LANDER: Los Angeles Network Data Exchange and Repository

Project Summary

The LANDER project was active from 2004-2007, with the LANDER-2007 project following on from 2007-2013. Although that work has completed, similar work continues on [the LACREND project](../lacrend/index.html).

The LANDER project participates as a data provider and a data-hosting site under the PREDICT program. LANDER will provide the research community with a rich set of high-quality network data, including traffic traces and network topology information. The ultimate goal of this work is to enable new research and improvements in network security.

LANDER is a joint research effort of USC's Information Sciences Institute, Computer Science Department, and Information Technology Services and is supported by the DHS PREDICT program through contract NBCHC040137 (2004-2007) and NBCHC080035 (2007-2017).

People

• Joseph Bannister, researcher and division director (USC/ISI)
• Genevieve Bartlett, researcher (USC CS Dept. and ISI)
• Xue Cai, USC CS PhD graduate (2013) (USC CS Dept. and ISI)
• Maureen Dougherty, project lead and director of USC HPC (USC Information Technology Services)
• Xun Fan, USC CS PhD graduate (2015) (USC CS Dept. and ISI)
• Xinming He, USC CS PhD graduate (2006) (USC CS Dept.)
• John Heidemann, PI on this project, project leader and professor (USC/ISI)
• Alefiya Hussain, USC CS PhD graduate (2005) (USC CS Dept. and ISI)
• Christos Papadopoulos, co-PI on this project, professor (University of Memphis) christos.papadopoulos (at) memphis.edu
• Jim Peppin, researcher and director of USC HPC (USC Information Technology Services)
• Lin Quan, USC CS PhD graduate (2014) (USC CS Dept. and ISI)
• Ramachandran Ramani, USC EE MS graduate (2005) (USC EE Dept.)
• Jenny Sager, PhD student (USC CS Dept. and ISI)
• Fabio Silva, researcher (USC/ISI)

