Learning network structure from passive measurements

The ability to discover network organization, whether in the form of explicit topology reconstruction or as embeddings that approximate topological distance, is a valuable tool. To date, network discovery has been based on active measurements. However, it is feasible to envision passive discovery of network topology and distance, simply by monitoring packet traffic. Unfortunately, the lack of explicit control over the choices of which endpoints are measured means that passive network discovery must deal with the problem of missing information. We consider one such example, namely reconstructing embeddings and some network structure information from unwanted network traffic captured at a set of honeypots. We develop a number of algorithms for reconstruction of missing measurements. Our algorithms use insights derived from the known topology of the Internet as well as local imputation techniques from approximation theory. We characterize the degree to which missing information can be re...

• Type: Conference
• Year: 2007
• Where: IMC
• Authors: Brian Eriksson, Paul Barford, Robert Nowak, Mark Crovella
• Keywords: Explicit Topology Reconstruction, IMC 2007, Internet Technology, Network Discovery, Topology