1. 10/17/2002RAID 2002, Zurich1 ELISHA: A Visual-Based Anomaly Detection System Soon-Tee Teoh, Kwan-Liu Ma S. Felix Wu University of California, Davis Dan Massey, Xiao-Liang Zhao Allison Mankin USC/ISI Dan Pei, Lan Wang, Lixia Zhang UCLA Randy Bush IIJ

2. 10/17/2002RAID 2002, Zurich2 Outline Visual-based “Anomaly Detection” The BGP/MOAS Problem ELISHA and demo Conclusion/Future Works

3. 10/17/2002RAID 2002, Zurich3 A Few Research Objectives Limitations on “Anomaly Detection” –We need to convey the alerts (or their abstraction) to the “human” users or experts Not only detecting the problem, but also, via an interactive process, finding more details about it –Root cause analysis –Event Correlation Human versus Machine Intelligence

4. 10/17/2002RAID 2002, Zurich4 Visual-based “Anomaly Detection” Utilize human’s cognitive pattern matching capability and techniques from information visualization. “Visual” Anomalies –Something catches your eyes…

5. 10/17/2002RAID 2002, Zurich5 An Interactive Process Methodology –Build an interactive interface between network management and operators, so they can visualize the data –Features help operators quickly perceive anomalies Data Collection Filtering Mapping Rendering Viewing

6. 10/17/2002RAID 2002, Zurich6 BGP & Autonomous Systems AS6192 (UCDavis)AS11423 (UC) AS11537 (CENIC) 169.237/16

7. 10/17/2002RAID 2002, Zurich7 6192 UCDavis 11423 UC, the origin ID is CENIC 11537 is admined by University Corporation for Advanced Internet Development, origin ID UCAID-1 513 is admined CERN - European Organization for Nuclear Research 3356 is admined by Level 3 Communications, LLC, origin ID is L3CL-1 6461 is admined by Abovenet Communications, Inc 13129 is RIPE Network Coordination Centre 209 is admined by Qwest, origin ID is QWEST-4 3320 is RIPE Network Coordination Centre 9177 is admined by NEXTRANET, T-Systems Multilink AG Switzerland. 4637, 1221 and 4608 are admined by APNIC, but I can't find who they are in APNIC whois database. 3549 is admined by Global Crossing, it is locate at Phoenix AZ. 3257 and 3333, 1103 are RIPE Network Coordination Centre 2914 is admined by Verio, Inc 7018 is admined by AT&T

8. 10/17/2002RAID 2002, Zurich8 Origin AS in an AS Path UCDavis (AS-6192) owns 169.237/16 and AS- 6192 is the origin AS AS Path: 2194  209  11423  6192 –12654 513 11537 11423 6192 –12654 13129 6461 3356 11423 6192 –12654 9177 3320 209 11423 6192 –12654 4608 1221 4637 11423 6192 –12654 777 2497 209 11423 6192 –12654 3549 3356 11423 6192 –12654 3257 3356 11423 6192 –12654 1103 11537 11423 6192 –12654 3333 3356 11423 6192 –12654 7018 209 11423 6192 –12654 2914 209 11423 6192 –12654 3549 209 11423 6192 Observation Points in the Internet collecting BGP AS Path Updates –RIPE: AS-12654

9. 10/17/2002RAID 2002, Zurich9 BGP MOAS/OASC Events Observable Changes in IP Address Ownership –OASC: Origin AS Changes Example 1: –Multiple ASes announce the same block of IP addresses. –MOAS stands for Multiple Origin AS. Example 2: –Punch Holes in the Address Space. –AS-7777 announced 169.237.6/24 Maybe legitimate or faulty. Many different types of MOAS/OASC events

10. 10/17/2002RAID 2002, Zurich10 BGP MOAS/OASC Events Max: 10226 (9177 from a single AS)

11. 10/17/2002RAID 2002, Zurich11 ELISHA/MOAS Low level events:BGP Route Updates High level events:MOAS/OASC –Still 1000+ per day and max 10226 per day IP address blocks Origin AS in BGP Update Messages Different Types of MOAS conflicts

12. 10/17/2002RAID 2002, Zurich12 1101 1000 1001 110001110011111001111011 110000110010111000111010 00110110 AS# Quad-Tree Representation

13. 10/17/2002RAID 2002, Zurich13 MOAS Event Types Using different colors to represent types of MOAS events C type: CSS, CSM, CMS, CMM H type: H B type: B O type: OS, OM

14. 10/17/2002RAID 2002, Zurich14 1101 1000 1001 110001110011111001111011 110000110010111000111010 00110110 one CSM instance victim suspect Example: CSM (Change S  M)

15. 10/17/2002RAID 2002, Zurich15 AS-7777 Punched a Hole Which AS against which And which address blocks?

16. 10/17/2002RAID 2002, Zurich16 Interesting ASs to watch AS7777 –August 14, 2000H, OS AS15412 –April 6-19, 2001CSM, CMS AS4740 –August 18, 2001CSM, CMS –September 27, 2001CSM, CMS AS701 –May 02, 2001H (63.0/10) 00 11 11 11 00 *****March 1, 2000, July 11, 200, September 26, 2001... AS64518 –September 18, 2001-NimdaH’ed from many ASes.

17. 10/17/2002RAID 2002, Zurich17 Demo time!!

18. 10/17/2002RAID 2002, Zurich18 08/14/2000 & 04/2001

19. 10/17/2002RAID 2002, Zurich19 Remarks Preliminary but encouraging results –Root cause analysis –Event correlation Integration of Information Visualization, Interactive Investigation Process, and Data Mining Examining several other problems: –BGP Route Path Dynamics and Stability –TCP/IP and HTTP Traffic Availability (source code, papers, ppt) –http://www.cs.ucdavis.edu/~wu/Elisha/ Sponsored by DARPA and NSF

20. 10/17/2002RAID 2002, Zurich20 August 14, 2000 (larger)

21. 10/17/2002RAID 2002, Zurich21 2-D versus 3-D on August 14, 2000

22. 10/17/2002RAID 2002, Zurich22

23. 10/17/2002RAID 2002, Zurich23 BGP AS Path Dynamics (1)

24. 10/17/2002RAID 2002, Zurich24 BGP AS Path Dynamics (2)

25. 10/17/2002RAID 2002, Zurich25 Address Appearing Frequency Normal

26. 10/17/2002RAID 2002, Zurich26 DDoS Attack