Mapping our Way to a MoreSecure Internetk claffy / CAIDA/UCSD
20171

Team Profile
The Center for Applied Internet Data Analysis (CAIDA)– Founded by PI and Director k claffy– Independent analysis and research group–20+ years experience in data collection, curation, and research– Renowned world-wide for data collection tools, analysis, and data sharing– located at the UC San Diego Supercomputer Center

Principal Investigators: kc claffy, Alberto Dainotti, Amogh Dhamdhere
Key Personnel: Bradley Huffaker, Young Hyun, Marina Fomenkov, JoshPolterock, Ken Keys, Matthew Luckie (now @Waikato), Ricky Mok, Paul Hick

2

Need
Today the "cyber threat" is one of our most serious
economic and national security challenges.
But we lack understanding of the structure, dynamics,and vulnerabilities of the global Internet.
Measurement infrastructures, reliable, representative,
Internet data sets, and advanced analysis tools are
rarely available to researchers and developers.
3

Security First?
No, actually. Measurement first.

We cannot secure what we cannot measure.

Internet measurement & mapping is essential to cybersecurity

4Outline of Talk
•What kind of Internet maps do we need? What problems do they solve?

•

What capabilities are required to construct which maps?

•

What are challenges to these capabilities? How many ways can we getthe required data?

•Examples of applied mapping R&D•

How you can help!

5Real world crisis!
•

What do first responders do *first*?

•Find the crisis on a map!
•

Where is it?

•

What is its scope?

•

What is its extent?

•How fast is it moving?

•How Do I Get There?

Katrina
San Bernardino, CABoston

6

Cybersituational awarenessHow can maps inform understanding and mitigation of risk?
•••
•
•
•

physical links, interconnection facilities, routers
structure, dynamics, outages
resiliency to upstream disruption
attacks in progress, e.g., DDoS, hijacks, censorshipaddress space utilization, reachability, ownershipsecurity vulnerabilities
But map construction requires data,…. map utility requires info visualization,and map validation requires social interaction

7

Mapping is interdisciplinary
Science, Technology, Art, and Politics•In the case of entirely new and dynamic territory, new methods andtechniques for cartography•

Infrastructure to operationalize it•

Platforms to share, improve, apply its utility•

Data privacy policies to protect sensitive data•

Funding models to sustain it (and leverage capabilities more broadly)8Macroscopic assessments
Guiding principle: We cannot secure what we cannot measure.
1. Baseline path measurements to support anomaly detection
2. Router-level topology (ultimately on-demand)
3. Facility-level topology (physical interconnection)
4. Performance (which may reflect security incidents)
5. Security hygiene best practices, e.g., spoofer
Many others: security protocol compliance, TCP vulnerabilities,
address utilization census, grey-market address transfers,<your experiment here>
9Internet cartography primer
Guiding principle: The Internet was not designed to be measured.
1. Internet changing every day
2. IP architecture does not respect (or acknowledge) network boundaries.
3. Basic topology measurement machinery is a 30-year old clever hack,with myriad misleading artifacts in output.
4. Network address assignment strategies and router implementation
variance limit the accuracy of any single method
5. Many operators are not incentive-aligned to facilitate mapping research10Internet cartography primer
Baseline Internet measurement terms.
1. Ping: is this device (interface) responsive?
2. Traceroute: How does my packet get across the Internet? What is the IPlevel path from here to there? (reported by intermediate IP hops, sometimesincorrectly)
3. BGP: what is the network-level path from here to there? (game of telephone,sometimes confusing)
4. Round-trip time (latency): how long does it take to get there?
5. Metadata galore: WHOIS, IANA, DNS, geolocation (enables interpretation)
11CyberCartography•

CAIDA has been developing Internet cartography techniques, and operating
infrastructure to support these techniques, for over a decade•Archipelago platform now 180 globally distributed nodes collecting data andperforming experiments for researchers•Multiple modes of access, from web interface to API to ssh access to nodes•

