@article {lutu2014bgp,
	title = {The BGP Visibility Toolkit: Detecting Anomalous Internet Routing Behavior},
	journal = {IEEE/ACM Transactions on Networking},
	year = {2015},
	month = {04/2015},
	publisher = {IEEE},
	abstract = {In this paper, we propose the BGP Visibility Toolkit, a system for detecting and analyzing anomalous behavior in the Internet. We show that interdomain prefix visibility can be used to single out cases of erroneous demeanors resulting from misconfiguration or bogus routing policies. The implementation of routing policies with BGP is a complicated process, involving fine-tuning operations and interactions with the policies of the other active ASes. Network operators might end up with faulty configurations or unintended routing policies that prevent the success of their strategies and impact their revenues. As part of the Visibility Toolkit, we propose the BGP Visibility Scanner, a tool which identifies limited visibility prefixes in the Internet. The tool enables operators to provide feedback on the expected visibility status of prefixes. We build a unique set of ground-truth prefixes qualified by their ASes as intended or unintended to have limited visibility. Using a machine learning algorithm, we train on this unique dataset an alarm system that separates with 95\% accuracy the prefixes with unintended limited visibility. Hence, we find that visibility features are generally powerful to detect prefixes which are suffering from inadvertent effects of routing policies. Limited visibility could render a whole prefix globally unreachable. This points towards a serious problem, as limited reachability of a non-negligible set of prefixes undermines the global connectivity of the Internet. We thus verify the correlation between global visibility and global connectivity of prefixes.},
	keywords = {Anomaly detection, BGP, Internet measurements, Machine learning},
	doi = {10.1109/TNET.2015.2413838},
	author = {Lutu, Andra and Bagnulo, Marcelo and Pelsser, Cristel and Maennel, Olaf and Cid-Sueiro, Jesus}
}
@inproceedings {24248,
	title = {Localization and not extent of fibrofatty infiltration is the primary factor determining conduction disturbance in a computational model of arrhythmogenic cardiomyopathy},
	journal = {E-Health and Bioengineering Conference (EHB)},
	year = {2015},
	pages = {1-6},
	publisher = {IEEE},
	isbn = {978-1-4673-7544-3},
	doi = {http://dx.doi.org/10.1109/EHB.2015.7391416},
	author = {Kallhovd, Siri and Sjur Urdson {Gjerald} and Maennel, Olaf and Saberniak, J and Haugaa, Kristina and Maleckar, Molly}
}
@inproceedings {lutu2014separating,
	title = {Separating wheat from chaff: Winnowing unintended prefixes using machine learning},
	journal = {INFOCOM, 2014 Proceedings IEEE},
	year = {2014},
	pages = {943{\textendash}951},
	publisher = {IEEE},
	abstract = {In this paper, we propose the use of prefix visibility at the interdomain level as an early symptom of anomalous events in the Internet. We focus on detecting anomalies which, despite their significant impact on the routing system, remain concealed from state of the art tools. We design a machine learning system to winnow the prefixes with unintended limited visibility - symptomatic of anomalous events - from the prefixes with intended limited visibility - resulting from legitimate routing operations. We train a winnowing algorithm with ground-truth data on 20,000 operational limited visibility prefixes (LVPs) already classified by the operators of the origin networks. The ground-truth was collected using the BGP Visibility Scanner, a tool we developed to provide operators with a multi-angle view on the efficacy of their routing policies. We build a dataset with the pre-classified prefixes and the features describing their visibility status dynamics. We further use this dataset to derive a boosted decision tree which winnows unintended LVPs with an accuracy of 95\%.},
	issn = {0743-166X},
	doi = {10.1109/INFOCOM.2014.6848023},
	author = {Lutu, Andra and Cid-Sueiro, Jesus and Maennel, Olaf}
}
@inproceedings {lutu2014understanding,
	title = {Understanding the reachability of IPv6 limited visibility prefixes},
	journal = {Passive and Active Measurement},
	year = {2014},
	month = {03/2014},
	pages = {163{\textendash}172},
	publisher = {Springer},
	abstract = {The main functionality of the Internet is to provide global connectivity for every node attached to it. In light of the IPv4 address space depletion, large networks are in the process of deploying IPv6. In this paper we perform an extensive analysis of how BGP route propagation affects global reachability of the active IPv6 address space in the context of this unique transition of the Internet infrastructure. We propose and validate a methodology for testing the reachability of an IPv6 address block active in the routing system. Leveraging the global visibility status of the IPv6 prefixes evaluated with the BGP Visibility Scanner, we then use this methodology to verify if the visibility status of the prefix impacts its reachability at the interdomain level. We perform active measurements using the RIPE Atlas platform. We test destinations with different BGP visibility degrees (i.e., limited visibility - LV, high visibility - HV and dark prefixes). We show that the IPv6 LV prefixes (v6LVPs) are generally reachable, mostly due to a less-specific\&nbsp;HV\&nbsp;covering prefix (v6HVP). However, this is not the case of the dark address space, which, by not having a covering v6HVP is largely unreachable.},
	isbn = {978-3-319-04917-5},
	issn = {0302-9743},
	doi = {10.1007/978-3-319-04918-2_16},
	author = {Lutu, Andra and Bagnulo, Marcelo and Pelsser, Cristel and Maennel, Olaf}
}
@inproceedings {24434,
	title = {The BGP Visibility Scanner},
	journal = {Computer Communications Workshops (INFOCOM WKSHPS), 2013 IEEE Conference on},
	year = {2013},
	month = {04/2013},
	pages = {115-120},
	abstract = {By tweaking the BGP configurations, the network operators are able to express their interdomain routing preferences, designed to accommodate a myriad goals. Given the complex interactions between policies in the Internet, the origin AS by itself cannot ensure that only by configuring a routing policy it can also achieve the anticipated results. Moreover, the definition of routing policies is a complicated process, involving a number of subtle tuning operations prone to errors. In this paper, we propose the BGP Visibility Scanner which allows network operators to validate the correct implementation of their routing policies, by corroborating the BGP routing information from approximatively 130 independent observation points in the Internet. We exemplify the use of the proposed methodology and also perform an initial validation for the BGP Visibility Scanner capabilities through various real operational use cases.},
	keywords = {BGP routing information, BGP visibility scanner, border gateway protocol, Educational institutions, Feeds, Internet, Labeling, Monitoring, network operators, Routing, routing policies, routing protocols, Topology},
	doi = {10.1109/INFCOMW.2013.6562877},
	author = {Lutu, Andra and Maennel, Olaf}
}
