Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016...
Transcript of Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016...
![Page 1: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/1.jpg)
SatelliteWill Scott, Thomas Anderson, Tadayoshi Kohno, Arvind Krishnamurthy
University of Washington
![Page 3: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/3.jpg)
![Page 4: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/4.jpg)
![Page 5: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/5.jpg)
https://freedomhouse.org/report/freedom-net-2015/maps-and-graphics
![Page 6: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/6.jpg)
twitter.com
Server IP8.8.8.8 (US) 199.59.149.19877.88.8.8 (Russia) 199.16.156.102180.76.76.6 (China) 159.106.121.75
![Page 7: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/7.jpg)
twitter.com
Server IP8.8.8.8 (US) 199.59.149.19877.88.8.8 (Russia) 199.16.156.102180.76.76.6 (China) 159.106.121.75
ResultTwitterTwitterFailure
![Page 8: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/8.jpg)
Structure• How & Why of measurement
• Background
• Algorithmic Identification
• Measurement Collection System
• Determination of Censorship
• Results
![Page 9: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/9.jpg)
DNSDNS
Server
![Page 13: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/13.jpg)
DNS
Resolver
ns.bbc.co.ukServer
![Page 14: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/14.jpg)
DNS
Resolver
ns.bbc.co.ukServer
Resolver
Server
![Page 17: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/17.jpg)
DNS
Resolver
ResolverResolver
![Page 18: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/18.jpg)
Scale
• Open Resolvers: 7,000,000
• Networks with >20 resolvers: ~20,000
• Countries with >20 resolvers: ~170
• Scan frequency: weekly
![Page 19: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/19.jpg)
Wikipedia DNS ResolutionsN
umbe
r of r
esol
utio
ns
1
100
10000
Resolved IP
198.35.26.96
Wikipedia has four IP addresses that are returned everywhere
![Page 20: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/20.jpg)
Google DNS ResolutionsN
umbe
r of r
esol
utio
ns
1
100
10000
Resolved IP
Google does not have a single set of ‘correct’ IP addresses
![Page 21: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/21.jpg)
Overall DNS Resolutions
1 5 10 50 100Dominant
IP addresses
0.2
0.4
0.6
0.8
1.0% Domains
20% of domains do not have a small number of dominant IPs
![Page 22: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/22.jpg)
Divergenceimgur.com scribd.com
AS 2856British Telecom
185.31.19.193: 130 185.31.18.193: 49
185.31.19.175: 183 185.31.18.175: 173
AS 12880ITC
199.27.73.193: 123 23.235.47.193: 50 199.27.79.193: 48
10.10.34.36: 214 185.31.17.175: 31
Censorship causes divergence from expected CDN responses
![Page 23: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/23.jpg)
Structure• How & Why of measurement
• Background
• Algorithmic Identification
• Measurement Collection System
• Determination of Censorship
• Results
![Page 26: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/26.jpg)
Domain Similaritya.com b.com
AS25
5.5.5.5
AS73
5.5.6.6 192.168.1.1
AS12880
![Page 27: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/27.jpg)
Domain Similarity
• DomainSimilarity(A,B)
• IPTrust(A, IP)
Clusters appear through iterative computation to a fixed point
![Page 28: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/28.jpg)
A few iterations produce well-defined clusters
![Page 29: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/29.jpg)
CDNsFastly Domain Alexa Rank
imgur.com 47
cnn.com 84
bbc.com 131
wikihow.com 238
scribd.com 449
kickstarter.com 529
www.gov.uk 684
![Page 30: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/30.jpg)
Implementation• Weekly scan of top 10,000 domains
• 1 Machine. Modified zmap client
• Scan time of 3 days at 100,000 pps
• 300GB weekly collection
• 2 years of measurements, code
![Page 31: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/31.jpg)
Censorship
![Page 32: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/32.jpg)
Structure• How & Why of measurement
• Background
• Algorithmic Identification
• Measurement Collection System
• Determination of Censorship
• Results
![Page 33: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/33.jpg)
Correctness
>90% identification. 95% of misidentifications are conservative
![Page 34: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/34.jpg)
CDNsCDN Size Representative
DomainCloudFlare 726 reddit.comAWS 647 amazon.com
Akamai 410 ebay.comGoogle 141 google.com
Dyn 112 webmd.comRackspace 77 wikihow.com
Fastly 72 imgur.comEdgecast 68 soundcloud.comIncapsula 55 wix.com
![Page 35: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/35.jpg)
Censorship
![Page 36: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/36.jpg)
![Page 37: Satellite - USENIX · Twitter Twitter Failure. Structure ... aty-slides.key Created Date: 6/22/2016 1:12:32 AM ...](https://reader034.fdocuments.net/reader034/viewer/2022050507/5f987cc3c16e04234c4ad9f8/html5/thumbnails/37.jpg)
Satellite
Will Scott <[email protected]> satellite.cs.washington.edu
• CDN mapping and censorship detection are related
• Satellite estimates both from observed behavior
• Public dataset of weekly global measurements of Alexa top 10,000 domains from a single machine