Network Measurements

1.1 PRACTICAL: Data usage in scientific publications about the Internet

Researchers have been studying Internet Measurement problems, in conferences like ACM SIGCOMM Internet Measurement Conference (IMC), for more than 10 years now. This project will do a macroscopic study on what data are used by related scientific publications in the last decade and for which purpose. It will study a number of papers published in IMC and will answer questions like what type of data the authors are using? Were the data private or public? Were the data anonymized? Which was the source of the data? For which purpose the data were used? This study will enable us to derive some macroscopic statistics on how data are used in scientific publications studying the Internet.

• Compile a list of questions (with the help of the Lecturer) that will be answered.
• Manually skim through 30-50 papers published in IMC and will answer the list of questions. For this task it will not be necessary to read each paper in detail, but most likely only a specific section for each paper describing the used data.
• Compute some aggregate statistics on the used data.

1.2 PRACTICAL: Anomaly Extraction

Recent research by the Communication Systems Group of ETH Zurich has highlighted that frequent item-set mining, a simple, well-known, and widely-used data mining method, is very effective in finding the root-cause of network anomalies [3, 4] observed in network traffic flow data. This project will evaluate the performance in terms of running time and memory consumption of a selection of different publically-available implementations of frequent item-set mining algorithms available in [2]. It will use a trace of traffic flows and it will establish which implementation (and associated algorithm) is better suited to extract frequent item-sets from traffic flow data.

• Learn what frequent item-set mining and associated rule learning are from [1].
• Select (in coordination with the Lecturer) a set of 4-6 frequent item-set mining implementations that will be evaluated.
• Execute simple tests to measure the performance of the implementations in terms of running time and memory consumption using a trace that will be provided by the Lecturer.
• Summarize and present findings.

1. Association Rule Learning
2. Frequent Itemset Mining Implementations Repository
3. D. Brauckhoff, X. Dimitropoulos, A. Wagner, K. Salamatian, Anomaly Extraction in Backbone Networks using Association Rules, ACM IMC 2009.
4. I. Paredes-Oliva, X. Dimitropoulos, M. Molina, P. Barlet-Ros, D. Brauckhoff, Automating Root-Cause Analysis of Network Anomalies using Frequent Itemset Mining, ACM SIGCOMM 2010.

1.3 THEORETICAL: Mediated Data Analysis

Recently, mediated data analysis has been proposed as an approach to enable researchers by-pass legal complexities associated with accessing data. A mediator, i.e., usually the data owner, conducts part of the analysis on behalf of a researcher and manually or automatically evaluates if the results of the analysis reveal any private information. A number of different techniques, like secure queries [2] and differential privacy [4], have been proposed to measure or limit the amount of private information revealed by the output of the analysis. This project will survey four recent papers on this subject [1, 2, 3, 4], will study the technical approaches taken, will identify limitations and advantages, and will compare them.

• Read and understand the techniques proposed in the four papers.
• Identify limitations and advantages for each technique and compare the four alternatives.
• Compile a short survey describing their findings.

1. J. C. Mogul and M. F. Arlitt. SC2D: An alternative to trace anonymization, MineNet Workshop 2006.
2. J. Mirkovic. Privacy-safe network trace sharing via secure queries, Workshop on Network Data Anonymization, 2008.
3. P. Mittal, V. Paxson, R. Summer, and M. Winterrowd. Securing mediated trace access using black-box permutation analysis, HotNets, 2009.
4. F. McSherry and R. Mahajan. Differentially-Private Network Trace Analysis, ACM SIGCOMM 2010.

1.4 PRACTICAL: Traffic analysis

Obtain at least 5 packet-level traces from the WIDE backbone. The set of selected traces should cover different years and include different sampling points. Merge the observed packets to flows where a flow is identified by IP address, port number, and protocol number. Afterwards compute flow-level statistics and plots that include at least: distribution/CDF of packets per flow, distribution of bytes per flow. Moreover, try to identify changes over the years. Finally, we ask you to record a packet-level trace on your laptop/desktop (e.g., over one hour) that captures your normal usage. Analyze this trace and compare with results from the WIDE traces. To complete the project: Describe your results in a short report and present your experiences, and your analysis in class.

1.5 THEORETICAL: Internet Background Radiation

Read at least the three provided paper. Imagine you are a professor and you have to present this topic to students: how would you summarize these three papers? how are they related to each other? What is your opinion on this topic? Write a survey report on this topic and present the results in class.

• Internet Background Radiation Revisited
• Network Telescopes
• Characteristics of Internet Background Radiation
• A Brief History of Scanning