Router-level Topology Research Articles

AliasClassifier: A High-Performance Router Alias Classifier

The task of router alias resolution for IPv4 networks presents a formidable challenge in the realm of router-level topology inference. Despite the considerable potential exhibited by machine-learning-based alias-resolution methods for IPv4 networks, several constraints impede their effectiveness. These constraints include a low discovery rate of aliased IPs, a failure to account for router aggregation, and a dearth of valid features in current schemes. In this study, we introduce a novel alias resolver, AliasClassifier, which is based on the Random Forest model and the alias triangulation algorithm. This innovative model identifies the key six features from a set of four prevalent routing behaviors that are typically employed to distinguish aliased IPs from non-alienated IPs. Subsequently, the AliasClassifier aggregates aliased IP pairs into routers using an alias triangulation algorithm. Experimental results demonstrate that AliasClassifier excels in discovering aliased IPs in IPv4 networks, boasting a resolution accuracy as high as 94.8% and a recall rate of 40.4%. Its comprehensive performance significantly surpasses that of state-of-the-art alias resolvers such as TreeNET, MLAR, and APPLE. Furthermore, as a typical centralized alias parser, AliasClassifier’s deployment cost is remarkably low. Consequently, AliasClassifier emerges as an ideal tool for router alias resolution in large-scale IPv4 networks.

Digging the Underlying Layers of Intelligent Transportation System Networks by Mobile Crowdsourcing

Understanding the underlying topologies of networks is very important for improving their performance and security, especially in Intelligent Transportation Systems (ITS). Anonymous router identification recognizes and merges anonymous interfaces belonging to the same router in the traceroute measurement data, which is regarded as one of the critical issues for recovering the router-level topologies of networks. In this paper, we studied the problem of recovering the router-level topologies of networks with mobile crowdsourcing and proposed a method based on graph embedding (called <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GE)</monospace> for accurate identification of anonymous network routers from traceroute measurement data. We first use the graph embedding method to capture the connection characteristics of different interfaces of anonymous routers from the traceroute data and then, evaluate the distances between interfaces based on the extracted connection characteristics. Finally, we identify the interfaces that belong to the same anonymous router by using a heuristic maximum likelihood estimation algorithm that we have developed. Compared to the existing methods, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GE</monospace> is more felxible in ITS because it identifies anonymous network routers without requiring manually predefined subgraphs (or patterns). In the evaluation, we simulated a variety of scenarios to generate the measurement data and compared <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GE</monospace> to two state-of-the-art methods (the neighborhood matching method and the graph induction-based method). The results suggest that <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GE</monospace> can significantly improve the accuracy of anonymous router identification (with an average improvement of over 20%) at a slight identification rate loss (less than 4%).

Discovering and Mapping Subnet Level Topology

&lt;p&gt;The research of Internet measurement has promoted the development of router-level topology discovery, while the subnet of the network layer can provide a more detailed intermediate complementary view. To improve the current level of router-level topology discovery, some researchers have proposed subnet discovery methods. However, the existing methods do not perform well in terms of efficiency and accuracy, which leads to the failure of the final resulting topology map. In this paper, we propose a new approach to discover subnets, which consists of a network pre-processing stage and a subnet inference stage. Given a set of target IP prefixes, the network pre-processing stage introduces a minimal probing overhead to improve probing efficiency. Based on the IP address allocation principle, the subnet inference stage utilizes a set of complementary inference rules to infer subnets. The experimental results show that our method can achieve a higher accuracy in discovering subnets while keeping lower probing overhead compared with existing methods. Finally, we utilize the proposed approach to discover the subnets of six geographically dispersed public Autonomous System (AS) networks and analyze their various subnet characteristics, including degree distribution.&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt;

Vrfinder

Current methods to analyze the Internet's router-level topology with paths collected using traceroute assume that the source address for each router in the path is either an inbound or off-path address on each router. In this work, we show that outbound addresses are common in our Internet-wide traceroute dataset collected by CAIDA's Ark vantage points in January 2020, accounting for 1.7% - 5.8% of the addresses seen at some point before the end of a traceroute. This phenomenon can lead to mistakes in Internet topology analysis, such as inferring router ownership and identifying interdomain links. We hypothesize that the primary contributor to outbound addresses is Layer 3 Virtual Private Networks (L3VPNs), and propose vrfinder, a technique for identifying L3VPN outbound addresses in traceroute collections. We validate vrfinder against ground truth from two large research and education networks, demonstrating high precision (100.0%) and recall (82.1% - 95.3%). We also show the benefit of accounting for L3VPNs in traceroute analysis through extensions to bdrmapIT, increasing the accuracy of its router ownership inferences for L3VPN outbound addresses from 61.5% - 79.4% to 88.9% - 95.5%.

