Demonstration venue · read-only. Every page can be browsed; the buttons that would change it are switched off. Create an account to run TaxoReview on your own data. A simulation from public publication records: the people listed were not invited and did not agree to review.
? Tutorial for this page

Brian Eriksson

dblp:29/2778 · DBLP profile ↗
← Back
27ranked-venue papers
13as first author
0since 2021 · last 2018
—ORCID · none

Domains — the database's venue-derived domains; a paper can count in several

Computer networks · 13 · 10 first-authorArtificial intelligence and machine learning · 10 · 1 first-authorGraphics, computer vision, multimedia, augmented reality and games · 4 · 1 first-authorDatabases, data management, data science and information retrieval · 2Security and privacy · 1 · 1 first-authorHuman-computer interaction and ubiquitous computing · 1

Expertise — from the expertise taxonomy: the topics of the expert's papers under the CCF categories. A weight counts papers with recency: 1 for a paper about the topic, 0.3 when the topic is its context, halved every five years.

Computer networks
13 papers
Network measurement and analytics · 64% Routing and switching · 11% Internet architecture and protocols · 10%
Artificial intelligence
6 papers
Probabilistic and Bayesian machine learning · 40% Efficient and distributed learning · 20% Optimization for machine learning · 14%
Databases, data mining, and information retrieval
3 papers
Data mining · 42% Web and social media mining · 35% Information retrieval · 23%
Human-computer interaction and pervasive computing
1 paper
Wearable and physiological sensing · 50% Health and well-being technologies · 50%

Topics — the 30 heaviest of 57, each with the papers that count most for it

TopicWeightPapersLastEvidence papers
Internet architecture and protocols › network topology
internet topology
0.452012
DomainImpute: Inferring unseen components in the Internet · INFOCOM 2011
Toward the Practical Use of Network Tomography for Internet Topology Discovery · INFOCOM 2010
Estimating Hop Distance Between Arbitrary Host Pairs · INFOCOM 2009
Network measurement and analytics › network tomography
topology inference
0.332011
Inferring Unseen Components of the Internet Core · IEEE J. Sel. Areas Commun. 2011
DomainImpute: Inferring unseen components in the Internet · INFOCOM 2011
Network discovery from passive measurements · SIGCOMM 2008
Machine learning › Efficient and distributed learning › model compression
low-rank approximation
0.312018
Wide Compression: Tensor Ring Nets · CVPR 2018
Machine learning › Efficient and distributed learning
model compression
0.312018
Wide Compression: Tensor Ring Nets · CVPR 2018
Machine learning › Representation and self-supervised learning
tensor decomposition
0.312018
Wide Compression: Tensor Ring Nets · CVPR 2018
Network measurement and analytics
internet topology mapping
0.322013
AliasCluster: A lightweight approach to interface disambiguation · INFOCOM 2013
Inferring Unseen Components of the Internet Core · IEEE J. Sel. Areas Commun. 2011
Network measurement and analytics
network tomography
0.322012
Efficient Network Tomography for Internet Topology Discovery · IEEE/ACM Trans. Netw. 2012
Toward the Practical Use of Network Tomography for Internet Topology Discovery · INFOCOM 2010
Data mining › clustering › model-based clustering
mixture model clustering
0.212016
Just One More: Modeling Binge Watching Behavior · KDD 2016
Web and social media mining › user behavior analysis
user behavior modeling
0.212016
Just One More: Modeling Binge Watching Behavior · KDD 2016
Network measurement and analytics
topology discovery
0.222012
Efficient Network Tomography for Internet Topology Discovery · IEEE/ACM Trans. Netw. 2012
Learning network structure from passive measurements · Internet Measurement Conference 2007
Machine learning › Learning theory
adaptive submodularity
0.212014
Large-Scale Optimistic Adaptive Submodularity · AAAI 2014
Machine learning › Probabilistic and Bayesian machine learning › statistical inference
bayesian inference
0.212014
Modeling Correlated Arrival Events with Latent Semi-Markov Processes · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › structured models › graphical models
gaussian graphical model
0.212014
Learning Latent Variable Gaussian Graphical Models · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › statistical inference › regression
