NETSEC

Internet Routing Forensics, funded by NSF

Under the IRF umbrella, we study a list of topics related to Internet routing, particularly the Border Gateway Protocol (BGP) -- the de facto inter-domain routing protocol on the Internet.

Our primary goal in this research is to systematically monitor, classify, and quantify the impact on BGP from disruptive events such as power outage or security attacks. In addition, we study BGP dynamics, as well as the relationship between the Internet control plane and Internet data plane.

Our publications include the following:

• Mingwei Zhang, Jun Li, and Scott Brooks, "I-seismograph: Observing, Measuring, and Analyzing Internet Earthquakes," University of Oregon, Computer and Information Science Department, Technical Report CIS-TR-2017-01, July, 2017.
• Jun Li and Scott Brooks, "I-seismograph: Observing and measuring Internet earthquakes," in Infocom 2011, April 2011, p. 9 pages. Paper, Slides.
• Jun Li, Dejing Dou, Zhen Wu, Shiwoong Kim, and Vikash Agarwal, "An Internet routing forensics framework for discovering rules of abnormal BGP events," ACM SIGCOMM Computer Communication Review, vol. 35, no. 5, pp. 55-66, October 2005.
• Jun Li, Michael Guidero, Zhen Wu, Eric Purpus, and Toby Ehrenkranz, "BGP routing dynamics revisited," ACM SIGCOMM Computer Communication Review, vol. 37, no. 2, pp. 7-16, April 2007.
• Jun Li, Zhen Wu, and Eric Purpus, "Toward understanding the behavior of BGP during large-scale power outages," in IEEE GLOBECOM, San Francisco, CA, November 2006, 5 pages.
• Zhen Wu, Eric S. Purpus, and Jun Li, "BGP behavior analysis during the August 2003 blackout," in The 9th IFIP/IEEE International Symposium on Integrated Network Management, Nice, France, May 2005, 4 pages (short paper).
• Matthew Roughan, Jun Li, Randy Bush, Zhuoqing Mao, and Timothy Griffin, "Is BGP update storm a sign of trouble: Observing the Internet control and data planes during Internet worms," in Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS), Calgary, Canada, July 2006, vol. 38, pp. 535-542.
• Jun Li, Randy Bush, Zhuoqing Mao, Timothy Griffin, Matthew Roughan, Daniel Stutzbach, and Eric Purpus, "Watching data streams toward a multi-homed sink under routing changes introduced by a BGP beacon," in Passive and Active Measurement Conference, Adelaide, Australia, March 2006, acceptance rate 25.6% (21/82).
• Dejing Dou, Jun Li, Han Qin, Shiwoong Kim, and Sheng Zhong, "Understanding and utilizing the hierarchy of abnormal BGP events," in SIAM International Conference on Data Mining, Minneapolis, Minnesota, April 2007, pp. 457-462 (short paper), acceptance rate 24.8% (36 full papers and 39 short papers are accepted, 302 submissions).
• Jun Li, Dejing Dou, Shiwoong Kim, Han Qin, and Yibo Wang, "On knowledge-based classification of abnormal BGP events," in International Conference on Information Systems Security, December 2007, pp. 267-271 (short paper).

  This research is supported by the National Science Foundation under Award No. CNS-0520326. Any opinions, findings, and conclusions or recommendations expressed in this research are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.