816 research outputs found
Scalable BGP Prefix Selection for Effective Inter-domain Traffic Engineering
Inter-domain Traffic Engineering for multi-homed networks faces a scalability
challenge, as the size of BGP routing table continue to grow. In this context,
the choice of the best path must be made potentially for each destination
prefix, requiring all available paths to be characterised (e.g., through
measurements) and compared with each other. Fortunately, it is well-known that
a few number of prefixes carry the larger part of the traffic. As a natural
consequence, to engineer large volume of traffic only few prefixes need to be
managed. Yet, traffic characteristics of a given prefix can greatly vary over
time, and little is known on the dynamism of traffic at this aggregation level,
including predicting the set of the most significant prefixes in the near
future. %based on past observations. Sophisticated prediction methods won't
scale in such context. In this paper, we study the relationship between prefix
volume, stability, and predictability, based on recent traffic traces from nine
different networks. Three simple and resource-efficient methods to select the
prefixes associated with the most important foreseeable traffic volume are then
proposed. Such proposed methods allow to select sets of prefixes with both
excellent representativeness (volume coverage) and stability in time, for which
the best routes are identified. The analysis carried out confirm the potential
benefits of a route decision engine
Control Plane Compression
We develop an algorithm capable of compressing large networks into a smaller
ones with similar control plane behavior: For every stable routing solution in
the large, original network, there exists a corresponding solution in the
compressed network, and vice versa. Our compression algorithm preserves a wide
variety of network properties including reachability, loop freedom, and path
length. Consequently, operators may speed up network analysis, based on
simulation, emulation, or verification, by analyzing only the compressed
network. Our approach is based on a new theory of control plane equivalence. We
implement these ideas in a tool called Bonsai and apply it to real and
synthetic networks. Bonsai can shrink real networks by over a factor of 5 and
speed up analysis by several orders of magnitude.Comment: Extended version of the paper appearing in ACM SIGCOMM 201
CAIR: Using Formal Languages to Study Routing, Leaking, and Interception in BGP
The Internet routing protocol BGP expresses topological reachability and
policy-based decisions simultaneously in path vectors. A complete view on the
Internet backbone routing is given by the collection of all valid routes, which
is infeasible to obtain due to information hiding of BGP, the lack of
omnipresent collection points, and data complexity. Commonly, graph-based data
models are used to represent the Internet topology from a given set of BGP
routing tables but fall short of explaining policy contexts. As a consequence,
routing anomalies such as route leaks and interception attacks cannot be
explained with graphs.
In this paper, we use formal languages to represent the global routing system
in a rigorous model. Our CAIR framework translates BGP announcements into a
finite route language that allows for the incremental construction of minimal
route automata. CAIR preserves route diversity, is highly efficient, and
well-suited to monitor BGP path changes in real-time. We formally derive
implementable search patterns for route leaks and interception attacks. In
contrast to the state-of-the-art, we can detect these incidents. In practical
experiments, we analyze public BGP data over the last seven years
Intelligent Management and Efficient Operation of Big Data
This chapter details how Big Data can be used and implemented in networking
and computing infrastructures. Specifically, it addresses three main aspects:
the timely extraction of relevant knowledge from heterogeneous, and very often
unstructured large data sources, the enhancement on the performance of
processing and networking (cloud) infrastructures that are the most important
foundational pillars of Big Data applications or services, and novel ways to
efficiently manage network infrastructures with high-level composed policies
for supporting the transmission of large amounts of data with distinct
requisites (video vs. non-video). A case study involving an intelligent
management solution to route data traffic with diverse requirements in a wide
area Internet Exchange Point is presented, discussed in the context of Big
Data, and evaluated.Comment: In book Handbook of Research on Trends and Future Directions in Big
Data and Web Intelligence, IGI Global, 201
Adaptive Traffic Fingerprinting for Darknet Threat Intelligence
Darknet technology such as Tor has been used by various threat actors for
organising illegal activities and data exfiltration. As such, there is a case
for organisations to block such traffic, or to try and identify when it is used
and for what purposes. However, anonymity in cyberspace has always been a
domain of conflicting interests. While it gives enough power to nefarious
actors to masquerade their illegal activities, it is also the cornerstone to
facilitate freedom of speech and privacy. We present a proof of concept for a
novel algorithm that could form the fundamental pillar of a darknet-capable
Cyber Threat Intelligence platform. The solution can reduce anonymity of users
of Tor, and considers the existing visibility of network traffic before
optionally initiating targeted or widespread BGP interception. In combination
with server HTTP response manipulation, the algorithm attempts to reduce the
candidate data set to eliminate client-side traffic that is most unlikely to be
responsible for server-side connections of interest. Our test results show that
MITM manipulated server responses lead to expected changes received by the Tor
client. Using simulation data generated by shadow, we show that the detection
scheme is effective with false positive rate of 0.001, while sensitivity
detecting non-targets was 0.016+-0.127. Our algorithm could assist
collaborating organisations willing to share their threat intelligence or
cooperate during investigations.Comment: 26 page
- …