generalized linear model
0.212014
Large-Scale Optimistic Adaptive Submodularity · AAAI 2014
Machine learning › Probabilistic and Bayesian machine learning › structured models
graphical models
0.212014
Learning Latent Variable Gaussian Graphical Models · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › structured models › graphical models
latent variable graphical model
0.212014
Learning Latent Variable Gaussian Graphical Models · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › monte carlo methods
markov chain monte carlo
0.212014
Modeling Correlated Arrival Events with Latent Semi-Markov Processes · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › stochastic processes
point process
0.212014
Modeling Correlated Arrival Events with Latent Semi-Markov Processes · ICML 2014
Machine learning › Probabilistic and Bayesian machine learning › statistical inference › bayesian inference
posterior inference
0.212014
Modeling Correlated Arrival Events with Latent Semi-Markov Processes · ICML 2014
Machine learning › Optimization for machine learning › combinatorial optimization
submodular maximization
0.212014
Large-Scale Optimistic Adaptive Submodularity · AAAI 2014
Machine learning › Optimization for machine learning › model-based optimization
bayesian optimization
0.212013
Sequential Bayesian Search · ICML (2) 2013
Machine learning › Reinforcement learning
multi-armed bandit
0.212013
Adaptive Submodular Maximization in Bandit Setting · NIPS 2013
Machine learning › Reinforcement learning
regret minimization
0.212013
Adaptive Submodular Maximization in Bandit Setting · NIPS 2013
Machine learning › Optimization for machine learning › combinatorial optimization
submodular optimization
0.212013
Adaptive Submodular Maximization in Bandit Setting · NIPS 2013
Information retrieval
interactive information retrieval
0.212013
Sequential Bayesian Search · ICML (2) 2013
Wearable and physiological sensing › biosignal sensing
electrodermal activity
0.212013
Predicting audience responses to movie content from electro-dermal activity signals · UbiComp 2013
Routing and switching › fault-tolerant routing
backup path routing
0.212013
RiskRoute: a framework for mitigating network outage threats · CoNEXT 2013
Network management and operations › fault management
fault diagnosis
0.212013
RiskRoute: a framework for mitigating network outage threats · CoNEXT 2013
Network measurement and analytics
geolocation
0.212013
Understanding geolocation accuracy using network geometry · INFOCOM 2013
Physical-layer communications
outage probability
0.212013
RiskRoute: a framework for mitigating network outage threats · CoNEXT 2013

Methods — techniques the papers use, named apart from their topics

regret analysis · 0.5survival analysis · 0.5statistical mixture model · 0.5semi-markov process · 0.4continuous-time modeling · 0.4MCMC · 0.4tensor ring factorization · 0.3sequential bayesian search · 0.3learning-based disambiguation · 0.3constraint-based inference · 0.2simulation · 0.2regularized maximum likelihood · 0.2parameter estimation · 0.2online learning · 0.2temporal feature analysis · 0.2optimization · 0.2measurement · 0.2exploration-exploitation trade-off · 0.2
YearPublicationVenuePosition
2018 Wide Compression: Tensor Ring Nets
abstract
Deep neural networks have demonstrated state-of-the-art performance in a variety of real-world applications. In order to obtain performance gains, these networks have grown larger and deeper, containing millions or even billions of parameters and over a thousand layers. The tradeoff is that these large architectures require an enormous amount of memory, storage, and computation, thus limiting their usability. Inspired by the recent tensor ring factorization, we introduce Tensor Ring Networks (TR-Nets), which significantly compress both the fully connected layers and the convolutional layers of deep neural networks. Our results show that our TR-Nets approach is able to compress LeNet-5 by 11× without losing accuracy, and can compress the state-of-the-art Wide ResNet by 243× with only 2.3% degradation in Cifar10 image classification. Overall, this compression scheme shows promise in scientific computing and deep learning, especially for emerging resource-constrained devices such as smartphones, wearables, and IoT devices.
