BigBen：用于Internet范围事件监控的遥测处理
BigBen: Telemetry Processing for Internet-wide Event Monitoring
摘要：
本文描述了BigBen，一种网络遥测处理系统，旨在实现准确和及时的互联网事件报告（例如，中断、攻击和配置更改）。BigBen与其他互联网事件检测系统的不同之处在于它使用网络时间协议（NTP）流量的被动测量。我们描述了BigBen的架构，它包括（i）分布式NTP流量收集组件，（ii）提取转换加载（ETL）组件，（iii）事件识别组件，以及（iv）可视化和报告组件。我们还描述了一个基于云的BigBen实现，用于处理大型NTP数据集并提供每日事件报告。我们在一个15.5TB的NTP数据库上演示了BigBen。我们表明，我们的实现是有效的，可以支持每小时的事件报告。我们发现，大本钟识别了广泛的互联网事件，其特点是他们的位置，范围和持续时间。我们比较了BigBen检测到的事件与基于大型主动探测器的检测系统检测到的事件。我们发现只有适度的重叠，并显示如何大本钟提供的事件，从积极的测量是不可用的细节。最后，我们报告的角度，大本钟提供的互联网事件，由第三方报告。在每一种情况下，BigBen都确认了事件，并提供了以前报告中没有的细节，突出了被动的、基于NTP的方法的效用。
英文摘要：
This paper describes BigBen, a network telemetry processing system designed to enable accurate and timely reporting of Internet events (e.g., outages, attacks and configuration changes). BigBen is distinct from other Internet-wide event detection systems in its use of passive measurements of Network Time Protocol (NTP) traffic. We describe the architecture of BigBen, which includes (i) a distributed NTP traffic collection component, (ii) an Extract Transform Load (ETL) component, (iii) an event identification component, and (iv) a visualization and reporting component. We also describe a cloud-based implementation of BigBen developed to process large NTP data sets and provide daily event reporting. We demonstrate BigBen on a 15.5TB corpus of NTP data. We show that our implementation is efficient and could support hourly event reporting. We show that BigBen identifies a wide range of Internet events characterized by their location, scope and duration. We compare the events detected by BigBen vs. events detected by a large active probe-based detection system. We find only modest overlap and show how BigBen provides details on events that are not available from active measurements. Finally, we report on the perspective that BigBen provides on Internet events that were reported by third parties. In each case, BigBen confirms the event and provides details that were not available in prior reports, highlighting the utility of the passive, NTP-based approach.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
