Online social media allow users to interact with one another by sharing opinions, and these opinions have a critical impact on the way readers think and behave. Accordingly, an increasing number of manipulators deliberately spread messages to influence the public, often in an organized manner. In particular, political manipulation—manipulation of opponents to win political advantage—can result in serious consequences: antigovernment riots can break out, leading to candidates’ defeat in an election. A few approaches have been proposed to detect such manipulation based on the level of social interaction (i.e., manipulators actively post opinions but infrequently befriend and reply to other users). However, several studies have shown that the interactions can be forged at a low cost and thus may not be effective measures of manipulation. To go one step further, we collect a dataset for real, large-scale political manipulation, which consists of opinions found on Internet forums. These opinions are divided into manipulators and nonmanipulators. Using this collection, we demonstrate that manipulators inevitably work hard, in teams, to quickly influence a large audience. With this in mind, it could be said that a high level of collaborative efforts strongly indicates manipulation. For example, a group of manipulators may jointly post numerous opinions with a consistent theme and selectively recommend the same, well-organized opinion to promote its rank. We show that the effort measures, when combined with a supervised learning algorithm, successfully identify greater than 95% of the manipulators. We believe that the proposed method will help system administrators to accurately detect manipulators in disguise, significantly decreasing the intensity of manipulation.

Network operators in large-scale networks are often faced with long lists of maintenance tasks and find it difficult to track the relative importance of these tasks, without knowing their impact on the network's operation. As a result, operators may react slowly to critical tasks, increasing network downtime and maintenance costs. We present a system that quantifies the impact of maintenance tasks so that operators can prioritize their reaction according to the estimated impact (i.e., spend more time and effort on avoiding the disruption caused by high-impact maintenance tasks). In particular, the proposed system estimates the amount of traffic loss due to maintenance operations on inter-domain routing sessions, one of the most frequently modified aspects of network configurations. We implement the proposed system and apply it to 372 routing sessions in a nation-wide ISP network. The system identifies sessions with a varying degree of impact: sessions with nearly zero data loss, as well as sessions that can result in more than 1,000 GB of data loss if disrupted without any protection mechanism applied. We also show that predicting the amount of data loss is not straightforward since this amount changes over time, often in unexpected ways (e.g., from 50GB to 0 over one-month period). Therefore, the proposed impact analysis system is necessary for network operators to perform periodic audits of the routing sessions' impact and to classify the sessions according to the projected data losses. Operators can then decide the level of protection for each session (e.g., employ more effective and costly methods to protect critical sessions) and thus allocate maintenance costs more efficiently.

Network configurations implement a set of policies that control a network's behavior. Therefore, correct understanding of the configurations is vital to ensure that the network operates according to the intended policies. However, the current practice of manually reading a large number of configuration commands, which are written in low-level languages and distributed in multiple devices, is inefficient and significantly increases management costs and operator errors. We propose a system that helps decode network configurations by interpreting low-level fragmented configurations and then presenting their high-level intended policies. In particular, the proposed system is applicable to inter-domain routing policies, one of the most complex aspects of network configurations. We implement our system and evaluate its effectiveness through a set of user studies involving 44 participants. These studies examine the participants¿ comprehension of routing policies presented with our system as compared to those presented with existing configuration languages. The studies show that our system improves both accuracy, from 70% to nearly 100%, as well as time-to-task-completion, from 30 minutes to 10 minutes. We believe that our system provides a basis for a clean separation of policy intent from its implementation so that policies can be better designed and understood. We also discuss the weaknesses in usability of current network configurations and argue that all aspects of future management systems need to be designed to address these usability issues.

Configuring a network is a tedious and error-prone task. In particular, configuring routing policies for a network is complex as it involves subtle dependencies in multiple routers across the network. Misconfigurations are common and certain misconfigurations can bring the Internet down. In 2005, a misconfigured router in AS 9121 blackholed traffic for tens of thousands of networks in the Internet. This paper describes NetPiler, a system that detects router misconfigurations. NetPiler consists of a routing policy configuration model and a misconfiguration detection algorithm. The model is applicable to routing policies configured on a single router as well as to network-wide configuration. Using the model, NetPiler detects configuration commands that do not influence the behavior of the network - we call these configurations ineffective commands. Although the ineffective commands could be benign, sometimes when the commands are mistakenly configured to be ineffective, they cause the network to misbehave deviating from the intended behavior. We have implemented NetPiler in approximately 128,000 lines of C++ code, and evaluated it on the configurations of four production networks. NetPiler discovers nearly a hundred ineffective commands. Some of these misconfigurations can result in loss of connectivity, access to protected networks, and financial implications by providing free transit services. We believe NetPiler can help networks to significantly reduce misconfigurations.

As a network evolves over time, multiple operators modify its configuration, without fully considering what has previously been done. Similar policies are defined more than once, and policies that become obsolete after a transition are left in the configuration. As a result, the network configuration becomes complicated and disorganized, escalating maintenance costs and operator faults. We present a method called NetPiler, which groups common policies by discovering a set of shared features and which uses the groupings for the configuration instead of using each individual policy. Such an approach removes redundancies and simplifies the configuration while preserving the intended behavior of the configuration. We apply NetPiler to the routing policy configurations from four different networks, and reduce more than 50% of BGP communities and the related commands. In addition, we show that the reduced community definitions are sufficient to satisfy changes as the network evolves over nearly two years.

Configuring a network is a low-level, device-specific task. Many have compared it to writing a distributed program in assembly language, reserved only for highly experienced network operators. Automation has been proposed by researchers and industry as the solution to problems in network configuration. However, there is a certain amount of resistance from the operator community against automation. On the one hand, operators do desire a way for network-wide configuration. On the other hand, they still like to have access and control to details, to ensure flexibility and for debugging. In this paper, we attempt to answer the question "How should we automate network configuration" by studying where the complexity lies in network configuration. With an operational perspective, using data from three different types of production networks, we analyze the configuration files from these networks over the span of up to two years. Our analysis shows that the majority of changes to these files are a few lines each and made frequently. We found that routing, especially its policies, constitute a significant portion of the configuration files, as well as modifications to them. We then present complexity models to measure network-wide risk, impact and duplication of routing policies in network configuration. We show that risk and impact tend to grow over time, and the duplication factor is high. Based on the results of our analysis, we propose ways to automate the complex parts of network configuration.

Routing infrastructure plays a vital mle in the Internet, and attacks on routers can be damaging. Compromised routers can drop, modih, mislforward or reorder valid packets. Existing proposals for secure forwarding require substantial computational overhead and additional capabilities at routers. We propose Secure Split Assignment Trajectory Sampling (SATS), a system that detects malicious routers on the data plane. SATS locates a set of suspicious routers when packets do not follow their predicted paths. It works with a traffic measurement platform using packet sampling, has low overhead on routers and is applicable to high-speed networks. Different subsets ofpackets are sampled over dzyerent groups of routers to ensure that an attacker cannot completely evade detection. Our evaluation shows that SATS can signzjicantly limit a malicious router's harm to a small portion of traffic in a network.