Los Angeles/Colorado Application and Network Information Community (LACANIC)

Project Description

The LACANIC project’s goal is to develop datasets and measurement techniques that improve Internet security and reliability. We distribute these datasets through IMPACT.

As part of this work we:

provide regular data collection to collect long-term, longitudinal data
curate datasets for special events
make data accessible through websites and portals
develop new measurement approaches

We provide several types of datasets:

anonymized packet headers and network flow data, often to document events like distributed denial-of-service (DDoS) attacks and regular traffic
Internet censuses and surveys for IPv4 to document address usage
Internet hitlists and histories, derived from IPv4 censuses, to support other topology studies
Internet outage observations about IPv4, collected from six locations around the world
application data, like DNS and Internet-of-Things mapping, to document regular traffic and DDoS events
and we are developing other datasets

Our datasets are documented on our website, with details about what we provide and how it can be obtained.

LACANIC is a joint effort of the ANT Lab involving USC/ISI (PI: John Heidemann) and Colorado State University (PI: Christos Papadopoulos).

Support

LACANIC is supported by the DHS HSARPA Cyber Security Division, through a grant sponsored by Air Force Research Laboratory under agreement number FA8750-17-2-0280. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon.

People

Guillermo Baltra, PhD student (USC CS Dept. and ISI)
John Heidemann, PI on this project, project leader and professor (USC/ISI)
Christos Papadopoulos, co-PI on this project, professor (University of Memphis) christos.papadopoulos (at) memphis.edu
Yuri Pradkin, researcher (USC/ISI)