Vrfinder

Current methods to analyze the Internet's router-level topology with paths collected using traceroute assume that the source address for each router in the path is either an inbound or off-path address on each router. In this work, we show that outbound addresses are common in our Internet-wide traceroute dataset collected by CAIDA's Ark vantage points in January 2020, accounting for 1.7% - 5.8% of the addresses seen at some point before the end of a traceroute. This phenomenon can lead to mistakes in Internet topology analysis, such as inferring router ownership and identifying interdomain links. We hypothesize that the primary contributor to outbound addresses is Layer 3 Virtual Private Networks (L3VPNs), and propose vrfinder, a technique for identifying L3VPN outbound addresses in traceroute collections. We validate vrfinder against ground truth from two large research and education networks, demonstrating high precision (100.0%) and recall (82.1% - 95.3%). We also show the benefit of accounting for L3VPNs in traceroute analysis through extensions to bdrmapIT, increasing the accuracy of its router ownership inferences for L3VPN outbound addresses from 61.5% - 79.4% to 88.9% - 95.5%.

Lessons from "a first-principles approach to understanding the internet's router-level topology"

Our main purpose for this editorial is to reiterate the main message that we tried to convey in our SIGCOMM'04 paper but that got largely lost in all the hype surrounding the use of scale-free network models throughout the sciences in the last two decades. That message was that because of (1) the Internet's highly-engineered architecture, (2) a thorough understanding of its component technologies, and (3) the availability of extensive (but typically noisy) measurements, this complex man-made system affords unique opportunities to unambiguously resolve most claims about its properties, structure, and functionality. In the process, we point out the fallacy of popular approaches that consider complex systems such as the Internet from the perspective of disorganized complexity and argue for renewed efforts and increased focus on advancing an "architecture first" view with its emphasis on studying the organized complexity of systems such as the Internet.

On Network Footprint of Traffic Inspection and Filtering at Global Scrubbing Centers

Traffic diversion through powerful cloud-based scrubbing centers provides a solution for protecting against various DDoS attacks. In one respect, such a solution enables sanitizing attack traffic close to its source and saves precious resources for the network service provider. Contrarily, the diversion of the inspected traffic toward the scrubbing centers may increase its footprint in the network. The location of the scrubbing centers greatly affects the network resource utilization and, therefore, should be carefully considered in the design of the security service. In this paper, we investigate four deployment strategies and compare their performance on a network of Points-of-Presence and on several router level topologies obtained from the RocketFuel project. The deployment quality was measured using the following criteria: the footprint of the inspected traffic, the redistribution of load on the links, and the increase in communication latency. Our results show that the deployment strategy that is considered to perform well for locating network monitors by maximizing flow coverage results in the worst footprint when traffic diversion is employed. Overall, we show that the deployment strategy that is tailored for traffic filtering is also suitable for traffic monitoring, but not the other way around.

On Measuring the Geographic Diversity of Internet Routes

Route diversity in networks is elemental for establishing reliable, high-capacity connections with appropriate security between endpoints. As for the Internet, route diversity has already been studied at both the autonomous system and router level topologies by means of graph theoretical disjoint paths. In this article we complement these approaches by proposing a method for measuring the diversity of Internet paths in a geographical sense. By leveraging the recent developments in IP geolocation we show how to map the paths discovered by traceroute into geographically equivalent classes. This allows us to identify the geographical footprints of the major transmission paths between end-hosts, and building on our observations, we propose a quantitative measure for geographical diversity of Internet routes between any two hosts.