Now using platform to involve broader research community•

Linking to other platforms to amplify utility

12Internet Outage Detection & Analysis

Screenshot of the IODA dashboard highlighting outages in Turkey
NSF CNS-1228994, UC San Diego
PI: Alberto Dainotti, CoPI: KC Claffy13

To measure outages, we need a baseline
1. Data acquisition and processing pipelinea. sanitize BGP data from sliding 1-week of RV/RIS data (reconstruct routingtables of hundreds of operational routers worldwide with 5-min granularity)
b. dynamically identify which IP addresses to probe(spatially and temporally fine-grained monitoring)c. Result: (nearly) live mapping of control and data planesd. Sharing: curated daily files of AS paths for post-event analysis
e. Support: outage detection & analysis (IODA) systemf. Support: interactive monitoring to detect route hijacks
Detecting traffic interception using
real-time BGP anomaly detection
paired with active probing triggered
upon event detection
14

Mapping Interdomain Congestion•goal: system to monitor
interdomain links and theircongestion state (canindicate DOS attack)•near real-time “congestion
heat map” of the Internet•

increase transparency,
empirical grounding of policy
debates15

Mapping Router Interconnections• Collaborating PI: Matthew Luckie (U. Waikato)
AS A
a1RAS B
a2

a3

R21b1

b2bc1
Responses to traceroute probes depend onrouter software implementation andplacement in the network. A response fromR2 may be naively interpreted as comingfrom a router operated by AS A, B, or C.

AS C

c2

R4c3

AS D
R5d?

b5

4R

b3
3b6

AS E b?
R6e?
16

Mapping interconnections

2
3

4
6
1

1.Developed and deployed heuristic
algorithms to accurately infer routerownership & interconnections fromtraceroute data
2. Apply heuristics to annotate maps
3. Validation with ISPs
4. AS border mapping software runs
continuously on Ark85

5. Supports CAIDA’s MANIC platform(Measurement and Analysis ofInterdomain Congestion) [see demo]

7

Conceptual mapping of heuristics to infer border routers(Diagram taken from Luckie, et al. IMC2016 paper.)17

Mapping Interconnection Facilities
1. Assemble/maintain IXP database from published sources (PCH, PeeringDB)
2. Develop new techniques to infer engineering approach to interconnection
3. Alias resolution of interconnection IP addresses
4. Merge above techniques to generate a facility-aware map (CONEXT2015)
5. Open question: feasibility of scaling methods to hundreds of facilities

18

Providing Mapping-Related Data• Publicly Available Mapping-Related Data (Most recent 2 years in DHS IMPACT)– IPv4 Routed /24 Topology, and associated DNS Names Dataset– IPv4 Prefix Probing Dataset (finer grained temporally)– Internet Topology Data Kits (ITDK)– IPv6 Topology and associated DNS Names Dataset– IPv4 Routed /24 AS Links (September 2007 - ongoing)– IPv6 AS Links (December 2008 - ongoing)– AS Relationships– AS Classification– AS to Organization
19

Archipelago Infrastructure

Legend:- Raspberry Pi- FreeBSD

181 monitors in 60 countries
135 Raspberry Pi's83 have IPv6Continent

Organizations
57

academic64

residential

Europe33

commercial/business

22

Africa27

network infrastructure

20Asia29

otherOceania

67

North America

7South America

5620Benefits of Cybercartography• Enhanced scientific understanding and technical capabilities for
empirically grounded macroscopic assessment of the global Internet• Comprehensive, trustworthy measurements of security-relevant
properties and behavior of the global Internet• Provides basis for data-focused services, products, tools andresources to advance the study of the Internet for a wide range of
disciplines, led by today’s imperative for improved cybersecurity• Challenges looming ahead: effective data sharing, IoT, IPv6, CGN

21

How can you help?
Use the data. Ask for more. Be specific.
Use the measurement infrastructure platforms. Be scientific.
Use the data integration platforms. Be situationally aware.
Deploy monitoring infrastructure. Email info@caida.org
Send promising students
Teach promising students
Remember, you cannot secure what you cannot measure.

22

k claffy
CAIDA/UCSD
kc@caida.org
858-534-8333
twitter:@caidaorg

23