Analyzing the Impact of Granularity on IP-to-AS Mapping

Presented by Baobao ZhangAuthours:Baobao Zhang, Jun Bi, Yangyang Wang, Jianping Wu

1 Introduction

Doing? Map the IP address to the AS that uses the IP

Meaning Help network managers diagnose network

failure Discover the AS-level topology with

traceroute Some other applications that need to map IP

to AS

An example

2 Data Collection

Data Source Traceroute Data (From CAIDA) BGP Routing Table (from routeviews)

Processing into pairs Extract the prefixes and AS paths from routing tables Extract the destination IPs and IP paths from traceroute

data Find the longest matching prefix for the destination IP The IP path associated with the destination IP and the AS

path associated with the longest prefix form one pair Origin IP-to-AS mapping

Extract the prefixes and its origin ASes from routing tables Map every prefix to its origin AS

Data Collection

Date: 04/22/2010 During: One Day

3 Methodology

Definition Exact Match Ambiguous Match Mismatch

Methods Prefix-granularity Method (PGM) IP-granularity Method (IGM) Prefix-granularity Limit Method (PGLM) Hierarchical Mapping System (HMS)

Assumption The traceroute path is consistent with the BGP AS

path.

Methods

Prefix-granularity Method (PGM) i.e. Mao’s Method Bind many IP addresses into one prefix Map one prefix to many ASes by setting threshold Tight coupling

Pros Can modify the incorrect mappings for the IPs that don’t

appear in the training dataset Cons

Mistakenly modify the originally correct mappings for the IPs that don’t appear in the training dataset. (tight coupling)

Threshold. Miss to modify the incorrect mappings for the IPs that appear in the training dataset

Threshold. Bring about ambiguous mappings

Methods

IP-granularity Method (IGM) We propose it for the first time Map one IP to one only AS Loose coupling

Pros Eliminate the ambiguous mappings

Cons Only can modify the mappings for the IPs

that appear in the training dataset.

Methods

Prefix-granularity Limit Method (PGLM) One fictitious Method The Limit of PGM. Set the threshold

=0 It is only used to be compared

Methods

Hierarchical Mapping System (HMS) Combine the IGM with PGM Three levels (/32 level, /24 level, origin level) Firstly look up in the /32 level mapping, then /24

level mapping, finally the origin level mapping Pros

complement the strength of tight coupling and loose coupling

Cons * inherit the characteristic of ambiguity from

PGM

4 Evaluation

DataSet

Evaluation

Training Accuracy

Evaluation

Validation Accuracy

Evaluation

Compare trained mapping with the origin mapping

Evaluation

5 Classification Tree Analysis

Motivation Quantify the pros and cons for the

IGM and PGM Analyze the obstacles in the way of

improving the accuracy for the IGM and PGM

Other potential findings

Constructing Classification Tree

Table 7 The improvement gained by correcting the mapping of

the types for the PGM VDS1gain

VDS2gain

VDS3gain

VDS4gain

Type1 0.00% 0.00% 0.00% 0.00%

Type2 0.71% 0.02% 0.27% 0.05%

Type3 14.25% 8.47% 8.15% 10.30%

Type4 0.00% 0.00% 0.00% 0.00%

Type5 2.37% 1.55% 0.35% 2.47%

Type6 0.00% 0.00% 0.00% 0.00%

Type7 0.80% 1.57% 1.47% 1.05%

Type8(Base)

-0.29%(5.66%)

-0.64%(7.34%)

-0.15%(6.79%)

-0.33%(6.20%)

Type1-2(Base)

0.00%(1.06%)

0.00%(0.61%)

0.00%(0.58%)

0.00%(1.92%)

Type2-2 0.36% 0.06% 1.01% 0.25%

Type3-2 0.42% 1.12% 22.29% 15.08%

Type4-2 0.00% 0.00% 0.00% 0.00%

Type5-2 0.45% 0.17% 0.25% 3.30%

Type8-2(Base)

0.00%(2.93%)

0.00%(2.38%)

-0.03%(2.22%)

-0.01%(0.15%)

Type-all 19.85% 12.87% 35.18% 32.94%

5.1 Quantify the pros and cons for the IGM and PGM

Pros and Cons (+) modify the incorrect mappings for the IPs that don’t

appear in the training dataset (Type 8-2, 1-2 for PGM, nothing for IGM)

(-) Mistakenly modifies the originally correct mappings for the IPs that don’t appear in the training dataset. (Type 2-2 for PGM , nothing for IGM)

(-) Miss to modify the incorrect mappings for the IPs that appear in the training dataset (Type3 for PGM and IGM)

Quantifying For PGM, Base(type8-2)+base(type1-2)-gain(type2-2) is

positive. 3.63%, 2.93%, 1.79% and 1.81% PGM(gain(type3))-IGM(gain(type3)) . 14.00%, 8.38%, 7.94% and 9.81%

Conclusion The IGM is superior to the PGM

5.2 Analyze the obstacles in the way of improving the accuracy for the IGM and PGM

IGM Type 7. (IPs do not appear in the

training dataset) PGM

Type 3. (IPs appear in the training dataset, but miss to modify due to the tight coupling)

Type 3-2. (IPs do not appear in the training dataset)

5.3 Other findings

The limit of validation accuracy1-gain(type2) -gain(type3)-gain(type5)

For IGM98.87%,97.96%,98.43% ,98.96%

For PGM82.66%,89.96%,91.23% ,87.18%

Other findings

Illustrating that the IGM has more potential to

improve the accuracy than the PGM

6 Conclusion

Proposed a hierarchical IP-to-AS mapping system

Analyzed and quantified the impact of granularity