Zeus - Using the Internet to Determine the Extent of Damage

Problem Statement

Currently, when a natural disaster occurs, news travels slowly to the
rest of the world as to the exact extent of the damage.  What if we
could use the current Internet structure to determine the extent of
the damage?  How can we determine where a computer is physically
located?  Even if we do have the geographic locations of hosts, how do
we determine if a disaster has occurred or if it is simply a small
power outage?  Considering the number of hosts on the Internet today,
do we need to poll every host or just a particular subset?  Can we
create a distributed system or will one host have to poll every other
host?  What if just one router is down, and the routing tables haven't
updated yet?

Project Work

This project will concentrate on designing a possible systems
architecture to begin solving these problems.  I will concentrate on
determining where a host is geographically located and designing a
system to determine if a "section" of the Internet is down.  In this
project, I will not venture into the heuristics of determining why a
part of the network is down.

Solution Areas

Some areas I plan to look for answers to determining geographic
location is DNS databases and backbone providers.  DNS entries allow a
geographic location to be specified, but is not widely used.  Backbone
providers (should) have databases of where their NAPs are, but talking
them into sharing that data may be a problem.  Many of them name their
backbone routers to give some indication of where they are located ex,
atl-core-02.inet.qwest.net is located in Atlanta.

In order to determine what areas of the Internet are "down",
due to whatever reason, we need a hierarchical system to prevent
information overload on one client.  Can one client take samples at a
rate fast enough to determine if part of the network is down, or is it
desirable to take samples over long periods of time to prevent false
positives occurring from a dead router or a short power outage, or a
re-boot.

We must also be cautious of polling the network too often, some
administrators may take that as a threat of attack and disable any
connection from the IP of the polling host.


Related Work 

Other work in this area includes: Cooperative Association for Internet
Data Analysis (http://www.caida.org) Claffy, K., et.al. ``Visualizing
the Global Topology of the MBone" 
(http://www-graphics.stanford.edu/papers/mbone/)