1. A Visual Exploration Process for the Analysis of Internet Routing Data Soon Tee Teoh Kwan-Liu Ma S. Felix Wu Presented by Zhenzhen Yan April. 11, 2007

2. Problem Protect Internet against various forms of attacks, malicious uses, and errors. Interactive visualization for the analysis of Internet routing data.

3. Motivation The Internet pervades many aspects of our lives: Commerce - An Accenture survey has found that the majority of consumers use the Internet as part of the shopping process even if they go to stores to purchase or pick up items.Accenture survey Education Government Production and general information dissemination

4. Motivation Cont’d The Internet is vulnerable to attacks and errors. - Researchers Estimate Worst-Case Worm Damage at $50 Billion (ENT news). -Affect people in other unquantifiable ways.

5. Example: 128.120.0.0/16 128.120. IP Prefix

6. AS One or more networks within a single administrative domain is referred to as an Autonomous System (AS), and is assigned a unique AS number.

7. BGP Border Gateway Protocol (BGP) is used to exchange network reachability information so that routers can eventually forward data packets to the correct destination.

8. BGP announcement Example: 128.120.0.0/16: (7,23,92) AS-7 AS-23 AS-92 (Origin) 128.120.0.0/16: WD (no longer reachable)

9. The Data The Oregon Route Views server 2000 and 2001 Observation point

12. Approach 1. Aggregate Data Browsing Module “Are there any patterns or clusters in the timing of the announcements?”

15. 2. Route Announcement Module

19. What is the time-interval threshold to determine whether we consider a sequence of announcements part of the same “event”?

21. 3. Node/Link Visualization Module

25. 4. Peer-Comparison Module

27. 5. Events Visualization module

29. Evaluation The user has been able to detect instances of known types of instability events as well as identify new types, and further classify known types. The user was able to quickly identify faster paths, preferred paths, slow points, points of failure, as well as hypothesize about the sequence of events that led to the observations. The user also discovered new sub-classes of instability events through visualization. Very positive feedback from the network analysts and Internet researchers who have seen and used the visualization software.

30. Conclusions Two-level (overview+detail) system. Visualize text with timestamps. Arcs visualization. EventShrubs.

31. Questions Why do the EventShrubs of Terralycos and Yahoo (Microsoft and Realnetworks) show similarity? What will you do to better evaluate these methods? What other applications are likely to use these interactive visualization techniques?