Publications

• Wouter B. de Vries, Ricardo de O. Schmidt, Wes Hardaker, John Heidemann, Pieter-Tjerk de Boer and Aiko Pras 2017. Verfploeter: Broad and Load-Aware Anycast Mapping. Proceedings of the ACM Internet Measurement Conference (London, UK, 2017), 477–488. [DOI] [PDF] [Dataset] Details
• Jelena Mirkovic, Genevieve Bartlett, John Heidemann, Hao Shi and Xiyue Deng 2017. Do You See Me Now? Sparsity in Passive Observations of Address Liveness. IEEE International Conference on Traffic Monitoring and Analysis (Dublin, Ireland, Jul. 2017), 1–9. [DOI] [PDF] Details
• Wouter B. de Vries, Ricardo de O. Schmidt, Wes Hardaker, John Heidemann, Pieter-Tjerk de Boer and Aiko Pras 2017. Verfploeter: Broad and Load-Aware Anycast Mapping. Technical Report ISI-TR-719. USC/Information Sciences Institute. [PDF] [Dataset] Details
• Ricardo de O. Schmidt, John Heidemann and Jan Harm Kuipers 2017. Anycast Latency: How Many Sites Are Enough? Proceedings of the Passive and Active Measurement Workshop (Sydney, Australia, Mar. 2017), to appear. [PDF] Details
• Giovane C. M. Moura, Ricardo de O. Schmidt, John Heidemann, Wouter B. de Vries, Moritz Müller, Lan Wei and Christian Hesselman 2016. Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event. Proceedings of the ACM Internet Measurement Conference (Nov. 2016). [DOI] [PDF] Details
• Jelena Mirkovic, Genevieve Bartlett, John Heidemann, Hao Shi and Xiyue Deng 2016. Do You See Me Now? Sparsity in Passive Observations of Address Liveness (extended). Technical Report ISI-TR-2016-710. USC/Information Sciences Institute. [PDF] Details
• Giovane C. M. Moura, Ricardo de O. Schmidt, John Heidemann, Wouter B. de Vries, Moritz Müller, Lan Wei and Christian Hesselman 2016. Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event (extended). Technical Report ISI-TR-2016-709b. USC/Information Sciences Institute. [PDF] Details
• Ricardo de O. Schmidt, John Heidemann and Jan Harm Kuipers 2016. Anycast Latency: How Many Sites Are Enough? Technical Report ISI-TR-2016-708. USC/Information Sciences Institute. [PDF] Details
• Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels and P. Hoffman 2016. Specification for DNS over Transport Layer Security (TLS) . Technical Report 7858. Internet Request For Comments. [DOI] [PDF] Details
• Lin Quan, John Heidemann and Yuri Pradkin 2014. Visualizing Sparse Internet Events: Network Outages and Route Changes. Computing. 96, 1 (Jan. 2014), 39–51. [DOI] [PDF] Details
• Alefiya Hussain, Yuri Pradkin and John Heidemann 2013. Replay of Malicious Traffic in Network Testbeds. Proceedings of the 13th IEEE Conference on Technologies for Homeland Security (HST) (Waltham, Massachusetts, USA, Nov. 2013), (to appear). [PDF] Details
• John Heidemann 2013. Evaluating Anycast in the Domain Name System. Presentation at DNS-OARC Meeting. [PDF] Details
• Xun Fan, John Heidemann and Ramesh Govindan 2013. Evaluating Anycast in the Domain Name System. Proceedings of the IEEE Infocom (Turin, Italy, Apr. 2013), 1681–1689. [PDF] Details
• Lin Quan, John Heidemann and Yuri Pradkin 2013. Poster Abstract: Towards Active Measurements of Edge Network Outages. Proceedings of the Passive and Active Measurement Workshop (Hong Kong, China, Mar. 2013), 276–279. [DOI] [PDF] Details
• John Heidemann 2013. Long-term Data Collection and Analysis of Outages at the Edge. Talk given at CAIDA Workshop on Active Internet Measurement Systems. [PDF] Details
• John Heidemann 2013. Active Probing of Edge Networks: Outages During Hurricane Sandy. Talk given at NANOG57 as part of panel hosted by James Cowie. [PDF] Details
• John Heidemann 2013. Active Probing of Edge Networks: Hurricane Sandy and Beyond. Talk given at FCC Workshop on Network Resiliency. [PDF] Details
• John Heidemann 2013. Third-Party Measurement of Network Outages in Hurricane Sandy. Proceedings of the FCC Workshop on Network Resiliency (Brooklyn, New York, USA, Feb. 2013). [PDF] Details
• Lin Quan, John Heidemann and Yuri Pradkin 2013. Visualizing Sparse Internet Events: Network Outages and Route Changes. Computing. (Jan. 2013), to appear. [DOI] [PDF] Details
• John Heidemann, Lin Quan and Yuri Pradkin 2012. A Preliminary Analysis of Network Outages During Hurricane Sandy. Technical Report ISI-TR-2008-685b. USC/Information Sciences Institute. [PDF] Details
• Lin Quan, John Heidemann and Yuri Pradkin 2012. Visualizing Sparse Internet Events: Network Outages and Route Changes. Proceedings of the First ACM Workshop on Internet Visualization (Boston, Mass., USA, Nov. 2012). [PDF] Details
• Xue Cai, John Heidemann, Balachander Krishnamurthy and Walter Willinger 2012. An Organization-Level View of the Internet and its Implications (Extended). Technical Report ISI-TR-2009-679. USC/Information Sciences Institute. [PDF] Details
• Xun Fan, John Heidemann and Ramesh Govindan 2012. Characterizing Anycast in the Domain Name System. Technical Report ISI-TR-2011-681. USC/Information Sciences Institute. [PDF] Details
• Lin Quan, John Heidemann and Yuri Pradkin 2012. Detecting Internet Outages with Precise Active Probing (extended). Technical Report ISI-TR-2012-678b. USC/Information Sciences Institute. [PDF] Details
• Xun Fan, John Heidemann and Ramesh Govindan 2011. Identifying and Characterizing Anycast in the Domain Name System. Technical Report ISI-TR-2011-671. USC/Information Sciences Institute. [PDF] Details
• Lin Quan and John Heidemann 2011. Detecting Internet Outages with Active Probing (extended). Technical Report ISI-TR-2011-672. USC/Information Sciences Institute. [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2011. Low-Rate, Flow-Level Periodicity Detection. Proceedings of the 14th IEEE Global Internet Symposium (Shanghai, China, Apr. 2011), 804–809. [DOI] [PDF] Details
• Xun Fan and John Heidemann 2010. Selecting Representative IP Addresses for Internet Topology Studies. Proceedings of the ACM Internet Measurement Conference (Melbourne, Australia, Nov. 2010), 411–423. [DOI] [PDF] Details
