Analyzing the Impact of Granularity on IP-to-AS Mapping Presented by Baobao Zhang Authours: Baobao Zhang, Jun Bi, Yangyang Wang, Jianping Wu

1 Introduction Doing? Map the IP address to the AS that uses the IP Meaning Help network managers diagnose network failure Discover the AS-level topology with traceroute Some other applications that need to map IP to AS

An example

2 Data Collection Data Source Traceroute Data (From CAIDA) BGP Routing Table (from routeviews) Processing into pairs Extract the prefixes and AS paths from routing tables Extract the destination IPs and IP paths from traceroute data Find the longest matching prefix for the destination IP The IP path associated with the destination IP and the AS path associated with the longest prefix form one pair Origin IP-to-AS mapping Extract the prefixes and its origin ASes from routing tables Map every prefix to its origin AS

Data Collection Date: 04/22/2010 During: One Day

3 Methodology Definition Exact Match Ambiguous Match Mismatch Methods Prefix-granularity Method (PGM) IP-granularity Method (IGM) Prefix-granularity Limit Method (PGLM) Hierarchical Mapping System (HMS) Assumption The traceroute path is consistent with the BGP AS path.

Methods Prefix-granularity Method (PGM) i.e. Mao s Method Bind many IP addresses into one prefix Map one prefix to many ASes by setting threshold Tight coupling Pros Can modify the incorrect mappings for the IPs that don t appear in the training dataset Cons Mistakenly modify the originally correct mappings for the IPs that don t appear in the training dataset. (tight coupling) Threshold. Miss to modify the incorrect mappings for the IPs that appear in the training dataset Threshold. Bring about ambiguous mappings

Methods IP-granularity Method (IGM) We propose it for the first time Map one IP to one only AS Loose coupling Pros Eliminate the ambiguous mappings Cons Only can modify the mappings for the IPs that appear in the training dataset.

Methods Prefix-granularity Limit Method (PGLM) One fictitious Method The Limit of PGM. Set the threshold =0 It is only used to be compared

Methods Hierarchical Mapping System (HMS) Combine the IGM with PGM Three levels (/32 level, /24 level, origin level) Firstly look up in the /32 level mapping, then /24 level mapping, finally the origin level mapping Pros complement the strength of tight coupling and loose coupling Cons * inherit the characteristic of ambiguity from PGM

4 Evaluation DataSet

Evaluation Training Accuracy

Evaluation Validation Accuracy

Evaluation Compare trained mapping with the origin mapping

Evaluation

5 Classification Tree Analysis Motivation Quantify the pros and cons for the IGM and PGM Analyze the obstacles in the way of improving the accuracy for the IGM and PGM Other potential findings

Constructing Classification Tree

Table 7 The improvement gained by correcting the mapping of the types for the PGM VDS1 gain VDS2 gain VDS3 gain VDS4 gain Type10.00% Type20.71%0.02%0.27%0.05% Type314.25%8.47%8.15%10.30% Type40.00% Type52.37%1.55%0.35%2.47% Type60.00% Type70.80%1.57%1.47%1.05% Type8 (Base) -0.29% (5.66%) -0.64% (7.34%) -0.15% (6.79%) -0.33% (6.20%) Type1-2 (Base) 0.00% (1.06%) 0.00% (0.61%) 0.00% (0.58%) 0.00% (1.92%) Type %0.06%1.01%0.25% Type %1.12%22.29%15.08% Type % Type %0.17%0.25%3.30% Type8-2 (Base) 0.00% (2.93%) 0.00% (2.38%) -0.03% (2.22%) -0.01% (0.15%) Type-all19.85%12.87%35.18%32.94%

5.1 Quantify the pros and cons for the IGM and PGM Pros and Cons (+) modify the incorrect mappings for the IPs that don t appear in the training dataset (Type 8-2, 1-2 for PGM, nothing for IGM) (-) Mistakenly modifies the originally correct mappings for the IPs that don t appear in the training dataset. (Type 2-2 for PGM, nothing for IGM) (-) Miss to modify the incorrect mappings for the IPs that appear in the training dataset (Type3 for PGM and IGM) Quantifying For PGM, Base(type8-2)+base(type1-2)-gain(type2-2) is positive. 3.63%, 2.93%, 1.79% and 1.81% PGM(gain(type3))-IGM(gain(type3)) %, 8.38%, 7.94% and 9.81% Conclusion The IGM is superior to the PGM

5.2 Analyze the obstacles in the way of improving the accuracy for the IGM and PGM IGM Type 7. (IPs do not appear in the training dataset) PGM Type 3. (IPs appear in the training dataset, but miss to modify due to the tight coupling) Type 3-2. (IPs do not appear in the training dataset)

5.3 Other findings The limit of validation accuracy 1-gain(type2) -gain(type3)-gain(type5) For IGM 98.87%,97.96%,98.43%,98.96% For PGM 82.66%,89.96%,91.23%,87.18%

Other findings Illustrating that the IGM has more potential to improve the accuracy than the PGM

6 Conclusion Proposed a hierarchical IP-to-AS mapping system Analyzed and quantified the impact of granularity