlay routing can also be used to bypass the router using the incorrect route.This project is building a prototype to test the effectiveness of the detection and mitigation algorithms. The prototype can be deployed at any network domain to achieve protection from external routing anomalies. The project involves ongoing collaboration with researchers at research labs, industry, and the operator community, in order to provide practical insights.