• CAIDA's AVOID Project

We will create a knowledge network that will improve the security and functioning of three key but inherently vulnerable systems that underpin all activity on the Internet: the addressing, routing, and naming systems. Lack of attention to security in early design decisions, persistent disagreement about the best path to improvement, and lowest-cost operational practices surrounding these three layers have allowed malicious actors to execute and scale harmful misbehavior including interception and disruption of traffic, denial of service and phishing attacks, and distribution and execution of malware.

• overview

This screencast provides a detailed overview on how to analyze Internet connectivity outages using IODA's Dashboard interface. IODA is short for Internet Outage Detection and Analysis and is a system being developed at CAIDA, a research center at UC San Diego. IODA's Dashboard is a publicly available web interface that allows you to learn about and investigate Internet outages. This screencast presents an overview of IODA, the data sources that IODA uses, and explores several Internet outage case studies, including large-scale outages caused by government-mandated shutdowns that affected Iran and Kashmir in 2019.

• www.caida.org/projects/ioda/

This screencast teaches you how to use IODA's Explorer interface. IODA is short for Internet Outage Detection and Analysis and is developed at CAIDA, a research center at UC San Diego. IODA's Explorer allows you to perform power analyses of Internet outages. This screencast presents the components of the Explorer interface and goes on to explain how to manipulate various time series to perform in-depth analyses of Internet outages detected by IODA.

• www.caida.org/projects/ioda/

Net Neutrality has become a bit of a political football. We don't have even close to enough data to truly litigate the net neutrality debate in an equitable way. We don't know enough. You need measurement." In this series of short clips, KC Claffy, founder and director of the Center for Applied Internet Data Analysis (CAIDA) at SDSC, brings us up to speed on some of the key issues surrounding the Net Neutrality debate. Watch the video "The Net Neutrality Debate", part of a series on Net Neutrality and Why We Need to Measure the Internet.

This screencast teaches you how to use IODA's Dashboard. IODA is short for Internet Outage Detection and Analysis and is developed at CAIDA, a research center at UC San Diego. IODA's Dashboard allows you to learn about and investigate Internet outages. This screencast will present the data sources that IODA uses, explain the components of its user interface, and discuss how to use IODA effectively.

• www.caida.org/projects/ioda/

Henya is CAIDA's large-scale Internet topology query system which provides remote search of traceroute data without requiring data downloads. Henya includes built-in analyses and visualizations for commonly occuring needs, and is intended to be responsive enough for interactive data exploration.

Over the past several months, CAIDA, in collaboration with Matthew Luckie at the University of Waikato, has upgraded Rob Beverly's original spoofing measurement system, developing new client tools for measuring IPv4 and IPv6 spoofing capabilities, along with services that provide reporting and allow users to opt-in or out of sharing the data publicly. Watch the video "What is IP Spoofing?" for an overview of what IP spoofing is and how you can install Spoofer and help.

• www.caida.org/projects/spoofer/

The sipscan composite animation combines the world map animation, standard byte ordered target progression animation, and the reversed byte order animation into a single, synchronized video. This allows an immediate comparison between the geographical dynamics of the bots and the progression of the IP addresses across the duration of the scan.

The sipscan coordinated view animation combines the world map animation, standard byte ordered target progression animation, and the reversed byte order animation into a single, synchronized video. This allows an immediate comparison between the geographical dynamics of the sources and the progression of the target addresses across the duration of the scan.

• .mp4 (40.3 MB)
• screenshot

The animation of the sipscan target progression in reversed byte order represents the progression over time of the IP addresses targeted by the sipscan. The darknet address space is represented as a Hilbert curve of order 12 in which the order of the three least significant bytes of each address is reversed before mapping it into the curve. Highlighted pixels correspond to IP addresses that have been probed up to that time (5 Feb 2011 11:47 GMT, in this frame). The animation proves the reverse-byte order progression is rigorously followed by the bots during the entire 12 days, independent of the varying rate of the sipscan.

• .mp4 (21.0 MB)
• screenshot

The animation of the sipscan target progression in standard byte order represents the progression over time of the actual IP addresses targeted by the sipscan. The darknet address space is represented as a Hilbert curve of order 12. Drawing the Hilbert curve using IP addresses sequenced in their natural byte order does not reveal a particular pattern in the target progression, showing the square uniformly filling across the 12 days of the scan.

• .mp4 (40.1 MB)
• screenshot

The Sipscan World Map animation shows, with 5:20-minutes of data represented per frame, circles at the geographical coordinates of source hosts (bots) with size proportional to the number of hosts geolocated to those coordinates, and color to the number of packets sent. The animation depicts the spatial and temporal dynamics of the scan.

• .mp4 (35.8 MB)
• screenshot

A visualization of the characteristics of IPv4 "whois" data from the five Regional Internet Registries (RIRs).

The DNS workload animated maps show the number of queries and clients seen by one of the .CL nameservers in Chile and its hourly variation along two days of traces beginning on July 3rd 2007 at 21:00 (UTC). The animation provides a view of the world map and colors countries based on the load that each country originates. The use of a terminator to show the sun's shadow helps depict potential diurnal patterns in the displayed data.

• The Nyxem Email Virus: Analysis and Inferences

• Analysis of the Witty Worm
• The Spread of the Witty Worm
• Cuttlefish Example: Witty Worm Infected Hosts

• (See "Witty Worm (world)" above)

• CAIDA Analysis of Code-Red
• The Spread of the Code-Red Worm (CRv2)
• Static image of the Code-Red Worm animation
• CodeRed Worm Infections in 24.0.0.0/8 on July 19, 2001
• Code-Red: a case study

The Egypt outage coordinated view animation combines a geographical representation of Egypt region along with animations of the source addresses observed during the event, both at a global level, and from the 41.0.0.0/8 network delegated to AfriNIC. (Egypt area map © OpenStreetMap contributors, CC BY-SA)

• Related paper: A Coordinated View of the Temporal Evolution of Large-scale Internet Events

The full source address space animation shows which sources sent packets to the UCSD Network Telescope before, during, and after the Egypt Internet Blackout. Address ranges which have been identified to belong to Egyptian organizations are highlighted in a dark blue color.

The zoomed source address space animation shows which sources within the 41.0.0.0/8 network - which has been delegated to AfriNIC - sent packets to the UCSD Network Telescope before, during, and after the Egypt Internet Blackout. Address ranges within the /8 network which have been identified to belong to Egyptian organizations are highlighted in a dark blue color.

• Animated Maps of Two Days of DNS Workload for the .CL Chilean ccTLD

• Animated Maps of Two Days of DNS Workload for the .CL Chilean ccTLD

• Inferring Internet Denial-of-Service Activity
• Network Telescopes Overview: What is a "Network Telescope"?
• UCSD Network Telescope -- The Backscatter-TOCS Dataset
• Worldwide Detection of Denial of Service (DoS) Attacks

• AS Core: Visualizing Internet Topology at a Macroscopic Scale

• CAIDA's skitter tool

• CAIDA's Mapnet tool