Wenqi Wang 0001, Yifan Sun 0001, Brian Eriksson, Wenlin Wang, Vaneet Aggarwal
CVPR3
2018 Block CUR: Decomposing Matrices Using Groups of Columns
Urvashi Oswal, Swayambhoo Jain, Kevin S. Xu 0001, Brian Eriksson
ECML/PKDD (2)4
2016 Just One More: Modeling Binge Watching Behavior
abstract
Easy accessibility can often lead to over-consumption, as seen in food and alcohol habits. On video on-demand (VOD) services, this has recently been referred to as binge watching, where potentially entire seasons of TV shows are consumed in a single viewing session. While a user viewership model may reveal this binging behavior, creating an accurate model has several challenges, including censored data, deviations in the population, and the need to consider external influences on consumption habits. In this paper, we introduce a novel statistical mixture model that incorporates these factors and presents a first of its kind characterization of viewer consumption behavior using a real-world dataset that includes playback data from a VOD service. From our modeling, we tackle various predictive tasks to infer the consumption decisions of a user in a viewing session, including estimating the number of episodes they watch and classifying if they continue watching another episode. Using these insights, we then identify binge watching sessions based on deviation from normal viewing behavior. We observe different types of binging behavior, that binge watchers often view certain content out-of-order, and that binge watching is not a consistent behavior among our users. These insights and our findings have application in VOD revenue generation, consumer health applications, and customer retention analysis.
William Trouleau, Azin Ashkan, Weicong Ding, Brian Eriksson
KDD4
2014 Large-Scale Optimistic Adaptive Submodularity
abstract
Maximization of submodular functions has wide applications in artificial intelligence and machine learning. In this paper, we propose a scalable learning algorithm for maximizing an adaptive submodular function. The key structural assumption in our solution is that the state of each item is distributed according to a generalized linear model, which is conditioned on the feature vector of the item. Our objective is to learn the parameters of this model. We analyze the performance of our algorithm, and show that its regret is polylogarithmic in time and linear in the number of features. Finally, we evaluate our solution on two problems, preference elicitation and adaptive face detection, and demonstrate that high-quality policies can be learned sample efficiently.
Victor Gabillon, Branislav Kveton, Zheng Wen 0002, Brian Eriksson, S. Muthukrishnan 0001
AAAI4
2014 Modeling Correlated Arrival Events with Latent Semi-Markov Processes
abstract
The analysis and characterization of correlated point process data has wide applications, ranging from biomedical research to network analysis. In this work, we model such data as generated by a latent collection of continuous-time binary semi-Markov processes, corresponding to external events appearing and disappearing. A continuous-time modeling framework is more appropriate for multichannel point process data than a binning approach requiring time discretization, and we show connections between our model and recent ideas from the discrete-time literature. We describe an efficient MCMC algorithm for posterior inference, and apply our ideas to both synthetic data and a real-world biometrics application.
Wenzhao Lian, Vinayak A. Rao, Brian Eriksson, Lawrence Carin
ICML3
2014 Learning Latent Variable Gaussian Graphical Models
abstract
Gaussian graphical models (GGM) have been widely used in many high-dimensional applications ranging from biological and financial data to recommender systems. Sparsity in GGM plays a central role both statistically and computationally. Unfortunately, real-world data often does not fit well to sparse graphical models. In this paper, we focus on a family of latent variable Gaussian graphical models (LVGGM), where the model is conditionally sparse given latent variables, but marginally non-sparse. In LVGGM, the inverse covariance matrix has a low-rank plus sparse structure, and can be learned in a regularized maximum likelihood framework. We derive novel parameter estimation error bounds for LVGGM under mild conditions in the high-dimensional setting. These results complement the existing theory on the structural learning, and open up new possibilities of using LVGGM for statistical inference.
