NeTS-NBD: Internet Routing Forensics -- A Framework for Understanding, Monitoring and Detecting Abnormal Border Gateway Protocol Events

虽然互联网继续蓬勃发展，异常路由事件的行为还没有得到很好的理解，也不是他们的症状和如何可以检测到。 尽管许多研究已经创建了通过调查互联网数据平面上的流量来检测入侵和异常的系统，但是还没有创建用于控制平面上的路由的类似系统。 这就留下了一个广泛的关键的基础和应用研究问题的答案，特别是基于边界网关协议（BGP）的路由-事实上在Internet上的域间路由协议。这项研究- Internet路由取证（IRF）-将提供一个系统的手段，通过调查大量的路由数据，从Internet控制平面理解和检测网络异常。 作为第一步，IRF侧重于BGP异常事件，如可能影响BGP正常运行的互联网蠕虫或大规模停电。 本研究将以检测速度、准确性和可用性为主要目标，构建一个可靠而灵活的框架，能够系统地处理大量的BGP数据档案，观察和学习异常BGP事件和正常行为的模式和影响，发现规则异常的BGP事件，并应用这些规则来检测这些事件的发生--即使它们还未知。虽然IRF的研究主要在网络领域，但它是跨学科的。 除了利用建模技术、数学方法和统计分析外，本研究将特别利用数据挖掘技术从全局和局部两个层面探索巨大的数据空间，设计一种新的规则处理器来优化数据挖掘过程中产生的规则，并采用监督机器学习和其他技术来更准确地识别给定上下文中的异常路由事件。通过提供一个关键的，但目前缺乏的服务，该研究有望推进互联网提供给社会的服务。 例如，网络运营商将与研究小组密切联系，分享他们使用该系统的经验。将传播这项研究的方法、工具和发现。此外，这项研究将促进一个充满活力的教育计划。 通过使用IRF框架来观察和分析互联网上发生的真实的事件，学生将积极参与理解和发现互联网的结构和复杂性。 少数民族和妇女将通过实习，研讨会，演讲和其他机会特别受益于并有助于这一研究项目。

While the Internet continues to thrive, the behavior of abnormal routing events are not well understood, nor are their symptoms and how they can be detected. Although numerous studies have created systems for detecting intrusions and anomalies by investigating traffic at the Internet data plane, no similar systems have been created for routing at the control plane. This leaves a wide range of critical basic and applied research questions unanswered, particularly for routing based on the Border Gateway Protocol (BGP) -- the de facto inter-domain routing protocol on the Internet.This research -- Internet Routing Forensics (IRF) -- will provide a systematic means for understanding and detecting networking anomalies from the Internet control plane by investigating a huge amount of routing data. As its first step, IRF focuses on abnormal BGP events, such as Internet worms or large-scale electricity outages that may affect the normal operation of BGP. With detection speed, accuracy and usability as the major goals, this research will build a reliable but flexible framework that can systematically process large archives of BGP data, observe and learn the patterns and effects of abnormal BGP events as well as those of normal behavior, discover rules of abnormal BGP events, and apply these rules to detect the occurrence of these events -- even if they are yet unknown.While IRF research lies primarily in the area of networking, it is inter-disciplinary. Besides leveraging modeling techniques, mathematical methods and statistical analysis, this research will in particular leverage data mining techniques to explore the huge data space from the global and local levels, devise a novel rule processor to optimize rules produced from the data mining process, and adopt supervised machine learning and other techniques to more accurately identify abnormal routing events within a given context.Broader Impact: By providing a crucial but currently lacking service, the research is expected to advance the service that the Internet provides to the society. Network operators, for example, will be in close contact with the research team to share their experience with the system. Methods, tools and discoveries from this research will be disseminated. Furthermore, this research will promote an energetic education plan. By using the IRF framework to observe and analyze real events happening on the Internet, students will be actively involved in the understanding and discovery of the structure and complexity of the Internet. Minorities and women will especially benefit from and contribute to this research project through internships, workshops, presentations, and other opportunities.