Tutorials
Tutorial 1: Traffic Modeling 101.
Methods and Results for Single Links and Whole Networks
Tutorial 2: Unwanted Traffic: Attacks,
Detection and Potential Solutions
Tutorial 3: Architectural
Considerations for Unusual and Challenged Networks
Traffic
Modelling 101:
Methods and Results for Single Links and Whole Networks
Mark Crovella, Boston University
Monday, August 30, 9:00-12:30
Summary:
This
tutorial will provide an introduction to traffic models and traffic
modeling for network researchers and engineers. The tutorial will
present an overview of practical methods for analyzing network traffic,
and will in tandem survey important results in the area of traffic
modeling.
The traffic we are concerned with is expressed in terms of bytes,
packets, or flows. We will look at flows at the IP level (as
defined by the 5-tuple) and at the level of network ingress-egress
(origin-destination flows) such as are used in traffic matrix
estimation. Along the way we'll consider methods and results that
apply to traffic measured on a single link, as well as methods and
results that apply to traffic measured simultaneously on all links of a
network.
Traffic models can be used for describing normal traffic behavior, or
for identifying when traffic is behaving unusually. Throughout
the tutorial we will consider the use of traffic models both for
characterizing typical traffic as well as for anomaly detection.
Outline:
- Introduction
- What are the uses for traffic
modeling?
- What are the different varieties of
traffic models?
- Traffic Modeling for Performance
Analysis
- Methods
- Measuring and analyzing marginals
and autocorrelation
- Examining heavy tails and
self-similarity
- Results - Properties of Observed
Traffic on short timescales
- Reference models: poisson,
fractional gaussian noise, alpha/beta
- Relationship to multiplexing
levels and bottlenecks
- Properties of bytes, packets, and
flows
- Traffic Modeling for Network
Engineering - Single Link
- Methods
- Separating trends and noise
- Frequency domain analysis and
wavelet transforms
- Results
- Reference models for
nonstationary traffic
- Forecasting and anomaly detection
- Traffic Modeling for Network
Engineering - Multiple Links
- Methods
- Separating trends and noise
- Spatial domain analysis and
subspace methods
- Tracking trends in time
- Results
- Intrinsic dimensionality of
bytes, packets, and flows
- Anomaly detection
Audience:
Researchers
and engineers
who want to understand what is known about
network traffic and how results have been
obtained. Attendees will learn analysis
methods useful for network researchers and engineers, as well as
essential background
for development of anomaly detection methods. Familiarity with basic
probability is assumed; linear algebra is helpful but not required.
Biography:
Mark Crovella is Associate Professor of Computer
Science at Boston University. He has been working in Internet
measurement
for 10 years, in areas including bandwidth and topology measurement,
heavy
tails and self-similarity, the World Wide Web, and network
traffic.
He is an editor for IEEE/ACM Transactions on
Networ-king and IEEE Transactions on Computers, and was the Program
Chair for
the 2003 ACM SIGCOMM Internet Measurement Conference. His paper
"Self-Similarity in World Wide Web Traffic: Evidence and Possible
Causes" is listed by Cite seer as one of the 100 most cited papers in
Computer Science, and his paper "Critical Path Analysis of TCP
Transactions" was nominated for the 2002 William Bennett Prize.
Unwanted
traffic: Attacks, detection, and potential solutions
Dina Katabi, MIT
Balachander
Krishnamurthy, AT&T Research
Monday, August 30,
1:30-5:00
Summary:
Unwanted packets are any undesirable data or control
traffic that the network delivers to a system. They may deplete the
link bandwidth of a victim in a denial of service attack, mount a SYN
flood attack, waste user's time on spam email messages, etc. Unwanted
packets have been at the heart of most of the problems on the Internet
in the last few years. What began as small scale attacks on
individual network nodes has spread to every layer of the protocol
stack through many popular applications. Many compromised
machines are used to launch a wide range of distributed attacks. Spam
has clogged networks and tied up the productivity of many uses while
lowering the overall value of email communication. Wastage of
resources, both human and computational, is on the increase due to
these attacks. Attacks on the DNS infrastructure, on BGP, and popular
Web sites have brought into question the stability of the Internet
architecture.
In this half-day tutorial, we present a taxonomy of the attacks as well
as a variety of existing and proposed mechanisms to deter them.
As targets of attacks we examine routers, links, the protocol
infrastructure, and popular applications. We explore the different
forms of attacks: probes, denial of service, worms, spam etc. For
each of the attacks, we examine a range of solutions. While there have
been legal and social solutions offered, we concentrate on the
technical portion of the solution space ranging from prevention,
establishing identity, intrusion and anomaly detection, deflection,
filtering, and traceback. The tutorial covers the lower and
higher layers of the Internet protocol stack. Examples at all layers
will be used to indicate similarities both in the attacks and the
proposed solutions.