Zhaoshi Meng, Brian Eriksson, Alfred O. Hero III
ICML2
2014 Matroid Bandits: Fast Combinatorial Optimization with Learning
Branislav Kveton, Azin Ashkan, Hoda Eydgahi, Brian Eriksson
UAI5
2013 Learning to Top-K Search using Pairwise Comparisons
abstract
Given a collection of N items with some unknown underlying ranking, we examine how to use pairwise comparisons to determine the top ranked items in the set. Resolving the top items from pairwise comparisons has application in diverse fields ranging from recommender systems to image-based search to protein structure analysis. In this paper we introduce techniques to resolve the top ranked items using significantly fewer than all the possible pairwise comparisons using both random and adaptive sampling methodologies. Using randomly-chosen comparisons, a graph-based technique is shown to efficiently resolve the top O(\logN) items when there are no comparison errors. In terms of adaptively-chosen comparisons, we show how the top O(\logN) items can be found, even in the presence of corrupted observations, using a voting methodology that only requires O(N\log^2N) pairwise comparisons.
Brian Eriksson
AISTATS1
2013 RiskRoute: a framework for mitigating network outage threats
abstract
A comprehensive understanding of outage threats is critical for robust network design and operation, and evaluating cost trade-offs for recovery planning. In this paper, we describe a study of network infrastructure events due to outage events and a framework for mitigating these risks through backup routing and additional provisioning. We evaluate risk via the concept of bit-risk miles, the geographically-scaled outage risk of traffic in a network. Our focus on bit-risk miles allows for first-of-its-kind analysis of the tradeoffs of shortest path routing and risk-averse routing. We leverage the concept of bit-risk miles to present RiskRoute, a flexible routing framework that allows for backup routes to be configured to respond to both historical and immediately forecasted outage threats. Specifically, RiskRoute is an optimization framework that minimizes bit-risk miles between arbitrary points in a network. RiskRoute also reveals the best locations for provisioning additional network infrastructure in the form of new PoP-to-PoP links for single-network domains, and the best new peering relationships for multi-network domains. To assess and evaluate RiskRoute, we assemble diverse data sets including (i) - detailed topological maps and peering relationships of Internet Service Providers (ISPs) in the US, and (ii) - historical information on different types of natural disasters which threaten physical infrastructure. Our analysis reveals the providers that have the highest risk to disaster-based outage events. We also provide provisioning recommendations for network operators that can in some cases significantly lower bit-risk miles for their infrastructures.
Brian Eriksson, Ramakrishnan Durairajan, Paul Barford
CoNEXT1
2013 Predicting audience responses to movie content from electro-dermal activity signals
abstract
The ability to assess fine-scale user responses has applications in advertising, content creation, recommendation, and psychology research. Unfortunately, current approaches, such as focus groups and audience surveys, are limited in size and scope. In this paper, we propose a combined biometric sensing and analysis methodology to leverage audience-scale electro-dermal activity (EDA) data for the purpose of evaluating user responses to video. We provide detailed characterization of how temporal physiological responses to video stimulus can be modeled, along with first-of-its-kind audience-scale EDA group experiments in uncontrolled real-world environments. Our study provides insights into the techniques used to analyze EDA, the effectiveness of the different temporal features, and group dynamics of audiences. Our experiments demonstrate the ability to classify movie ratings with accuracy of over 70% on specific films. Results of this study suggest the ability to assess emotional reactions of groups using minimally invasive sensing modalities in uncontrolled environments.
Fernando Silveira, Brian Eriksson, Anmol Sheth, Adam Sheppard
UbiComp2
2013 Sequential Bayesian Search
abstract
Millions of people search daily for movies, music, and books on the Internet. Unfortunately, non-personalized exploration of items can result in an infeasible number of costly interaction steps. We study the problem of efficient, repeated interactive search. In this problem, the user is navigated to the items of interest through a series of options and our objective is to learn a better search policy from past interactions with the user. We propose an efficient learning algorithm for solving the problem, sequential Bayesian search (SBS), and prove that it is Bayesian optimal. We also analyze the algorithm from the frequentist point of view and show that its regret is sublinear in the number of searches. Finally, we evaluate our method on a real-world movie discovery problem and show that it performs nearly optimally as the number of searches increases.