Modularity Structure and Traffic Dynamics of ISP Router-level Topologies

Modularity Structure and Traffic Dynamics of ISP Router-level Topologies

A Router-Level Topology Simulation Algorithm Based on Improved BA Model

A Router-Level Topology Simulation Algorithm Based on Improved BA Model

Efficient Network Tomography for Internet Topology Discovery

Accurate and timely identification of the router-level topology of the Internet is one of the major unresolved problems in Internet research. Topology recovery via tomographic inference is potentially an attractive complement to standard methods that use TTL-limited probes. Unfortunately, limitations of prior tomographic techniques make timely resolution of large-scale topologies impossible due to the requirement of an infeasible number of measurements. In this paper, we describe new techniques that aim toward efficient tomographic inference for accurate router-level topology measurement. We introduce methodologies based on Depth-First Search (DFS) ordering that clusters end-hosts based on shared infrastructure and enables the logical tree topology of a network to be recovered accurately and efficiently. We evaluate the capabilities of our algorithms in large-scale simulation and find that our methods will reconstruct topologies using less than 2% of the measurements required by exhaustive methods and less than 15% of the measurements needed by the current state-of-the-art tomographic approach. We also present results from a study of the live Internet where we show our DFS-based methodologies can recover the logical router-level topology more accurately and with fewer probes than prior techniques.

Analyzing and modeling router-level internet topology and application to routing control

Measurement studies on the Internet topology show that connectivities of nodes exhibit power-law attribute, but it is apparent that only the degree distribution does not determine the network structure, and especially true when we study the network-related control like routing control. In this paper, we first reveal structures of the router-level topologies using the working ISP networks, which clearly indicates ISP topologies are highly clustered; a node connects two or more nodes that also connected each other, while not in the existing modeling approaches. Based on this observation, we develop a new realistic modeling method for generating router-level topologies. In our method, when a new node joins the network, the node likely connects to the nearest nodes. In addition, we add the new links based on the node utilization in the topology, which corresponds to an enhancement of network equipments in ISP networks. With appropriate parameters, important metrics, such as the a clustering coefficient and the amount of traffic that pass through nodes, exhibit the similar value of the actual ISP topology while keeping the degree distribution of resulting topology to follow power-law. We then apply the routing control method to the ISP topologies and show that the optimal routing method gives much smaller maximum link utilization (about 1/3) compared with the minimum hop routing which is often used in the operating networks. Accordingly, we examine a heuristic routing method suitable to the ISP topologies with consideration of technology constraints of IP routers. The evaluation results show that our modeling method can be actually used for evaluations on routing control.

Analyzing and Utilizing the Collaboration Structure for Reliable Router-Level Networks

As the Internet represents a key social infrastructure, its reliability is essential if we are to survive failures. Physical connectivity of networks is also essential as it characterizes reliability. There are collaboration structures, which are topological structures where two or more nodes are connected to a node, and collaboration structures are observed in transcriptional regulatory networks and the router-level topologies of ISPs. These collaboration structures are related to the reliability of networks. The main objective of this research is to find whether an increase in collaboration structures would improve reliability or not. We first categorize the topology into a three-level hierarchy for this purpose, i.e., top-level, middle-level, and bottom-level layers. We then calculate the reliability of networks. The results indicate that the reliability of most transcriptional regulatory networks is higher than that of one of router-level topologies. We then investigate the number of collaboration structures. It is apparent that there are much fewer collaboration structures between top-level nodes and middle-level nodes in router-level topologies. Finally, we confirm that the reliability of router-level topologies can be improved by rewiring to increase the collaboration structures between top-level and middle-level nodes.

Dynamics of Feedback-Induced Packet Delay in ISP Router-Level Topologies

Dynamics of Feedback-Induced Packet Delay in ISP Router-Level Topologies

Models of Link Capacity Distribution in Isp's Router-Level Topology

Modeling the Internet is vital for network researches. Recent measurement studies on the Internet topology show that the degree distribution obeys the power-law distribution. However, only the degree distribution does not determine the performance of network control methods. As previous studies have shown, one of important factors to characterize the performance of network control methods in the Internet is a structure of topologies. However, other characteristics, which are even more important, are link capacities and node processing capacities of the network because these characteristics are particular to communication networks. In this paper, we investigate how to model the link capacity in the router-level topologies. We first reveal that the link capacity distribution of ISP’s backbone network in Japan obeys a power-law with exponent -1.1. To clarify the reason for the link capacity distribution, we evaluate throughput of networks having various kinds of link capacity distributions. Our numerical results show that the network with power-law link capacity distribution can accommodate much more traffic than the network with exponential distributions of link capacities.