Publications

Giovane C. M. Moura, Sebastian Castro, John Heidemann and Wes Hardaker 2021. TsuNAME: exploiting misconfiguration and vulnerability to DDoS DNS. Proceedings of the ACM Internet Measurement Conference (Virtual, Nov. 2021), 398–418. [DOI] [PDF] Details
Abdul Qadeer and John Heidemann 2021. Efficient Processing of Streaming Data using Multiple Abstractions. Proceedings of the IEEE International Conference on Cloud Computing (Virtual, Sep. 2021), 157–167. [DOI] [PDF] Details
Lan Wei and John Heidemann 2020. Whac-A-Mole: Six Years of DNS Spoofing. Technical Report arXiv:2011.12978v1. USC/ISI. [PDF] Details
Abdul Qadeer and John Heidemann 2020. Plumb: Efficient Stream Processing of Multi-User Pipelines. Software—Practice and Experience. 51, 2 (2020), 385–408. [DOI] [PDF] Details
Hang Guo and John Heidemann 2020. Detecting IoT Devices in the Internet. ACM/IEEE Transactions on Networking. 28, 5 (Oct. 2020). [DOI] [PDF] Details
Giovane C. M. Moura, John Heidemann, Wes Hardaker, Jeroen Bulten, Joao Ceron and Christian Hesselman 2020. Old but Gold: Prospecting TCP to Engineer DNS Anycast (extended). Technical Report ISI-TR-739b. USC/Information Sciences Institute. [PDF] Details
Hang Guo and John Heidemann 2020. IoTSTEED: Bot-side Defense to IoT-based DDoS Attacks (Extended). Technical Report ISI-TR-738. USC/Information Sciences Institute. [PDF] Details
Lan Wei, Marcel Flores, Harkeerat Bedi and John Heidemann 2020. Bidirectional Anycast/Unicast Probing (BAUP): Optimizing CDN Anycast. Proceedings of the IEEE Network Traffic Monitoring and Analysis Conference (Berlin, Germany, Jun. 2020). [PDF] Details
Giovane C. M. Moura, Sebastian Castro, John Heidemann and Wes Hardaker 2021. TsuNAME vulnerability and DDoS against DNS. Technical Report ISI-TR-740. USC/Information Sciences Institute. [PDF] Details
Guillermo Baltra and John Heidemann 2020. Improving Coverage of Internet Outage Detection in Sparse Blocks. Proceedings of the Passive and Active Measurement Workshop (Eugene, Oregon, USA, Mar. 2020). [PDF] Details
Hang Guo, Xun Fan, Anh Cao, Geoff Outhred and John Heidemann 2019. Peek Inside the Closed World: Evaluating Autoencoder-Based Detection of DDoS to Cloud. Technical Report arXiv:1912.05590v2 [cs.NI]. arXiv. [PDF] Details
Ryan Bogutz, Yuri Pradkin and John Heidemann 2019. Identifying Important Internet Outages. Sixth National Symposium for NSF REU Research in Data Science, Systems, and Security (Dec. 2019). [PDF] Details
Ryan Bogutz, Yuri Pradkin and John Heidemann 2019. Identifying Important Internet Outages (extended). Technical Report ISI-TR-735. USC/Information Sciences Institute. [PDF] Details
Giovane C. M. Moura, John Heidemann, Ricardo de O. Schmidt and Wes Hardaker 2019. Cache Me If You Can: Effects of DNS Time-to-Live. Proceedings of the ACM Internet Measurement Conference (Amsterdam, the Netherlands, Oct. 2019), to appear. [DOI] [PDF] Details
Abdul Qadeer and John Heidemann 2019. Plumb: Efficient Processing of Multi-User Pipelines (Poster). USC/Information Sciences Institute. [PDF] Details
Kensuke Fukuda and John Heidemann 2018. Who Knocks at the IPv6 Door? Detecting IPv6 Scanning. Proceedings of the ACM Internet Measurement Conference (2018, Oct. 2018). [DOI] [PDF] Details
Giovane C. M. Moura, John Heidemann, Moritz Müller, Ricardo de O. Schmidt and Marco Davids 2018. When the Dike Breaks: Dissecting DNS Defenses During DDoS. Proceedings of the ACM Internet Measurement Conference (Oct. 2018). [DOI] [PDF] Details
Liang Zhu and John Heidemann 2018. LDplayer: DNS Experimentation at Scale. Proceedings of the ACM Internet Measurement Conference (Boston, Massachusetts, USA, Oct. 2018), to appear. [DOI] [PDF] [Code] Details
Abdul Qadeer and John Heidemann 2018. Plumb: Efficient Processing of Multi-User Pipelines (Poster Abstract). Proceedings of the Symposium on Cloud Computing (Carlsbad, CA, USA, Oct. 2018), 519. [DOI] [PDF] Details
Abdul Qadeer and John Heidemann 2018. Plumb: Efficient Processing of Multi-Users Pipelines (Extended). Technical Report ISI-TR-727. USC/Information Sciences Institute. [PDF] Details
John Heidemann, Yuri Pradkin and Guillermo Baltra 2018. The Policy Potential of Measuring Internet Outages. Proceedings of the TPRC, the Research Conference on Communication, Information and Internet Policy (Washington, DC, USA, Sep. 2018). [PDF] Details
Hang Guo and John Heidemann 2018. IP-Based IoT Device Detection. Proceedings of the ACM SIGCOMM Workshop on IoT Security and Privacy (Budapest, Hungary, Aug. 2018), 36–42. [DOI] [PDF] [Dataset] Details
Calvin Ardi and John Heidemann 2018. Leveraging Controlled Information Sharing for Botnet Activity Detection. Proceedings of the ACM SIGCOMM Workshop on Traffic Measurements for Cybersecurity (Budapest, Hungary, Aug. 2018), 14–20. [DOI] [PDF] Details
Hang Guo and John Heidemann 2018. Detecting IoT Devices in the Internet (Extended). Technical Report ISI-TR-726B. USC/Information Sciences Institute. [PDF] Details
Giovane C. M. Moura, John Heidemann, Ricardo de O. Schmidt and Wes Hardaker 2019. Cache Me If You Can: Effects of DNS Time-to-Live (extended). Technical Report ISI-TR-734b. USC/Information Sciences Institute. [PDF] Details
Giovane C. M. Moura, John Heidemann, Moritz Müller, Ricardo de O. Schmidt and Marco Davids 2018. When the Dike Breaks: Dissecting DNS Defenses During DDoS (extended). Technical Report ISI-TR-725b. USC/Information Sciences Institute. [PDF] Details
Guillermo Baltra and John Heidemann 2019. Improving the Optics of Active Outage Detection (extended). Technical Report ISI-TR-733. USC/Information Sciences Institute. [PDF] Details
John Heidemann 2018. Internet Outages: Reliablity and Security. Invited talk at University of Oregon Cybersecurity Day. [PDF] Details
John Heidemann 2018. Outage Clustering: From Leaves to Trees. Talk at CAIDA Active Internet Measurement Workshop (AIMS). [PDF] Details
John Heidemann 2018. Internet Reliability, from Addresses to Outages. Talk at MIT CSAIL. [PDF] Details
John Heidemann, Yuri Pradkin and Aqib Nisar 2018. Back Out: End-to-end Inference of Common Points-of-Failure in the Internet (extended). Technical Report ISI-TR-724. USC/Information Sciences Institute. [PDF] Details

For related publications, please see the ANT publications web page.

Software

cryptopANT C/C++ Library/tool for IP address anonymization
dag scrubber Tool for scrubbing packet traces
dnsanon extract DNS traffic from pcap to text with optionally anonymization
dnsanon_rssac Dnsanon_rssac is an implementation of RSSAC-002v2 processing for DNS statistics
icmptrain-hadoop-reader Hadoop reader/format for census/survey data
IP Hitlist Generation Scripts for IP Hitlist generation
knot_dnsrtt Knot DNSRTT extends Knot to solicit TCP DNS queries for each subnet.
LANDER Trace Software LANDER Trace Capture software handles for packet capture, scrubbing, and triggering user-provided scripts
LDplayer/dns-replay-client Replay DNS queries against a DNS server with correct timing and optionally log timing or latency.
LDplayer/dns-replay-controller LDplayer component
LDplayer/dns-query-mutator LDplayer component
LDplayer/dns-replay-proxy A proxy that helps to emulate DNS hierarchy in DNS trace replay.
LDplayer/dns-route-setup LDplayer component
LDplayer/dns-zone-constructor LDplayer component
mtracecap packet capture tool
outage_adaptive_geolocation Scripts we run to geolocate our outage_adaptive datasets
print_datafile tool for decoding census/survey data

Datasets

We make all datasets and specifically our network outage datasets public through the LACANIC project.