Branislav Kveton, Brian Eriksson, Sandilya Bhamidipati
ICML (2)3
2013 Understanding geolocation accuracy using network geometry
abstract
The ability to estimate the geographic position of a network host has a vast array of uses, and many measurement-based geolocation methods have been proposed. Unfortunately, comparing results across multiple studies is difficult. A key contributor to that difficulty is network geometry - the spatial arrangement of hosts and links. In this paper, we study the relationship between network geometry and geolocation accuracy. We define the notion of scaling dimension to characterize the geometry of a wide array of different networks. We show that the scaling dimension correlates with a number of aspects of geolocation accuracy. In networks with low scaling dimension, geolocation accuracy improves more rapidly with the addition of landmarks. Further, we show that the scaling dimension of operator networks varies considerably across different regions of the world. Our results point to the complexity of, and suggest standards for, the meaningful evaluation of geolocation algorithms.
Brian Eriksson, Mark Crovella
INFOCOM1
2013 AliasCluster: A lightweight approach to interface disambiguation
abstract
Internet topologies discovered by standard traceroute-based probing schemes are limited by many factors. One of the main factors is the ambiguity of the returned interfaces, where multiple unique interface IP addresses belong to the same physical router. The unknown assignment of interface IPs to physical routers can result in grossly inflated estimated topologies compared with the true underlying physical infrastructure of the network. The ability to determine which interfaces belong to which router would aid in the ability to accurately reconstruct the underlying topology of the Internet. In this paper, we present ALIASCLUSTER, a lightweight learning-based methodology that disambiguates router aliases using only observed traceroute measurements and requires no additional load on the network. Compared with existing techniques, we find that ALIASCLUSTER can resolve the same number of true router alias pairs with 50% fewer false alarms.
Larissa Spinelli, Mark Crovella, Brian Eriksson
INFOCOM3
2013 Adaptive Submodular Maximization in Bandit Setting
abstract
Maximization of submodular functions has wide applications in machine learning and artificial intelligence. Adaptive submodular maximization has been traditionally studied under the assumption that the model of the world, the expected gain of choosing an item given previously selected items and their states, is known. In this paper, we study the scenario where the expected gain is initially unknown and it is learned by interacting repeatedly with the optimized function. We propose an efficient algorithm for solving our problem and prove that its expected cumulative regret increases logarithmically with time. Our regret bound captures the inherent property of submodular maximization, earlier mistakes are more costly than later ones. We refer to our approach as Optimistic Adaptive Submodular Maximization (OASM) because it trades off exploration and exploitation based on the optimism in the face of uncertainty principle. We evaluate our method on a preference elicitation problem and show that non-trivial K-step policies can be learned from just a few hundred interactions with the problem.
Victor Gabillon, Branislav Kveton, Zheng Wen 0002, Brian Eriksson, S. Muthukrishnan 0001
NIPS4
2012 Efficient Network Tomography for Internet Topology Discovery
abstract
Accurate and timely identification of the router-level topology of the Internet is one of the major unresolved problems in Internet research. Topology recovery via tomographic inference is potentially an attractive complement to standard methods that use TTL-limited probes. Unfortunately, limitations of prior tomographic techniques make timely resolution of large-scale topologies impossible due to the requirement of an infeasible number of measurements. In this paper, we describe new techniques that aim toward efficient tomographic inference for accurate router-level topology measurement. We introduce methodologies based on Depth-First Search (DFS) ordering that clusters end-hosts based on shared infrastructure and enables the logical tree topology of a network to be recovered accurately and efficiently. We evaluate the capabilities of our algorithms in large-scale simulation and find that our methods will reconstruct topologies using less than 2% of the measurements required by exhaustive methods and less than 15% of the measurements needed by the current state-of-the-art tomographic approach. We also present results from a study of the live Internet where we show our DFS-based methodologies can recover the logical router-level topology more accurately and with fewer probes than prior techniques.
