10/17/2002RAID 2002, Zurich1 ELISHA: A Visual-Based Anomaly Detection System Soon-Tee Teoh, Kwan-Liu Ma S. Felix Wu University of California, Davis Dan Massey, Xiao-Liang Zhao Allison Mankin USC/ISI Dan Pei, Lan Wang, Lixia Zhang UCLA Randy Bush IIJ

10/17/2002RAID 2002, Zurich2 Outline Visual-based “Anomaly Detection” The BGP/MOAS Problem ELISHA and demo Conclusion/Future Works

10/17/2002RAID 2002, Zurich3 A Few Research Objectives Limitations on “Anomaly Detection” –We need to convey the alerts (or their abstraction) to the “human” users or experts Not only detecting the problem, but also, via an interactive process, finding more details about it –Root cause analysis –Event Correlation Human versus Machine Intelligence

10/17/2002RAID 2002, Zurich4 Visual-based “Anomaly Detection” Utilize human’s cognitive pattern matching capability and techniques from information visualization. “Visual” Anomalies –Something catches your eyes…

10/17/2002RAID 2002, Zurich5 An Interactive Process Methodology –Build an interactive interface between network management and operators, so they can visualize the data –Features help operators quickly perceive anomalies Data Collection Filtering Mapping Rendering Viewing

10/17/2002RAID 2002, Zurich6 BGP & Autonomous Systems AS6192 (UCDavis)AS11423 (UC) AS11537 (CENIC) /16

10/17/2002RAID 2002, Zurich UCDavis UC, the origin ID is CENIC is admined by University Corporation for Advanced Internet Development, origin ID UCAID is admined CERN - European Organization for Nuclear Research 3356 is admined by Level 3 Communications, LLC, origin ID is L3CL is admined by Abovenet Communications, Inc is RIPE Network Coordination Centre 209 is admined by Qwest, origin ID is QWEST is RIPE Network Coordination Centre 9177 is admined by NEXTRANET, T-Systems Multilink AG Switzerland. 4637, 1221 and 4608 are admined by APNIC, but I can't find who they are in APNIC whois database is admined by Global Crossing, it is locate at Phoenix AZ and 3333, 1103 are RIPE Network Coordination Centre 2914 is admined by Verio, Inc 7018 is admined by AT&T

10/17/2002RAID 2002, Zurich8 Origin AS in an AS Path UCDavis (AS-6192) owns /16 and AS is the origin AS AS Path: 2194  209   6192 – – – – – – – – – – – – Observation Points in the Internet collecting BGP AS Path Updates –RIPE: AS-12654

10/17/2002RAID 2002, Zurich9 BGP MOAS/OASC Events Observable Changes in IP Address Ownership –OASC: Origin AS Changes Example 1: –Multiple ASes announce the same block of IP addresses. –MOAS stands for Multiple Origin AS. Example 2: –Punch Holes in the Address Space. –AS-7777 announced /24 Maybe legitimate or faulty. Many different types of MOAS/OASC events

10/17/2002RAID 2002, Zurich10 BGP MOAS/OASC Events Max: (9177 from a single AS)

10/17/2002RAID 2002, Zurich11 ELISHA/MOAS Low level events:BGP Route Updates High level events:MOAS/OASC –Still per day and max per day IP address blocks Origin AS in BGP Update Messages Different Types of MOAS conflicts

10/17/2002RAID 2002, Zurich AS# Quad-Tree Representation

10/17/2002RAID 2002, Zurich13 MOAS Event Types Using different colors to represent types of MOAS events C type: CSS, CSM, CMS, CMM H type: H B type: B O type: OS, OM

10/17/2002RAID 2002, Zurich one CSM instance victim suspect Example: CSM (Change S  M)

10/17/2002RAID 2002, Zurich15 AS-7777 Punched a Hole Which AS against which And which address blocks?

10/17/2002RAID 2002, Zurich16 Interesting ASs to watch AS7777 –August 14, 2000H, OS AS15412 –April 6-19, 2001CSM, CMS AS4740 –August 18, 2001CSM, CMS –September 27, 2001CSM, CMS AS701 –May 02, 2001H (63.0/10) *****March 1, 2000, July 11, 200, September 26, AS64518 –September 18, 2001-NimdaH’ed from many ASes.

10/17/2002RAID 2002, Zurich17 Demo time!!

10/17/2002RAID 2002, Zurich18 08/14/2000 & 04/2001

10/17/2002RAID 2002, Zurich19 Remarks Preliminary but encouraging results –Root cause analysis –Event correlation Integration of Information Visualization, Interactive Investigation Process, and Data Mining Examining several other problems: –BGP Route Path Dynamics and Stability –TCP/IP and HTTP Traffic Availability (source code, papers, ppt) – Sponsored by DARPA and NSF

10/17/2002RAID 2002, Zurich20 August 14, 2000 (larger)

10/17/2002RAID 2002, Zurich21 2-D versus 3-D on August 14, 2000

10/17/2002RAID 2002, Zurich22

10/17/2002RAID 2002, Zurich23 BGP AS Path Dynamics (1)

10/17/2002RAID 2002, Zurich24 BGP AS Path Dynamics (2)

10/17/2002RAID 2002, Zurich25 Address Appearing Frequency Normal

10/17/2002RAID 2002, Zurich26 DDoS Attack