CT-ISG: Collaborative Research: Router Models and Downscaling Tools for Scalable Security Experiments

国家科学基金会NSF网络信任计划建议编号：0831060主要调查者：Ness Shroff机构：俄亥俄州立大学建议标题：CT-ISG：协作研究：可扩展安全实验的路由器模型和缩减工具项目摘要保护Internet免受拒绝服务和域间路由等攻击至关重要。尽管已经提出了几种防御措施，但实际部署有限。缺乏部署的一个主要原因是，大多数防御措施没有在现实条件下或在足够大的规模下得到验证。许多攻击还具有二阶效应，但人们对此并不清楚。这是因为很难在分析、模拟或仿真模型或试验台中以任何合理的规模合并所涉及的所有协议。该项目包括两个相辅相成的努力，通过设计以下内容来解决安全实验中的保真度和可扩展性挑战：(1)路由器模型：将设计高保真但可扩展的路由器和其他设备模型，这些模型将基于几个精心设计的场景下的简单设备测量。将同时考虑数据平面中的排队行为和控制平面中的资源消耗。(2)缩减工具：在使用模拟、仿真或试验台实验研究实验场景之前，将开发技术来简化实验场景。我们将设计一些算法来缩小实验场景的规模，同时仍能保留该场景的重要排队或路由特性。更广泛的影响：将开发和公开传播通用实验工具、大规模测试技术、使用测试框架的方法以及相关的研究生级课程。计划向模拟和试验台团队，例如ns-3、C-BGP和Dreat(基于Emulab)，以及行业，特别是思科、英特尔和AT&amp；T，以及来自计算机科学和电气工程领域代表性不足的少数群体的学生积极参与。

National Science FoundationNSF Cyber Trust ProgramProposal Number: 0831060Principal Investigator: Ness ShroffInstitution: Ohio State UniversityProposal Title: CT-ISG: Collaborative Research: Router Models and Downscaling Tools for Scalable Security ExperimentsProject Summary It is critical to protect the Internet from attacks such as denial of service, and attacks on inter-domain routing. Although several defenses have been proposed, actual deployments have been limited. A primary reason for this lack of deployment is that most defenses have not been validated under realistic conditions, or at sufficiently large scales. Many attacks also have second-order effects that are not well understood. This is because it is difficult to incorporate all the protocols involved at any reasonable scale in analytical, simulation, or emulation models or testbeds. This project includes two complementary efforts to address both the fidelity and scale challenges in security experiments by designing the following: (1) Router models: High-fidelity yet scalable models for routers and other devices will be designed that are based on simple device measurements under a few well-crafted scenarios. Both the queueing behavior in the data plane and resource consumption in the control plane will be considered. (2) Downscaling tools: Techniques will be developed to simplify experimental scenarios before studying them using simulation, emulation, or testbed experiments. Algorithms that can downscale an experimental scenario while still preserving the important queueing or routing characteristics of this scenario will be devised. Broader Impact: Development and public dissemination of general- purpose experimental tools, large-scale testing techniques, methodologies for the use of testing frameworks, and related graduate- level courseware will be undertaken. Significant outreach is planned to simulation and testbed teams, e.g., ns-3, C-BGP, and DETER (based on Emulab), and to industry, specifically Cisco, Intel, and AT&T. Students from under-represented minority groups in computer science and electrical engineering will be actively involved.