E-Locus - Institutional Repository of the University of Crete

Home Collections Type of Work Post-graduate theses

Post-graduate theses

Current Record: 5042 of 6549

[Add to Basket]

Identifier

000417253

Title

Detecting traffic anomalies at colocation facilities

Alternative Title

Ανίχνευση ανωμαλιών κίνησης δεδομένων σε εγκαταστάσεις σύζευξης

Author

Μηλολιδάκης, Αλέξανδρος Κ.

Thesis advisor

Δημητρόπουλος, Ξενοφώντας

Reviewer

Παπαδοπούλη, Μαρία
Μαρκάτος, Ευάγγελος

Abstract

Internet eXchange Points (IXPs) as core parts of the Internet infrastructure, hosted at Colocation Facilities (Colos), facilitate the exchange of Terabytes of traffic on a daily basis by big Internet Service Providers (ISPs). Offering flexibilities, routing benefits and a safe place for operators to install their equipment, Colos provide the ideal location where new peering relations are formed. Although the equipment is usually well preserved, major traffic anomalies between Autonomous Systems (ASes) over facility peering links can take place. This thesis aims to detect anomalies at Colos and measure the impact on traffic traversing the affected entity. To achieve this, i) we use data plane information from the facilities where IXPs are located (e.g., IP addresses), ii) we utilize daily traceroute snapshots from the RIPE Atlas measurement platform to identify the facilities the traffic goes through and iii) we use statistical methods to detect unusual delay discrepancies and routing anomalies over the facility peering links. Using our system, we analyzed a timeframe between May and December 2015 ranking the observed alarms to infer significant disruptions. To demonstrate our system, we present and validate three cases: an IXP outage, a DDoS attack and a power failure in a colocation facility indicating that our proposed methods are able to detect real world outages. Furthermore, we map Colos to their metropolitan area and assess the impact of each alarm in neighboring facilities of the same area. Our results also show a time window ('the hours' around midnight) that has a higher probability of triggering an alarm, possible due to planned maintenance.

Language

English

Subject

Anomaly detection

IXPs

Issue date

2018-07-20

Collection

School/Department--School of Sciences and Engineering--Department of Computer Science--Post-graduate theses

Type of Work--Post-graduate theses

Permanent Link

https://elocus.lib.uoc.gr//dlib/f/4/d/metadata-dlib-1531915143-680859-26774.tkl