Skip to main content
CAIDA home

NIDS Assignment Planning Guide

NIDS Assignment Planning Guide

Before creating any files, work through this short set of questions about what your assignment introduces, what it assumes, and what could go wrong. Fill it in directly in the browser; download the result as Markdown or Word to keep, share, or paste into an issue.

This is step zero — before the content guide walks through what a finished repository should contain, and the style guide specifies exactly how each file is written, work through this page to sketch your assignment at a high level. Fill in the fields below directly in your browser; nothing is sent anywhere, and the two buttons at the bottom let you download what you wrote as a Markdown or Word file to keep, paste into an issue, or share with the NIDS team.

We’re pulling examples throughout this guide from nids-dns-ecosystem, a published NIDS assignment.

Focus

Four short answers that together say what your assignment is. Name at least one thing beyond the dataset — a tool, a practice, or an idea. A practice is a way of working — scaling a prototype into a batch job, writing index-aware queries against a large table. An idea is a concept that outlives the dataset — customer cone, market concentration, provenance.

Example (nids-dns-ecosystem)
  • In one to two sentences: The assignment will look at DNS concentration using OpenINTEL's zone based data.
  • Teaching:
    • Idea — market concentration and systemic dependency, measured with the HHI
    • Dataset (guide) — OpenINTEL zone-based measurements (NS, DNSKEY, DS, CAA, TXT, SOA records) and the LACeS Anycast Census
    • Dataset — LACeS Anycast Census
    • Tool (guide) — PySpark with the S3A connector, reading partitioned Parquet straight from an object store with guide
    • Tool — dnspython a DNS resolve library
  • Assumes: nothing — no prerequisite NIDS assignment
  • Tasks:
    • derive DNS provider market share and the HHI from raw NS records, rather than cite a published concentration figure
    • count nameservers and providers per domain, then cross-reference the anycast census; Task 1's provider mapping is the input, so a shortcut taken early surfaces as a wrong answer here
    • measure DNSSEC, CAA, and SPF adoption in one snapshot, then repeat across 2019–2024

What the assignment does, and why it is worth doing.

Dataset, tool, practice, or idea. Be specific: "Internet topology" is not an answer; "router-level links inferred from traceroute, and when their inferred geolocation can be trusted" is. Pick a type per entry, and check Include guide if the assignment ships its own guide for it.

Check any existing NIDS assignment students should complete before this one. Anything not covered by a prerequisite is new material your assignment has to teach. For tools specifically — one no prerequisite covers needs its own guide in your repository; one a prerequisite covers only partly needs a guide covering just the difference.

One task per row. A student must not be able to finish a task by falling back on what they already knew.

Risks

What could go wrong? Write it down now, while there is still time to change course: Is the data bigger than you can process in the time you have? Does any of it need access you don't yet have? Is the scope too broad to finish — or so narrow the student learns nothing new? Will the analysis land on a clean result, or on "it depends"? What's your fallback if the main analysis doesn't work?

Example (nids-dns-ecosystem)
  • .fr/.se snapshots run 1–4M domains/day, too big for a laptop — recommend .gov/.li to prototype, .se on NRP's Spark cluster for the graded run
  • A 2019–2024 trend could land on "it depends" — anchor it to events inside the window and make the questions ask for them (Q6 on market-share shifts, Q17 on adoption inflection points); the 2010 Cloudflare and Route 53 launches predate the window and cannot appear in it

Reading

The papers, docs, blog posts, and talks your group is drawing on for inspiration. One line each: source and link — what idea it contributes. Check Required for anything you would put in front of the students as part of the assignment itself.

Example (nids-dns-ecosystem)
  • OpenINTEL Project (https://openintel.nl) — the DNS measurement platform the assignment runs on (required)
  • OpenINTEL Data Dictionary (https://openintel.nl/data/dictionary/) — field-level reference for every record type (required)
  • LACeS Anycast Census (https://manycast.net) — the anycast dataset used in Task 2 (required)
  • OpenINTEL Zone-Based Measurements (https://openintel.nl/data/forward-dns/zone-based/) — how the measurement is taken, and how to download the original data
  • OpenINTEL-Spark presentation (ships in-repo as a PDF) — worked Spark + OpenINTEL walkthrough
Your answers are saved in this browser only — nothing is sent anywhere. Use the buttons above to keep or share a copy.