Brian Eriksson, Gautam Dasarathy, Paul Barford, Robert D. Nowak
IEEE/ACM Trans. Netw.1
2011 On the prevalence and characteristics of MPLS deployments in the open internet
abstract
Multi-Protocol Label Switching (MPLS) is a mechanism that enables service providers to specify virtual paths through IP networks. The use of MPLS in the open Internet (i.e., public end-to-end paths) has important implications for users and network neutrality since MPLS is frequently used in traffic engineering applications today. In this paper we present a longitudinal study of the prevalence and characteristics of MPLS deployments in the open Internet. We use path measurement data collected over the past 3.5 years by the CAIDA Archipelago project (Ark), which consist of over 10 billion individual traceroutes between hosts throughout the Internet. We use two different techniques for identifying MPLS paths in Ark data: direct observation via ICMP extensions that include MPLS label information, and inference using a Bayesian data fusion methodology. Our direct observation method can only identify uniform-mode tunnels, which very likely underestimates MPLS deployments. Nonetheless, our results show that the total number of tunnels observed in a given measurement period has varied widely over time with the largest deployments in tier-1 providers. About 7% of all autonomous systems deploy MPLS and this level of deployment has been consistent over the past three years. The average length of an MPLS tunnel has decreased from 4 hops in 2008 to 3 hops in 2011, and the path length distribution is heavily skewed. About 25% of all paths in 2011 cross at least one MPLS tunnel, while 4% cross more than one. Finally, data observed in MPLS headers suggest that many ASes employ some types of traffic classification and engineering in their tunnels.
Joel Sommers, Paul Barford, Brian Eriksson
Internet Measurement Conference3
2011 DomainImpute: Inferring unseen components in the Internet
abstract
Despite many efforts over the past decade, the ability to generate topological maps of the Internet at the router-level accurately and in a timely fashion remains elusive. Mapping campaigns commonly involve traceroute-like probing that are usually non-adaptive and incomplete, thus revealing only a portion of the underlying topology. In this paper we demonstrate that standard probing methods yield datasets that implicitly contain information about much more than just the directly observed links and routers. Each probe, in addition to the underlying domain knowledge, returns information that places constraints on the underlying topology, and by integrating a large number of such constraints it is possible to accurately infer the existence of unseen components of the Internet. We describe DomainImpute, a novel data analysis methodology designed to accurately infer the unseen hop-count distances between observed routers. We use both synthetic and a large empirical dataset to validate the proposed methods. On our empirical real world dataset, we show that our methods can estimate over 55% of the unseen distances between observed routers to within a one-hop error.
Brian Eriksson, Paul Barford, Joel Sommers, Robert D. Nowak
INFOCOM1
2011 Efficient network-wide flow record generation
abstract
Experiments on diverse topics such as network measurement, management and security are routinely conducted using empirical flow export traces. However, the availability of empirical flow traces from operational networks is limited and frequently comes with significant restrictions. Furthermore, empirical traces typically lack critical meta-data (e.g., labeled anomalies) which reduce their utility in certain contexts. In this paper, we describe fs: a first-of-its-kind tool for automatically generating representative flow export records as well as basic SNMP-like router interface counts. fs generates measurements for a target network topology with specified traffic characteristics. The resulting records for each router in the topology have byte, packet and flow characteristics that are representative of what would be seen in a live network. fs also includes the ability to inject different types of anomalous events that have precisely defined characteristics, thereby enabling evaluation of proposed attack and anomaly detection methods. We validate fs by comparing it with the ns-2 simulator, which targets accurate recreation of packet-level dynamics in small network topologies. We show that data generated by fs are virtually identical to what are generated by ns-2, except over small time scales (below 1 second). We also show that fs is highly efficient, thus enabling test sets to be created for large topologies. Finally, we demonstrate the utility of fs through an assessment of anomaly detection algorithms, highlighting the need for flexible, scalable generation of network-wide measurement data with known ground truth.
