TTP: Medium: Detection and Analysis of Large-Scale Internet Infrastructure Outages

尽管互联网是关键基础设施，但几乎没有专门用于监测全球互联网行为的科学工具。特别是，我们没有严格的框架来衡量、分析或量化网络中断、过滤或其他异常连接动态对全球规模的影响。该项目将成功的研究成果应用于分析最近的宏观互联网连接中断，以开发、测试和试验性部署操作能力，以检测、监控和表征此类大规模基础设施中断。调查人员正在寻求验证和推广一种方法，不仅可以确定哪些网络受到了停电的影响，还可以确定哪些机制被用来实施故意中断。这项研究的两个智能主题是：(1)从互联网流量中恶意软件引发的背景辐射(IBR)中提取信号；(2)结合多种类型的数据(主动探测、被动IBR、路由数据、地理位置和注册表数据库)来描述中断的范围和进展。该项目还将制定量化指标，以衡量地球物理灾害对互联网基础设施的影响，包括服务中断和恢复的动态。将这些研究成果转化为实践将产生一个系统规范、实施和试验性操作部署，以检测和监控全球范围的连接故障。除了提高我们对测量如何产生对网络行为的洞察的理解，并增强我们对大规模复杂网络建模的能力，这样的系统还将揭示源于架构、拓扑或经济限制的基础设施漏洞，建议如何在未来的互联网体系结构和测量研究中缓解或消除这些弱点。

Despite the Internet's status as critical infrastructure, there is little scientific instrumentation dedicated to monitoring global Internet behavior. In particular, we have no rigorous framework for measuring, analyzing, or quantifying the impact of network outages, filtering, or other abnormal connectivity dynamics on a global scale.This project applies successful research results in analyzing recent macroscopic Internet connectivity disruptions to the development, testing, and experimental deployment of an operational capability to detect, monitor, and characterize such large-scale infrastructure outages. The investigators are seeking to validate and extend a methodology for identifying not only which networks have been affected by an outage, but also which mechanisms have been used to effect a deliberate disruption. The two intellectual themes of the research are: (1) extracting signal from malware-induced background radiation in Internet traffic (IBR); and (2) combining multiple types of data (active probing, passive IBR, routing data, geolocation, and registry databases) to delineate the scope and progression of the outage. The project will also develop quantitative indicators to gauge the impact of geophysical disasters on Internet infrastructure, including the dynamics of loss and restoration of service. A transition of these research outcomes into practice will yield a system specification, implementation, and experimental operational deployment to detect and monitor global connectivity failures on a planetary scale. In addition to improving our understanding of how measurements yield insights into network behavior, and strengthening our ability to model large scale complex networks, such a system will illuminate infrastructure vulnerabilities that derive from architectural, topological, or economic constraints, suggesting how to mitigate or eliminate these weaknesses in future Internet architecture and measurement research.