Skip to main content
CAIDA home

NIDS Assignment Planning Guide

NIDS Assignment Planning Guide

Before creating any files, work through this short set of questions about what your assignment introduces, what it assumes, and what could go wrong. Fill it in directly in the browser; download the result as Markdown or Word to keep, share, or paste into an issue.

This is step zero — before the content guide walks through what a finished repository should contain, and the style guide specifies exactly how each file is written, work through this page to sketch your assignment at a high level. Fill in the fields below directly in your browser; nothing is sent anywhere, and the two buttons at the bottom let you download what you wrote as a Markdown or Word file to keep, paste into an issue, or share with the NIDS team.

We’re pulling examples throughout this guide from nids-dns-ecosystem, a published NIDS assignment.

Focus

Two sentences, one per box below: the first names what you are introducing, the second says how the tasks force engagement. Name at least one thing beyond the dataset — a tool, a practice, or an idea. A practice is a way of working — scaling a prototype into a batch job, writing index-aware queries against a large table. An idea is a concept that outlives the dataset — customer cone, market concentration, provenance.

Example (nids-dns-ecosystem)
  • What you are introducing: OpenINTEL's daily zone-based DNS measurements and the LACeS Anycast Census, read with PySpark over S3A, together with the practice of prototyping a query on a small TLD before scaling it to a large one and the idea that concentration, shared fate, and adoption lag are measurable properties of any critical Internet service.
  • How the tasks force engagement: Every task re-derives from raw records a claim a student would otherwise take on faith — that DNS is redundant, that it is secured — and Task 1's provider mapping is the input to Task 2, so a shortcut taken early surfaces as a wrong answer later.

Dataset, tool, practice, or idea in this assignment.

How will the tasks force the student to engage with this new material?

Description

Expand on Focus, covering only these four points.

Example (nids-dns-ecosystem)
  • Introduces: Dataset — OpenINTEL zone-based measurements (NS, DNSKEY, DS, CAA, TXT, SOA records) and the LACeS Anycast Census; Tool — PySpark with the S3A connector, reading partitioned Parquet straight from an object store; Idea — market concentration and systemic dependency, measured with the HHI
  • Assumes: nothing — no prerequisite NIDS assignment
  • Forces engagement: tasks re-derive "DNS is resilient/secure" claims from raw records instead of taking them on faith
  • Produces: nids-dns-ecosystem.ipynb with market-share/HHI plots, longitudinal trend charts, and 18 answered questions

Dataset, tool, practice, or idea. Be specific: "Internet topology" is not an answer; "router-level links inferred from traceroute, and when their inferred geolocation can be trusted" is.

What a prerequisite assignment already covers. Anything not covered is new material your assignment has to teach.

A student must not be able to finish a task by falling back on what they already knew.

The concrete outputs.

Reading

The papers, docs, blog posts, and talks your group is drawing on for inspiration. One line each: source and link — what idea it contributes. Check Required for anything you would put in front of the students as part of the assignment itself.

Example (nids-dns-ecosystem)
  • OpenINTEL Project (https://openintel.nl) — the DNS measurement platform the assignment runs on (required)
  • OpenINTEL Data Dictionary (https://openintel.nl/data/dictionary/) — field-level reference for every record type (required)
  • LACeS Anycast Census (https://manycast.net) — the anycast dataset used in Task 2 (required)
  • OpenINTEL Zone-Based Measurements (https://openintel.nl/data/forward-dns/zone-based/) — how the measurement is taken, and how to download the original data
  • OpenINTEL-Spark presentation (ships in-repo as a PDF) — worked Spark + OpenINTEL walkthrough

Related Reading

Adjacent material worth pointing at but not central to your design: background on the protocol, the paper that introduced a dataset, an existing NIDS assignment that overlaps with yours.

Example (nids-dns-ecosystem)
  • RFC 1034 §4.1 (https://www.rfc-editor.org/rfc/rfc1034) — the two-nameserver requirement Task 2 measures against
  • RFC 7208 (https://www.rfc-editor.org/rfc/rfc7208) — SPF record format and qualifier semantics
  • 2016 Dyn DDoS incident coverage — motivates why DNS concentration matters

Prerequisite Assignments

List existing assignments students should complete before your assignment. Anything not covered by a prerequisite is new material your assignment has to teach. For tools specifically — one no prerequisite covers needs its own guide in your repository; one a prerequisite covers only partly needs a guide covering just the difference.

Example (nids-dns-ecosystem)
  • None — this assignment is self-contained and does not depend on material from other NIDS assignments.

Resources

Name the actual data sources — not "routing data," the actual collector, table, or day. One line each: Source and link | what you'll use | how you get it (and whether it needs a login).

Example (nids-dns-ecosystem)
  • OpenINTEL Forward DNS (.se TLD) | NS/DNSKEY/DS/CAA/TXT/SOA records, ~1M domains/day, 2016–present | public S3 (object.openintel.nl) via PySpark+S3A, no login
  • LACeS Anycast Census | AB/GCD anycast scores at /24 granularity | manycast.net, small one-time download, no login

Tools

The query languages, libraries, and platforms the student will actually use. One line each: Tool | new, or covered by which prerequisite | needs a guide?. Anything new needs a guide in your repository.

Example (nids-dns-ecosystem)
  • PySpark + S3A | New | Yes — ships as Spark.md
  • dnspython | New | No — covered inline in Datasets.md and Task-2-resilience.md
  • tldextract | New | No — but Task-1-centralization.md explains why splitting on a dot gets the registrable domain wrong

Challenges

What could go wrong? Write it down now, while there is still time to change course: Is the data bigger than you can process in the time you have? Does any of it need access you don't yet have? Is the scope too broad to finish — or so narrow the student learns nothing new? Will the analysis land on a clean result, or on "it depends"? What's your fallback if the main analysis doesn't work?

Example (nids-dns-ecosystem)
  • .fr/.se snapshots run 1–4M domains/day, too big for a laptop — recommend .gov/.li to prototype, .se on NRP's Spark cluster for the graded run
  • A 2019–2024 trend could land on "it depends" — anchor it to events inside the window and make the questions ask for them (Q6 on market-share shifts, Q17 on adoption inflection points); the 2010 Cloudflare and Route 53 launches predate the window and cannot appear in it

Tasks

Break the assignment into tasks. Most existing NIDS assignments land on about three, plus a short setup step — but use as many as the material actually needs.

Example (nids-dns-ecosystem)
  • Task 0: Setup and Data Access — confirm the SparkSession starts and can reach OpenINTEL's S3 endpoint
  • Task 1: DNS Hosting Centralization — provider market share, HHI, and the longitudinal concentration trend
  • Task 2: DNS Infrastructure Resilience & Anycast — NS redundancy, provider diversity, SOA parameters, anycast cross-reference
  • Task 3: DNS Security Best Practices — DNSSEC, CAA, and SPF adoption in one snapshot, then across years
Your answers are saved in this browser only — nothing is sent anywhere. Use the buttons above to keep or share a copy.