Internet Populations (Good and Bad): Measurement, Estimation, and Correlation. Heidemann, J. Presentation at ICERM Workshop on Cybersecurity, October, 2014.
Internet Populations (Good and Bad): Measurement, Estimation, and Correlation [link]Paper  abstract   bibtex   
Our research studies the Internet's public face. Since 2006 we have been taking censuses of the Internet address space (pinging all IPv4 addresses) every 3 months. Since 2012 we have studied network outages and events like Hurricane Sandy, using probes of much of the Internet every 11 minutes. Most recently we have evaluated the diurnal Internet, finding countries where most people turn off their computers at night. Finally, we have looked at network reputation, identifying how spam generation correlates with network location, and others have studies multiple measurements of ``network reputation''. \newline ∈dent A common theme across this work is one must estimate characteristics of the edge of the Internet in spite of noisy measurements and a underlying changes. One also need to compare and correlate these imperfect measurements with other factors (from GDP to telecommunications policies). \newline ∈dent How do these applications relate to the mathematics of census taking and measurement, estimation, and correlation? Are there tools we should be using that we aren't? Do the properties of the Internet suggest new approaches (for example where rapid full enumeration is possible)? Does correlation and estimates of network ``badness'' help us improve cybersecurity by treating different parts of the network differently?
@Misc{Heidemann14e,
	author = 	"John Heidemann",
	title = 	"Internet Populations (Good and Bad): Measurement, Estimation, and Correlation",
	howpublished = "Presentation at ICERM Workshop on Cybersecurity",
	address = "Providence, Rhode Island",
	month = 	oct,
	year = 	2014,
	sortdate = "2014-10-22",
	project = "ant, lacrend, retrofuture",
	jsubject = "network_topology",
	jlocation = 	"johnh: pafile",
	keywords = 	"internet census, outages, diurnal, math",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Heidemann14e.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Heidemann14e.pdf",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
	abstract = "
Our research studies the Internet's public face.  Since 2006 we have
been taking censuses of the Internet address space (pinging all IPv4
addresses) every 3 months.  Since 2012 we have studied network outages
and events like Hurricane Sandy, using probes of much of the Internet
every 11 minutes.  Most recently we have evaluated the diurnal
Internet, finding countries where most people turn off their computers
at night.  Finally, we have looked at network reputation, identifying
how spam generation correlates with network location, and others have
studies multiple measurements of ``network reputation''. \newline \indent
A common theme across this work is one must estimate characteristics
of the edge of the Internet in spite of noisy measurements and a
underlying changes.  One also need to compare and correlate these
imperfect measurements with other factors (from GDP to
telecommunications policies). \newline \indent
How do these applications relate to the mathematics of census taking
and measurement, estimation, and correlation?  Are there tools we
should be using that we aren't?  Do the properties of the Internet
suggest new approaches (for example where rapid full enumeration is
possible)?  Does correlation and estimates of network ``badness'' help
us improve cybersecurity by treating different parts of the network
differently?
",
}

Downloads: 0