Joel Sommers, Rhys Alistair Bowden, Brian Eriksson, Paul Barford, Matthew Roughan, Nick G. Duffield
INFOCOM3
2011 Inferring Unseen Components of the Internet Core
abstract
Despite many efforts over the past decade, the ability to generate topological maps of the Internet at the router-level accurately and in a timely fashion remains elusive. Mapping campaigns commonly involve {t traceroute}-like probing that are usually non-adaptive and incomplete, thus revealing only a portion of the underlying topology. In this paper we demonstrate that standard probing methods yield datasets that implicitly contain information about much more than just the directly observed links and routers. Each probe yields information that places constraints on the underlying topology, and by integrating a large number of such constraints it is possible to accurately infer the existence of unseen components of the Internet (i.e., links and routers not directly revealed by the probing). Moreover, we show that this information can be used to adaptively re-focus the probing in order to more quickly discover the topology. These findings suggest radically new and more efficient approaches to Internet mapping. Our work focuses on the discovery of the core of the Internet. We define "Internet core" as the set of routers that is roughly bounded by ingress/egress routers from stub autonomous systems. We describe a novel data analysis methodology designed to accurately infer (i) the number of unseen core routers, (ii) the unseen hop-count distances between observed routers, and (iii) unseen links between observed routers. We use a large experimental dataset to validate the proposed methods. For our data set, we show that our methods can predict the number of unseen routers to within a 13% error level, estimate 60% of the unseen distances between observed routers to within a one-hop error, and robustly detect over 35% of the unseen links between observed routers. Furthermore, we use the information extracted by our inference methodology to drive an adaptive active-probing scheme. The adaptive probing method allows us to generate maps on our data set using 50% fewer probes than standard non-adaptive approaches.
Brian Eriksson, Paul Barford, Joel Sommers, Robert D. Nowak
IEEE J. Sel. Areas Commun.1
2010 BasisDetect: a model-based network event detection framework
abstract
The ability to detect unexpected events in large networks can be a significant benefit to daily network operations. A great deal of work has been done over the past decade to develop effective anomaly detection tools, but they remain virtually unused in live network operations due to an unacceptably high false alarm rate. In this paper, we seek to improve the ability to accurately detect unexpected network events through the use of BasisDetect, a flexible but precise modeling framework. Using a small dataset with labeled anomalies, the BasisDetect framework allows us to define large classes of anomalies and detect them in different types of network data, both from single sources and from multiple, potentially diverse sources. Network anomaly signal characteristics are learned via a novel basis pursuit based methodology. We demonstrate the feasibility of our BasisDetect framework method and compare it to previous detection methods using a combination of synthetic and real-world data. In comparison with previous anomaly detection methods, our BasisDetect methodology results show a 50% reduction in the number of false alarms in a single node dataset, and over 65% reduction in false alarms for synthetic network-wide data.
Brian Eriksson, Paul Barford, Rhys Alistair Bowden, Nick G. Duffield, Joel Sommers, Matthew Roughan
Internet Measurement Conference1
2010 Toward the Practical Use of Network Tomography for Internet Topology Discovery
abstract
Accurate and timely identification of the router-level topology of the Internet is one of the major unresolved problems in Internet research. Topology recovery via tomographic inference is potentially an attractive complement to standard methods that use TTL-limited probes. In this paper, we describe new techniques that aim toward the practical use of tomographic inference for accurate router-level topology measurement. Specifically, prior tomographic techniques have required an infeasible number of probes for accurate, large scale topology recovery. We introduce a Depth-First Search (DFS) Ordering algorithm that clusters end host probe targets based on shared infrastructure, and enables the logical tree topology of the network to be recovered accurately and efficiently. We evaluate the capabilities of our DFS Ordering topology recovery algorithm in simulation and find that our method uses 94% fewer probes than exhaustive methods and 50% fewer than the current state-of-the-art. We also present results from a case study in the live Internet where we show that DFS Ordering can recover the logical router-level topology more accurately and with fewer probes than prior techniques.
Brian Eriksson, Gautam Dasarathy, Paul Barford, Robert D. Nowak
INFOCOM1
2010 A Learning-Based Approach for IP Geolocation
Brian Eriksson, Paul Barford, Joel Sommers, Robert D. Nowak
PAM1
2009 Estimating Hop Distance Between Arbitrary Host Pairs
abstract
Establishing a clear and timely picture of Internet topology is complicated by many factors including the vast size and dynamic nature of the infrastructure. In this paper, we describe a methodology for estimating an important characteristic of Internet topology - the hop distance between arbitrary pairs of end hosts. Our goal is to develop an approach to pairwise hop distance estimation that is accurate, scalable, timely and does not require a significant measurement infrastructure. Our methodology is based on deploying a small set of landmark nodes that use trace route-like probes between each other to establish a set of accurate pairwise hop distances. The landmark nodes are also configured to collect source IP addresses and TTL values from passively monitored network packet traffic. We develop a novel multidimensional scaling algorithm that can be applied to both the passive and active measurements to generate pairwise hop distance estimates for all of the observed source host addresses. The basic algorithm is then enhanced to consider the autonomous system membership of source hosts via BGP routing information. We investigate the capabilities of our estimation algorithms using a set of synthetic network topologies. The results show that our method can generate highly accurate pairwise hop distance estimates over a range of network sizes and configurations, and landmark infrastructure sizes.