A Modeling Method for Router-Level Topologies based on Network-Cost Optimization

Measurement studies of Internet topologies show that the degree distribution of the topologies exhibits a power-law attribute. However, it is apparent that only degree distributions do not determine the structure of ISP topologies, where ISP designs routerlevel topologies based on their own design policies. Other structural properties than degree distribution are important to generate realistic Internet topologies. In this paper, we develop a modeling method for generating realistic ISP Internet topologies that obey a power-law degree distribution and have similar structural properties observed in the measurement studies. Our modeling method adds nodes one by one, and each node connects to optimal nodes to minimize overall network-cost. Then we answer the following question: what design factors are important to form realistic Internet topologies? Our results show that the answers are node locations and traffic demands.

Measured impact of crooked traceroute

Data collected using traceroute-based algorithms underpins research into the Internet's router-level topology, though it is possible to infer false links from this data. One source of false inference is the combination of per-flow load-balancing, in which more than one path is active from a given source to destination, and classic traceroute, which varies the UDP destination port number or ICMP checksum of successive probe packets, which can cause per-flow load-balancers to treat successive packets as distinct flows and forward them along different paths. Consequently, successive probe packets can solicit responses from unconnected routers, leading to the inference of false links. This paper examines the inaccuracies induced from such false inferences, both on macroscopic and ISP topology mapping. We collected macroscopic topology data to 365k destinations, with techniques that both do and do not try to capture load balancing phenomena. We then use alias resolution techniques to infer if a measurement artifact of classic traceroute induces a false router-level link. This technique detected that 2.71% and 0.76% of the links in our UDP and ICMP graphs were falsely inferred due to the presence of load-balancing. We conclude that most per-flow load-balancing does not induce false links when macroscopic topology is inferred using classic traceroute. The effect of false links on ISP topology mapping is possibly much worse, because the degrees of a tier-1 ISP's routers derived from classic traceroute were inflated by a median factor of 2.9 as compared to those inferred with Paris traceroute.

Modeling generation of the router-level topology of an ISP network

Characterizing the Internet’s router-level topology is important in understanding Internet architecture and how it is linked with technical, economic, and social factors. Hosts on the Internet are connected via thousands of Internet service providers (ISPs), wherein each ISP contains one or more autonomous systems (ASs) depending on its size. An AS is a set of routers within a single administration domain. A major challenge in modeling router-level topology is identifying the factors influencing topological evolution. The current work proposes a router-level topology model in which each router is viewed as resource and attributes, and each link is considered an interaction relationship. We present the concept of “attraction degree” by analyzing the topological data of an actual ISP. We attribute the evolution of the Internet’s router-level topology to interactions among the internal and external factors. In this paper, we also consider the impact of both attribute evolution and geographical limit on topological growth. Using power-law, Laplacian eigenvalue, and heat kernel trace, the proposed modeling algorithm is expected to improve the understanding of researchers and engineers regarding the current Internet situation and how Internet topology will change in the future.

Characterizing and modeling the Internet Router-level topology – The hierarchical features and HIR model

In this paper, we seek to understand the properties related with the hierarchical structure of the Internet Router-level topology. We first analyzed the hierarchical features of the Internet Router-level topology with the actual topology measuring data authorized by CAIDA (The Cooperative Association for Internet Data Analysis) Skitter project. Then we analyzed the distribution of the nodes in each shell, the distribution of the edges within the shell and to the higher shells and induced the computing functions. We proposed a new framework for modeling the Internet Router-level topology with the conclusion we have drawn and we implemented the model, HIR model. HIR model was based on the k-core decomposition in order to reveal the hierarchical of the network. The analysis shows that HIR model can reproduce Internet on most properties and has got the hierarchies of network close to that of Internet. The experiments show that HIR model can fully reflect the hierarchy characteristics of the Internet Router-level topology while preserving the power-law distribution on degree.

Structure of Protein Interaction Networks and Their Implications on Drug Design

Protein-protein interaction networks (PINs) are rich sources of information that enable the network properties of biological systems to be understood. A study of the topological and statistical properties of budding yeast and human PINs revealed that they are scale-rich and configured as highly optimized tolerance (HOT) networks that are similar to the router-level topology of the Internet. This is different from claims that such networks are scale-free and configured through simple preferential-attachment processes. Further analysis revealed that there are extensive interconnections among middle-degree nodes that form the backbone of the networks. Degree distributions of essential genes, synthetic lethal genes, synthetic sick genes, and human drug-target genes indicate that there are advantageous drug targets among nodes with middle- to low-degree nodes. Such network properties provide the rationale for combinatorial drugs that target less prominent nodes to increase synergetic efficacy and create fewer side effects.