Dynamic Scheduling DDoS Signature Detection
Multi-cloud Network Management Multi-cloud Route Characterization Unraveling the Cloud Peering Fabric
Optics-based DDoS Defenses DDoS Signature Detection Climate Change Risks to Networks Colocation View of Internet Routes
Multi-task Weak Supervision De-noising Delay Measurements Forecasting Network Streams Application Behavior Modeling
Metro Fiber Characterization IPv6 Alias Resolution Mapping Internet Interconnections IPv6 Topology Discovery Geography of Eyeball ASes
Traffic Localization Web Complexity
BONSAI
Predicting Mental Health Incentivized Reviews Coarse View of Graphs
PRIME Mesh vs Multiple Trees ISP-Friendly Contribution Awareness Dissecting Performance Overlay Monitoring
Unbiased Sampling Peer Dynamics (Churn) DHT Lookup Performance Tsunami, A DHT Botnet Shared Files Monitoring DHT Traffic Overlay Topology Impact on [AS] Underlay
Publisher Behavior Peer-Level Performance Assessing Scalability

Cybersecurity and Resiliency

Optics-based DDoS Defenses

Distributed Denial of Service (DDoS) attacks continue to present a clear and imminent danger to critical network infrastructures. DDoS attacks have increased in sophistication with advanced strategies to continuously adapt (e.g., changing threat postures dynamically) and induce collateral damage (i.e., higher latency and loss for legitimate traffic). Furthermore, advanced attacks may also employ reconnaissance (e.g., mapping the network to find bottleneck links) to target the network infrastructure itself. In light of these trends, state-of-art defenses (e.g., advanced scrubbing, emerging software-defined defenses, and programmable switching hardware) have fundamental shortcomings. This project will develop a new framework, referred to as “Optics-enabled In-Network defenSe for Extreme Terabit DDoS attacks” (ONSET). The framework makes a case for new dimensions of defense agility that can programmatically control the topology of the network (in addition to the processing behavior) to tackle advanced and future attacks. The project will facilitate the use of optical technologies as an exciting visual medium for engaging K-12 students via suitable channels for dissemination. The project will also result in new course materials at the intersection of optical networking, software-defined networking, and network security to enable students to become domain experts in this emerging problem space.

The project will take an interdisciplinary approach spanning security, optics, systems, and networks, to address fundamental challenges along three thrusts: (1) novel “data plane” solutions to rapidly reconfigure the wavelengths and switches and new capabilities in programmable switches to rapidly identify malicious vs. benign traffic at line rate; (2) novel “control plane” orchestration mechanisms for scalable resource management algorithms and coordinated control across optical networking and programmable switches; and (3) new “northbound application programming interfaces (APIs)” to express novel defenses to combat current and future DDoS attacks (e.g., with reconnaissance). This project will develop a new framework, referred to as “Optics-enabled In-Network defenSe for Extreme Terabit DDoS attacks” (ONSET). The research efforts will result in end-to-end prototypes using open-source and standardized interfaces to demonstrate the novel defense capabilities of ONSET. The efficacy of ONSET will be evaluated using pilot studies on operational networks to create a roadmap to practical deployment, using real testbeds and large-scale simulations. The project outcomes will be released as open-source software tools, models, and simulation frameworks that will inform industry and academic work.

Publications

  • Are WANs Ready for Optical Topology Programming?
    Matthew Nance Hall, Paul Barford, Klaus-Tycho Foerster, Manya Ghobadi, William Jensen, and Ramakrishnan Durairajen
    In Proceedings of Workshop on Optical Systems (OptSys’21)
    Virtual, August 2021.
    [PAPER]
  • Fighting Fire with Light: Tackling Extreme Terabit DDoS Using Programmable Optics
    Matthew Nance Hall, Guyue Liu, Vyas Sekar and Ramakrishnan Durairajan
    In Proceedings of 1st Workshop on Secure and Programmable Network Infrastructure (SPIN’20)
    co-located with ACM SIGCOMM’20, New York, USA, August 2020.
    [PAPER] [SLIDES]
  • Bridging the Optical-Packet Network Chasm via Secure Enclaves (Extended abstract)
    Matthew Nance Hall and Ramakrishnan Durairajan
    In Workshop on Optical Systems Design (OptSys’20)
    co-located with ACM SIGCOMM’20, New York, USA, August 2020.
    [SLIDES]

Team

  • Prof. Ram Durairajan (UO)
  • Matthew Nance-Hall (UO)
  • Prof. Alan Liu (Boston University)
  • Prof. Vyas Sekar (CMU)

Funding

  • This material is based upon work supported by the National Science Foundation (NSF) award NSF SaTC 2132651. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the NSF.

