Retro-Future Bridge and Outages

Project Summary

Retro-future Bridge and Outages builds on two existing projects: Retro-Future Project and Detecting and Understanding Outages in the Internet (DUOI).

The Retro-Future Project is developing an Internet DVR that can provide time-travel over network data to assist assessing network security problems such as post-facto analysis of zero-day attacks and insider threats. Its technical challenges are how to be efficient, maximizing the effective history that is saved, to be cost-effective commodity hardware and software, and most importantly, to accommodate permission and privacy constraints that are necessary to deploy this system.

DUOI builds on the Trinocular system of Internet outage detection.

The outcome of this project is to assist in technology transfer of both of these efforts. We are working to support Retro-future technology with several groups, and to improve outage detection to report outages in near-real time and additional validation.

This project is carried out at USC’s Information Sciences Institute.

Support

This work is supported by the Department of Homeland Security (DHS) Science and Technology Directorate, Cyber Security Division (DHS S&T/CSD) via contract number HHSP233201600010C.

The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the Department of Homeland Security.

People

John Heidemann, PI on this project, project leader and professor (USC/ISI)
Christos Papadopoulos, co-PI on this project, professor (University of Memphis) christos.papadopoulos (at) memphis.edu
Yuri Pradkin, researcher (USC/ISI)

Publications

Lan Wei and John Heidemann 2020. Whac-A-Mole: Six Years of DNS Spoofing. Technical Report arXiv:2011.12978v1. USC/ISI. [PDF] Details
Abdul Qadeer and John Heidemann 2019. Plumb: Efficient Processing of Multi-User Pipelines (Poster). USC/Information Sciences Institute. [PDF] Details
Liang Zhu and John Heidemann 2018. LDplayer: DNS Experimentation at Scale. Proceedings of the ACM Internet Measurement Conference (Boston, Massachusetts, USA, Oct. 2018), to appear. [DOI] [PDF] [Code] Details
Abdul Qadeer and John Heidemann 2018. Plumb: Efficient Processing of Multi-User Pipelines (Poster Abstract). Proceedings of the Symposium on Cloud Computing (Carlsbad, CA, USA, Oct. 2018), 519. [DOI] [PDF] Details
Abdul Qadeer and John Heidemann 2018. Plumb: Efficient Processing of Multi-Users Pipelines (Extended). Technical Report ISI-TR-727. USC/Information Sciences Institute. [PDF] Details
Hang Guo and John Heidemann 2018. IP-Based IoT Device Detection. Proceedings of the ACM SIGCOMM Workshop on IoT Security and Privacy (Budapest, Hungary, Aug. 2018), 36–42. [DOI] [PDF] [Dataset] Details
Calvin Ardi and John Heidemann 2018. Leveraging Controlled Information Sharing for Botnet Activity Detection. Proceedings of the ACM SIGCOMM Workshop on Traffic Measurements for Cybersecurity (Budapest, Hungary, Aug. 2018), 14–20. [DOI] [PDF] Details
John Heidemann 2018. Internet Outages: Reliablity and Security. Invited talk at University of Oregon Cybersecurity Day. [PDF] Details
Hang Guo and John Heidemann 2018. Detecting ICMP Rate Limiting in the Internet. Proceedings of the Passive and Active Measurement Workshop (Berlin, Germany, Mar. 2018), to appear. [PDF] Details
John Heidemann 2018. Outage Clustering: From Leaves to Trees. Talk at CAIDA Active Internet Measurement Workshop (AIMS). [PDF] Details
Basileal Imana, Aleksandra Korolova and John Heidemann 2018. Enumerating Privacy Leaks in DNS Data Collected Above the Recursive. Proceedings of the ISOC NDSS Workshop on DNS Privacy (San Diego, California, USA, Feb. 2018). [PDF] [Dataset] Details
Lan Wei and John Heidemann 2018. Does Anycast Hang up on You (UDP and TCP)? IEEE Transactions on Network and Service Management. 15, 2 (Feb. 2018), 707–717. [PDF] Details
John Heidemann 2018. Internet Reliability, from Addresses to Outages. Talk at MIT CSAIL. [PDF] Details
John Heidemann, Yuri Pradkin and Aqib Nisar 2018. Back Out: End-to-end Inference of Common Points-of-Failure in the Internet (extended). Technical Report ISI-TR-724. USC/Information Sciences Institute. [PDF] Details
Liang Zhu and John Heidemann 2017. LDplayer: DNS Experimentation at Scale. Technical Report 722. USC/Information Sciences Institute. [PDF] [Code] Details
Wouter B. de Vries, Ricardo de O. Schmidt, Wes Hardaker, John Heidemann, Pieter-Tjerk de Boer and Aiko Pras 2017. Verfploeter: Broad and Load-Aware Anycast Mapping. Proceedings of the ACM Internet Measurement Conference (London, UK, 2017), 477–488. [DOI] [PDF] [Dataset] Details
Moritz Müller, Giovane C. M. Moura, Ricardo de O. Schmidt and John Heidemann 2017. Recursives in the Wild: Engineering Authoritative DNS Servers. Proceedings of the ACM Internet Measurement Conference (London, UK, 2017), 489–495. [DOI] [PDF] [Dataset] Details
Kensuke Fukuda, John Heidemann and Abdul Qadeer 2017. Detecting Malicious Activity with DNS Backscatter Over Time. ACM/IEEE Transactions on Networking. 25, 5 (Aug. 2017), 3203–3218. [DOI] [PDF] [Dataset] Details
Lan Wei and John Heidemann 2017. Does Anycast Hang up on You? IEEE. [DOI] [PDF] Details
John Heidemann 2017. Digging in to Ground Truth in Network Measurements. Talk at the Network Traffic Measurement and Analysis PhD School. [PDF] Details
Moritz Müller, Giovane C. M. Moura, Ricardo de O. Schmidt and John Heidemann 2017. Recursives in the Wild: Engineering Authoritative DNS Servers. Technical Report ISI-TR-720. USC/Information Sciences Institute. [PDF] Details
Wouter B. de Vries, Ricardo de O. Schmidt, Wes Hardaker, John Heidemann, Pieter-Tjerk de Boer and Aiko Pras 2017. Verfploeter: Broad and Load-Aware Anycast Mapping. Technical Report ISI-TR-719. USC/Information Sciences Institute. [PDF] [Dataset] Details
Hang Guo and John Heidemann 2017. Detecting ICMP Rate Limiting in the Internet (extended). Technical Report ISI-TR-717. USC/Information Sciences Institute. [PDF] Details
John Heidemann 2017. Collecting and Visualizing Outages Over the Long Haul. Talk at CAIDA Active Internet Measurement Workshop (AIMS). [PDF] Details
Lan Wei and John Heidemann 2017. Does Anycast Hang up on You? (extended). Technical Report ISI-TR-716. USC/Information Sciences Institute. [PDF] Details
Abdulla Alwabel, John Healy, John Heidemann, Brian Luu, Yuri Pradkin and Rasoul Safavian. 2015. Evaluating Externally Visible Outages. Technical Report ISI-TR-701. USC/Information Sciences Institute. [PDF] Details

For related publications, please see the ANT publications web page.

Software

LANDER Trace Software LANDER Trace Capture software handles for packet capture, scrubbing, and triggering user-provided scripts
timefind and indexer Software to handle indexing and selection of multiple network data types based on a given time range.
verfploeter/packetcapr A pinger for active measurement of anycast catchements.
verfploeter/pingextract A ping analyzer for active measurement of anycast catchements.

Datasets

We some datasets from this project available.