Outline:
- Tutorial
overview
- Scope
of the tutorial, takeaways, definitions
- Types
of unwanted traffic
- Targets
of unwanted traffic
- Forms
of unwanted traffic
- Attacks
- part I
- TCP
misbehavior
- Routers
Attacks
- Dential
of Service Attacks
- Attacks
- part II
- Peer-to-Peer
- Viruses
& worms
- Spam
- Combination
attacks
- Detection
methods
- Intrusion
detection
- Anomaly
detection
- Audits
& traceback
- Overview
of countermeasures
- Classes
of solutions
- Legal/social
- Technical
- Impact
of solutions
- Countermeasures
-- part I
- Firewalls
- Pushback
- Overlays
- Establishing
Identity
- Countermeasures
-- part II
- Spam
fighting solutions
- Novel
solutions in specific applications
- Economic
disincentives for spam
- Attacking
free rider problem (eMule)
- Impact
on privacy
- Future
Audience:
Students
involved in research in related areas, practitioners who want a state
of the
art survey of proposed solutions along with their evaluation, and
industry folks
who are dealing with the problem of unwanted packets daily. No
background is
expected except some basics of networking.
Biographies:
Dina Katabi is an Assistant Professor in
the Department of Electrical Engineering and Computer Science and a
member of
the Computer Science and Artificial Intelligence Laboratory (CSAIL) at
MIT. She
received her PhD and MS from MIT in 2003 and 1999, and her Bachelor of
Science
from Damascus
University
in 1995. Her doctoral
dissertation won a Sprowls award and an ACM Honorable Mention award.
She is a
co-chair of the SIGCOMM workshop on Practice and Theory of Incentives
in
Networked Systems (PINS).
Balachander
Krishnamurthy has published nearly
sixty papers in various conferences, has more than a dozen patents, and
has
given invited lectures in over thirty countries. He has given tutorials
at
SIGCOMM, WWW, and several other venues. He has co-written and edited a
book on
UNIX, and was series editor of the “Trends in Software” series of
books. He
co-authored “Web Protocols and Practice: HTTP/1.1, Networking
Protocols, Caching,
and Traffic Measurement” (Addison-Wesley, transla-ted into Portuguese,
Japanese, and Russian). He is on the editorial board of ACM TOIT and
SIGCOMM
CCR, and on the Steering Commit-tee of the Internet Measurement
Conference that
he helped start.
Architectural
Considerations for Unusual and Challenged Internetworks
Dr. Kevin
Fall,
Intel Research Berkeley.
Robert Durst, The MITRE Corporation.
Friday, September 3, 9:00-5:00
Summary:
The current Internet architecture
has scaled beyond the wildest dreams of its designers. However, it has
a number
of significant problems when employed to fulfill service requirements
or when
applied to some classes of networks for which it was not originally
designed. In this tutorial we will investigate
the unique performance characteris-tics of some specialized networks
that
present significant challenges for supporting the Internet
architecture. We shall approach this investiga-tion with a
focus on the architectural consequen-ces of these
characteristics. We will conclude with a review of the Delay
Tolerant Networking Architecture and its architectural approach to
handle these
types of networks.
Outline:
- Introduction
- Reviewing the Internet Architecture
- The
Internet Model in Challenged Environments
- TCP with large RTTs or high loss
- DNS and application time-outs and
related problems
- Performance enhancing proxies
- Protocol modifications
- Issues with naming and
interoperability
- Some
Interesting Challenged Environments
- Sensor Networks
- ZebraNet
- Deep Space Network
- Military Style Ad-hoc networks
- Acoustic underwater networks
- Sneakernet-type approaches (DakNet,
Wizzy Courier)
- Elements
of Delay and Disruption Tolerance
- Naming and interoperability
- Store and forward operation
- Reliability
- Routing
- Security
- Application interface
- Bundling
Protocol and API Overview
- Status
and Futures
- Other
efforts in related areas and status
- Unsolved
problems/research areas
- Potential
applications
Audience:
Researchers, network architects, and
protocol
implementers from government, academia or industry interested in the
performance characteristics of unusual networks (sensor networks,
epidemically-routed networks, space networks, battlefield ad-hoc
networks, etc.)
and how to interconnect them.
Biographies:
Kevin Fall, PhD
1994 from UC San Diego, is a Research Scientist
at Intel Research in Berkeley,
CA. He
is presently chair of the IRTF Delay
Tolerant Networking Research Group (DTNRG).
In collabora-tion with researchers at UC Berkeley, he is involved in a
new project aimed at developing information and communication
technologies for
developing regions of the world. Prior
to his arrival at Intel, he was a co-founder of NetBoost Corporation,
and an adjunct professor at UC Berkeley.
Robert C. Durst is a
Senior Principal Network Engineer
at The MITRE Corporation in McLean, VA.
He is a member of the IRTF Delay Tolerant
Networking Research Group, and is director of the Space Internetworking
Services area of the Consultative Committee for Space Data Systems, a
standards
organization addressing spacecraft communication and information
systems. Mr. Durst is involved with mobile ad hoc
networking for military tactical communication systems, and was the
lead
designer for the Space Communication Protocol Standards (SCPS)
enhancements to
TCP and for the SCPS Network Protocol.
He holds a BSEE from the University
of Missouri.
|