FACT: Flow-Based Approach for Connectivity Tracking

Schatzmann, Dominik; Leinen, Simon; Kögel, Jochen; Mühlbauer, Wolfgang

doi:10.1007/978-3-642-19260-9_22

Cited by 11 publications

(14 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, these approaches typically rely on anomaly detection techniques for discovering, e.g., prefix hijacking, and are prone to false positives. Passive measurements from the data plane leverage user traffic, like in FACT [31] and Crowdsourcing Event Monitoring [9]. To exploit the benefits of active and passive measurements, some systems combine both approaches.…”

Section: Network Outage Monitoring Systemsmentioning

confidence: 99%

“…Monitoring systems using this architecture detect Internet-wide (or global) outages, which may be irrelevant for some domains. In contrast, some monitoring system, such as FACT [31], only monitor the traffic of a domain (i.e., ISP or AS) and the decision making process is performed by the same domain. While this means that only relevant outages are detected, the sys-tem cannot determine whether the outage is limited to a domain or is more widespread.…”

Section: Network Outage Monitoring Systemsmentioning

confidence: 99%

“…A number of recent studies have identified passive network traffic measurements as a new, promising data source for detecting and measuring the impact of network outages [31,17,12]. These approaches analyze network traffic over time to identify changes in the traffic signal observed from different networks.…”

Section: Passive Monitoring With Factmentioning

confidence: 99%

“…Compared to the traditional approach of running active measurements, they leverage an existing rich data source, i.e., the innate traffic of a network, without introducing additional probing. In this work we exploit in particular the tool introduced in the Flow-based Approach for Connectivity Tracking (FACT) [31], which is based on passive flow-level traffic measurements.…”

Section: Passive Monitoring With Factmentioning

confidence: 99%

“…First, we propose Multi-FACT, a novel system for detecting the scope and severity of network outages by aggregating traffic data from multiple domains, while preserving the privacy of the source data. Multi-FACT builds on earlier work on the Flow-based Approach for Connectivity Tracking (FACT) [31]. It enables multi-domain collaboration, while keeping confidential all associations between domains and the destinations towards which they experience outages.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Federated flow-based approach for privacy preserving connectivity tracking

Djatmiko¹,

Schatzmann

Dimitropoulos

et al. 2013

Proceedings of the Ninth ACM Conference on Emerging Networking Experiments and Technologies

Self Cite

View full text Add to dashboard Cite

Network outages are an important issue for Internet Service Providers (ISPs) and, more generally, online service providers, as they can result in major financial losses and negatively impact relationships with their customers. Troubleshooting network outages is a complex and time-consuming process. Network administrators are overwhelmed with large volumes of monitoring data and are limited to using very basic tools for debugging, e.g., ping and traceroute. Intelligent correlation of measurements from different Internet locations is very useful for analyzing the root cause of outages. However, correlating measurements of user traffic across domains is largely avoided as it raises privacy concerns. A possible solution is secure multi-party computation (MPC), a set of cryptographic methods that enable a number of parties to aggregate data in a privacy-preserving manner. In this work, we describe a novel system that helps diagnose network outages by correlating passive measurements from multiple ISPs in a privacy-preserving manner. We first show how MPC can be used to compute the scope (local, global, or semi-global) and severity (number of affected hosts) of network outages. To meet near-real-time monitoring guarantees, we then present an efficient protocol for MPC multiset union that uses counting Bloom filters (CBF) to drastically accelerate MPC comparison operations. Finally, we demonstrate the utility of our scheme using real-world traffic measurements from a national ISP and we discuss the trade-offs of the CBF-based computation.

show abstract

Section: Network Outage Monitoring Systemsmentioning

confidence: 99%

Section: Network Outage Monitoring Systemsmentioning

confidence: 99%

Section: Passive Monitoring With Factmentioning

confidence: 99%

Section: Passive Monitoring With Factmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Federated flow-based approach for privacy preserving connectivity tracking

Djatmiko¹,

Schatzmann

Dimitropoulos

et al. 2013

Proceedings of the Ninth ACM Conference on Emerging Networking Experiments and Technologies

Self Cite

View full text Add to dashboard Cite

show abstract

Measuring Cloud Service Health Using NetFlow/IPFIX: The WikiLeaks Case

et al. 2013

View full text Add to dashboard Cite

The increasing trend of outsourcing services to cloud providers is changing the way computing power is delivered to enterprises and end users. Although cloud services offer several advantages, they also make cloud consumers strongly dependent on providers. Hence, consumers have a vital interest to be immediately informed about any problems in their services. This paper aims at a first step toward a network-based approach to monitor cloud services. We focus on severe problems that affect most services, such as outages or extreme server overload, and propose a method to monitor these problems that relies solely on the traffic exchanged between users and cloud providers. Our proposal is entirely based on NetFlow/IPFIX data and, therefore, explicitly targets high-speed networks. By combining a methodology to reassemble and classify flow records with stochastic estimations, our proposal has the distinct characteristic of being applicable to both sampled and non-sampled data. We validate our proposal and show its applicability using data collected at both the University of Twente and an international backbone during the WikiLeaks Cablegate. Our results show that, in contrast to Anonymous' claims, the users of the targeted services have been only marginally affected by the attacks.

show abstract