Mingwei Zhang

BGP anomalies, especially like BGP hijackings, are still hard to understand. We use the existing visualization tool, BGPlayJS, to help people understand the BGP anomaly events. We compiled a list of BPG anomaly events and present them into vivid visualization webpages.

Internet routing system reacts to routing changes by sending BGP updates. By observing the flow of global BGP updates, we can infer the Internet routing system running status on certain time period. Events like natural disasters and large-scale electricity blackouts could trigger a large amount of BGP updates. We' developed Java-based Internet-level BGP monitoring system that detects such events. Upon detecting any event, a serious of analysis will be done to provide further information of the… Show more

Internet routing system reacts to routing changes by sending BGP updates. By observing the flow of global BGP updates, we can infer the Internet routing system running status on certain time period. Events like natural disasters and large-scale electricity blackouts could trigger a large amount of BGP updates. We' developed Java-based Internet-level BGP monitoring system that detects such events. Upon detecting any event, a serious of analysis will be done to provide further information of the event, such as potential root cause AS, affected areas and the severeness of the impact. It works like an earthquake seismograph, so we call it Internet seismograph. Show less

There are many BGP monitoring and anomaly detection systems with multiple granularities, such as prefix-level monitors and dynamics-level monitors. However, there is yet a comprehensive monitoring system that can perform BGP monitoring task within the same framework. In this project, we're trying to design and implement a comprehensive framework that enables users to monitoring BGP traffics and detect BGP anomalies in real-time. Beside real-time, the framework also enables extensibility… Show more

There are many BGP monitoring and anomaly detection systems with multiple granularities, such as prefix-level monitors and dynamics-level monitors. However, there is yet a comprehensive monitoring system that can perform BGP monitoring task within the same framework. In this project, we're trying to design and implement a comprehensive framework that enables users to monitoring BGP traffics and detect BGP anomalies in real-time. Beside real-time, the framework also enables extensibility, meaning new functionalities and designs can be easily plugged in and working simultaneously and independently. Show less

In network topology discovery, the MRINFO is a important tool that can quickly discover connections among multi-cast enabled routers. In this project, I use MRINFO together with XNET to recursively probe and discover all the connectivity information any give IP addresses. With Prefuse visualization toolkit, the discovered topology and be seen and reviewed clearly. Besides, I also use iffinder to do alias resolution to reduce the duplicate edges between same pair of routers.

Resource Public Key Infrastructure (RPKI) allows users to certify their resources to help secure Internet routing, however it is vulnerable to different kinds of malicious manipulations. This detections system monitors changes in RPKI repository and detect anomalies on RPKI.

wo-factor authentication provides one more layer of security than a single password authentication system. Different methods have been brought up along the development of crypographic and information security. The majority of two-factor authentication are deployed for web applications.
In this project, we designed a two-factor security scheme for local machine authentication.
With this scheme, people can easily deploy a local two-factor authentication to provide another layer of… Show more

wo-factor authentication provides one more layer of security than a single password authentication system. Different methods have been brought up along the development of crypographic and information security. The majority of two-factor authentication are deployed for web applications.
In this project, we designed a two-factor security scheme for local machine authentication.
With this scheme, people can easily deploy a local two-factor authentication to provide another layer of authentication protection.
The design is based on Google's open-source two-step authenticator project, which could be deployed on multiple platforms including PC, Mac, Smartphone and Java-compatible devices. Show less

Used open source encryption library libgcrypt, to create tools to encrypt and decrypt files in both local and remote modes. Project used Git as the version control system, and published in bitbucket.org

Client-server applications can cause bandwidth overload on the server side when large amount of clients sending data requests to one single server.
This problem can be solved by enabling peer-to-peer data sharing between clients.
However, by using peer-to-peer network, data integrity and sharing incentives becomes a concern.
Li's work of mSSL, addressed this problem and provided a solution for secure file transmission.
mSSL protocol provides a secure file sharing environment in a… Show more

Client-server applications can cause bandwidth overload on the server side when large amount of clients sending data requests to one single server.
This problem can be solved by enabling peer-to-peer data sharing between clients.
However, by using peer-to-peer network, data integrity and sharing incentives becomes a concern.
Li's work of mSSL, addressed this problem and provided a solution for secure file transmission.
mSSL protocol provides a secure file sharing environment in a hybrid peer-to-peer network with efficient data integrity verification capability.

We introduce a prototype of file sharing system that applies mSSL protocol on JXTA peer-to-peer network.
JXTA is a light-weight peer-to-peer network platform, which includes several open-source protocols.
By applying JXTA, we can quickly create the background peer-to-peer network for mSSL.
Combining mSSL with JXTA, the prototype provides a complete Java package for file sharing applications.
User can use one single package to achieve both functions of setting up network and providing file sharing services.
Besides, we also conducted a series of tests on mSSL's key function -- integrity verification.
The results show that mSSL's integrity function is efficient for different sizes of files.
Show less

Due to operational malpractice or security attacks, an IP prefix (i.e., a block of IP addresses) can undergo many types of routing anomalies. Perhaps the most well-known of such anomalies is prefix hijacking, where an attacker hijacks traffic meant to reach the legitimate user of a prefix. Anomalies can also easily occur through misconfiguration, such as route leaks which affect large portions of the address space. While various solutions have been proposed to detect such attacks, these… Show more

Due to operational malpractice or security attacks, an IP prefix (i.e., a block of IP addresses) can undergo many types of routing anomalies. Perhaps the most well-known of such anomalies is prefix hijacking, where an attacker hijacks traffic meant to reach the legitimate user of a prefix. Anomalies can also easily occur through misconfiguration, such as route leaks which affect large portions of the address space. While various solutions have been proposed to detect such attacks, these solutions are limited and susceptible to attacker countermeasures.

Our work is called Buddyguard, a new approach to detecting prefix anomalies and prefix hijacking in particular. Buddyguard compares the routes to a monitored prefix with the routes to numerous buddy prefixes that behave similarly to the monitored prefix, and detects anomalies when the routes to the monitored prefix differ significantly from the routes to the buddy prefixes. Our evaluation results show that Buddyguard provides fast and accurate monitoring of IP prefix anomalies, and its introduction and use of buddy prefixes enables it to be resilient against resourceful attackers. Show less