• Lin Quan and John Heidemann 2010. On the Characteristics and Reasons of Long-lived Internet Flows. Proceedings of the ACM Internet Measurement Conference (Melbourne, Australia, Nov. 2010), 444–450. [DOI] [PDF] Details
• Gautam Thatte, Urbashi Mitra and John Heidemann 2010. Parametric Methods for Anomaly Detection in Aggregate Traffic. ACM/IEEE Transactions on Networking. 19, 2 (Aug. 2010), 512–525. [DOI] [PDF] Details
• Xun Fan and John Heidemann 2010. Selecting Representative IP Addresses for Internet Topology Studies. Technical Report ISI-TR-2010-666. USC/Information Sciences Institute. [PDF] Details
• John Heidemann 2010. Mapping the Internet to Assist Cyber-Defense. Invited talk at Spring Electronic Crimes Task Force Meeting. [PDF] Details
• Lin Quan and John Heidemann 2010. On the Characteristics and Reasons of Long-lived Internet Flows (extended). Technical Report ISI-TR-2010-667. USC/Information Sciences Institute. [PDF] Details
• Chris Wilcox, Christos Papadopoulos and John Heidemann 2010. Correlating Spam Activity with IP Address Characteristics. Proceedings of the IEEE Global Internet Symposium (San Diego, California, USA, Mar. 2010), 1–6. [DOI] [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2009. Using Low-Rate Flow Periodicities for Anomaly Detection: Extended. Technical Report ISI-TR-2009-661. USC/Information Sciences Institute. [PDF] Details
• John Heidemann and Christos Papadopoulos 2009. Uses and Challenges for Network Datasets. Proceedings of the IEEE Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH) (Washington, DC, USA, Mar. 2009), 73–82. [DOI] [PDF] Details
• Xue Cai and John Heidemann 2009. Understanding Address Usage in the Visible Internet. Technical Report ISI-TR-2009-656. USC/Information Sciences Institute. [PDF] Details
• John Heidemann 2009. USC/LANDER Passive and Active Data Collection. Lightning talk at CAIDA AIMS Workshop. [PDF] Details
• John Heidemann, Yuri Pradkin, Ramesh Govindan, Christos Papadopoulos, Genevieve Bartlett and Joseph Bannister 2008. Census and Survey of the Visible Internet. Proceedings of the ACM Internet Measurement Conference (Vouliagmeni, Greece, Oct. 2008), 169–182. [PDF] Details
• Xue Cai and John Heidemann 2008. Active Probing to Classify Internet Address Blocks (poster abstract). Proceedings of the ACM SIGCOMM Conference (Seattle, Washington, USA, Aug. 2008), to appear. [PDF] Details
• Xue Cai and John Heidemann 2008. Active Probing to Classify Internet Address Blocks (poster abstract). Technical Report ISI-TR-2008-653. USC/Information Sciences Institute. [PDF] Details
• John Heidemann, Yuri Pradkin, Ramesh Govindan, Christos Papadopoulos, Genevieve Bartlett and Joseph Bannister 2008. Census and Survey of the Visible Internet (extended). Technical Report ISI-TR-2008-649b. USC/Information Sciences Institute. [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2007. Understanding Passive and Active Service Discovery. Proceedings of the ACM Internet Measurement Conference (San Diego, California, USA, Oct. 2007), to appear. [PDF] Details
• John Heidemann and Yuri Pradkin 2007. Mapping the Internet Address Space (Poster). (Aug. 2007). [Dataset] Details
• Genevieve Bartlett, John Heidemann, Christos Papadopoulos and James Pepin 2007. Estimating P2P Traffic Volume at USC. Technical Report ISI-TR-2007-645. USC/Information Sciences Institute. [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2007. Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing. Proceedings of the 10th IEEE Global Internet Symposium (Anchorage, Alaska, USA, May 2007). [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2007. Understanding Passive and Active Service Discovery (extended). Technical Report ISI-TR-2007-642. USC/Information Sciences Institute. [PDF] Details
• Genevieve Bartlett, John Heidemann and Christos Papadopoulos 2006. Inherent Behaviors for On-line Detection of Peer-to-Peer File Sharing (extended). Technical Report ISI-TR-2006-627. USC/Information Sciences Institute. [PDF] Details
• Alefiya Hussain, John Heidemann and Christos Papadopoulos 2006. Identification of Repeated Denial of Service Attacks. Proceedings of the IEEE Infocom (Barcelona, Spain, Apr. 2006), to appear. [PDF] Details
• Alefiya Hussain, Genevieve Bartlett, Yuri Pryadkin, John Heidemann, Christos Papadopoulos and Joseph Bannister 2005. Experiences with a Continuous Network Tracing Infrastructure. Proceedings of the ACM SIGCOMM MineNet Workshop (Philadelphia, PA, USA, Aug. 2005), 185–190. [PDF] Details
• Alefiya Hussain, Genevieve Bartlett, Yuri Pryadkin, John Heidemann, Christos Papadopoulos and Joseph Bannister 2005. Experiences with a Continuous Network Tracing Infrastructure. Technical Report ISI-TR-2005-601. USC/Information Sciences Institute. [PDF] Details
• Rishi Sinha, Christos Papadopoulos and John Heidemann 2005. Fingerprinting Internet Paths using Packet Pair Dispersion. Technical Report 06-876. University of Southern California Computer Science Department. [PDF] Details

For related publications, please see the ANT publications web page.

Software

See also ANT software.

• cryptopANT C/C++ Library/tool for IP address anonymization
• dag scrubber Tool for scrubbing packet traces
• dag trace generator The DAG Trace generator is a collection of tools for parsing a DAG formatted packet header trace. (Please see the enclosed README for instructions.)
• icmptrain Rapid probing of IPv4.
• icmptrain-hadoop-reader Hadoop reader/format for census/survey data
• IP Hitlist Generation Scripts for IP Hitlist generation
• LANDER Trace Software LANDER Trace Capture software handles for packet capture, scrubbing, and triggering user-provided scripts
• lonlat2color A tiny utility to convert coordinates to color
• mtracecap packet capture tool
• outage_adaptive_geolocation Scripts we run to geolocate our outage_adaptive datasets
• print_datafile tool for decoding census/survey data
• stream_merger traffic stream merger

Traces

Details to follow.

Related Links

ANT: the Analysis of Network Traffic research group