Brian Eriksson, Paul Barford, Robert D. Nowak
INFOCOM1
2008 Learning to satisfy
abstract
This paper investigates a class of learning problems called learning satisfiability (LSAT) problems, where the goal is to learn a set in the input (feature) space that satisfies a number of desired output (label/response) constraints. LSAT problems naturally arise in many applications in which one is interested in the class of inputs that produce desirable outputs, rather than simply a single optimum. A distinctive aspect of LSAT problems is that the output behavior is assessed only on the solution set, whereas in most statistical learning problems output behavior is evaluated over the entire input space. We present a novel support vector machine (SVM) algorithm for solving LSAT problems and apply it to a synthetic data set to illustrate the impact of the LSAT formulation.
Frederic Thouin, Mark Coates, Brian Eriksson, Robert D. Nowak, Clayton Scott
ICASSP3
2008 Network discovery from passive measurements
abstract
Understanding the Internet's structure through empirical measurements is important in the development of new topology generators, new protocols, traffic engineering, and troubleshooting, among other things. While prior studies of Internet topology have been based on active (traceroute-like) measurements, passive measurements of packet traffic offer the possibility of a greatly expanded perspective of Internet structure with much lower impact and management overhead. In this paper we describe a methodology for inferring network structure from passive measurements of IP packet traffic. We describe algorithms that enable 1) traffic sources that share network paths to be clustered accurately without relying on IP address or autonomous system information, 2) topological structure to be inferred accurately with only a small number of active measurements, 3) missing information to be recovered, which is a serious challenge in the use of passive packet measurements. We demonstrate our techniques using a series of simulated topologies and empirical data sets. Our experiments show that the clusters established by our method closely correspond to sources that actually share paths. We also show the trade-offs between selectively applied active probes and the accuracy of the inferred topology between sources. Finally, we characterize the degree to which missing information can be recovered from passive measurements, which further enhances the accuracy of the inferred topologies.
Brian Eriksson, Paul Barford, Robert D. Nowak
SIGCOMM1
2007 Learning network structure from passive measurements
abstract
The ability to discover network organization, whether in the form of explicit topology reconstruction or as embeddings that approximate topological distance, is a valuable tool. To date, network discovery has been based on active measurements. However, it is feasible to envision passive discovery of network topology and distance, simply by monitoring packet traffic. Unfortunately, the lack of explicit control over the choices of which endpoints are measured means that passive network discovery must deal with the problem of missing information. We consider one such example, namely reconstructing embeddings and some network structure information from unwanted network traffic captured at a set of honeypots. We develop a number of algorithms for reconstruction of missing measurements. Our algorithms use insights derived from the known topology of the Internet as well as local imputation techniques from approximation theory. We characterize the degree to which missing information can be reconstructed and show that a limited but useful amount of reconstruction is possible, allowing the recovery of network embeddings and some topological relationships from passively collected data.
Brian Eriksson, Paul Barford, Robert D. Nowak, Mark Crovella
Internet Measurement Conference1
2006 Maximum Likelihood Methods for Time-Resolved Imaging Through Turbid Media
abstract
Recently technological advances now enable time-gated acquisitions of photons at very fast rates. This can allow one to separate scattered and unscattered photons in transillumination imaging. Time-resolved transillumination (TRT) imaging opens the door to an new type of imaging through turbid (scattering) media such as soft tissue and fog/smoke, and exciting potential applications in bioimaging and surveillance. This paper proposes a novel maximum likelihood based approach to TRT image reconstruction.
Brian Eriksson, Robert D. Nowak
ICIP1