Collaborative Research: NeTS-NBD: SCAN: Statistical Collaborative Analysis of Networks

协作研究：NeTS-NBD：SCAN：网络统计协作分析

• 批准号: 0721591
• 负责人: Carlos Guestrin
• 金额: $ 26.1万
• 依托单位: Carnegie-Mellon University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-01-01 至 2011-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0721591&HistoricalAwards=false
• 关键词: Collaborative; Research; NeTS; NBD; SCAN

Communications networks increasingly rely on robust, accurate monitoring systems to help network operators detect disruptions, misconfigurations, and failures. Accurate monitoring techniques detect disruptions when they occur (with a negligible number of false alarms), and identify the source of the disruption, for example, the faulty network element, the source of unwanted traffic. Robust monitoring detects disruptions when measurements may be noisy, incomplete, or when attackers are actively trying to disguise their presence. Network monitoring is most accurate when distributed; that is, when it draws upon observations from a large number of vantage points. Monitoring is more robust when it is network-level; that is, when it can rely on properties of the network traffic, rather than on other features such as traffic content. The researchers are developing techniques for distributed, network-level monitoring and incorporating these techniques into a distributed data management system for detecting network disruptions in two areas: internal network faults and failures, and external threats and unwanted traffic.The research has three themes: (1) Online, distributed, detection algorithms; (2) Informed actuation that uses passive measurements as a baseline, judiciously choosing active measurements to issue in support of the passive measurements, (3) Incorporating these techniques into real-world systems to evaluate the practicality of the schemes and their applicability in realistic network monitoring settings. We will evaluate our algorithms in two settings: detection of internal network disruptions (e.g., failures, faults and misconfigurations within a single network, such as a campus or enterprise network); and fast detection of global threats (e.g. spam, botnets).

通信网络越来越依赖强大、准确的监控系统来帮助网络运营商检测中断、错误配置和故障。 准确的监控技术可以在中断发生时检测到中断（误报数量可以忽略不计），并识别中断的来源，例如故障网络元件、不需要的流量的来源。 当测量可能有噪音、不完整或攻击者积极试图掩盖其存在时，强大的监控可以检测到中断。 分布式网络监控最准确；也就是说，当它利用大量有利位置的观察结果时。网络级监控更加稳健；也就是说，它可以依赖网络流量的属性，而不是流量内容等其他特征。研究人员正在开发分布式网络级监控技术，并将这些技术整合到分布式数据管理系统中，以检测两个领域的网络中断：内部网络故障和故障，以及外部威胁和不需要的流量。该研究有三个主题：（ 1）在线、分布式、检测算法； (2) 使用无源测量作为基线的知情驱动，明智地选择有源测量来发布以支持无源测量，(3) 将这些技术纳入现实世界的系统中，以评估方案的实用性及其在现实网络中的适用性监控设置。 我们将在两种情况下评估我们的算法：检测内部网络中断（例如单个网络（例如园区或企业网络）内的故障、错误和配置错误）；以及快速检测全球威胁（例如垃圾邮件、僵尸网络）。