Climate Change Risks to Networks

As innovations on the Internet continue to evolve, so do the risks to this critical infrastructure. In fact, since its inception, the Internet has grown increasingly exposed to small- and large- scale disaster events such as hurricanes, earthquakes, wildfires, thunderstorms, and, more recently, even climate change. Such events can have significant consequences on society including the loss of connectivity for large sections of users or businesses for extended periods of time. We seek an answer to the following research question: what is the overall resilience of Internet infrastructures to climate change-induced multi-hazard risks?

Publications

  • On the Resilience of Internet Infrastructures in the Pacific Northwest to Earthquakes
    Juno Mayer, Valerie Sahakian, Emilie Hooft, Douglas Toomey and Ramakrishnan Durairajan
    In Proceedings of Passive and Active Measurement Conference (PAM’21)
    Virtual, March 2021.
    [PAPER]
  • Lights Out: Climate Change Risk to Internet Infrastructure
    Ramakrishnan Durairajan, Carol Barford and Paul Barford
    In Proceedings of ACM/IRTF/ISOC Applied Networking Research Workshop (ANRW’18)
    co-located with IETF 102, Montreal, Canada, July 2018.
    [PAPER]

Team

  • Prof. Ram Durairajan (UO)
  • Juno Mayer (UO)

Colocation View of Internet Routes

Many public and private Internet stakeholders regard today’s Internet as a “critical infrastructure” and assume its end-to-end connectivity service (henceforth referred to as IP routes) to be secure, resilient, and private. However, contrary to this assumption, the problem of assessing and improving the resiliency and privacy of IP routes requires a careful examination of a two-pronged threat model: (i) Route Resiliency where specific routes are intrinsically disrupted by the failure of an infrastructure element (e.g., link cut); (ii) Route Privacy where a collection of routes is extrinsically diverted and their traffic is exposed to other countries. Scientific inquiries to solve this complex problem are hindered by two key challenges. First, these threats exploit the decoupling between the network and physical layers in the Internet architecture. Specifically, a logical representation of a route (e.g., as captured by traceroute) reveals little information about the physical infrastructural dependencies e.g., routers and links associated with that route. State-of-the-art techniques for elucidating the infrastructural dependencies are typically accurate at the country-level granularity, making them largely inadequate for assessing these threats even at metro level. Second, even with accurate information about the dependency of IP routes on the infrastructure, providing actionable intelligence (to mitigate these problems) to public and private stakeholders (e.g., federal agencies; enterprises and ISPs) remains challenging. For one, the dependency information is often proprietary in nature and cannot be shared with all stakeholders. Moreover, the number and selection of routes that different stakeholders are incentivized, authorized, and able to change are very diverse. Finally, many independently-made adjustments to a small set of the stakeholders’ routes may not address these threats for all stakeholders.

The main vision of this research project is to enable and incentivize public and private Internet stakeholders to assess and improve the resiliency and privacy of their IP routes in a principled and privacy-preserving manner. To this end, the proposed research is organized into three related thrusts. Thrust 1 seeks to investigate new scalable techniques to accurately determine the fine-grained dependencies of all public, inter-metro IP routes across the US on the physical Internet infrastructure. Enabling the techniques is our recently developed method that systematically infers the IP- and router-level views of Autonomous System (AS) peerings at individual colocation facilities. The outcome will be presented as a dependency map. This map is input to Thrusts 2 & 3 and enables a novel two-pronged approach to address the above-mentioned threats in a principled manner. Thrust 2 aims to assess the considered threat model across all US routes, enable public stakeholders to identify the threats at the national level, and facilitate coordination with backbone networks (and cable providers) to mitigate these threats in a top-down manner. Thrust 3 proposes a framework to enable individual private stakeholders to assess the considered threats across a subset of related routes, obtain alternative routes, and incentivize these stakeholders to mitigate these threats in a bottom-up, scalable, privacy-preserving manner.

Colocation View of Internet Routes

Team

  • Prof. Reza Rejaie (UO)
  • Prof. Ram Durairajan (UO)
  • Dr. Walter Willinger (NIKSUN, Inc.)