EECS 395/495 Internet Measurement and its Reverse Engineering


Yan Chen, Assistant Professor
Room L459, Tech Institute, 491-4946.
Office Hours: by appointment, Room L459, Tech Institute

Location and Time

·        Lectures: Tuesday and Thursday 2-3:20pm, Room M128, Tech Institute

Course Description

While the Internet has been an astounding engineering triumph, it faces huge technical problems.  As just one example, worldwide spending on cleaning up after viruses, worms, and spam -- that is, spending on coping with the consequences of connecting to the Internet -- is much larger than the worldwide spending on Internet connectivity itself.  The Internet itself is fragile, insecure, and poorly optimized.  To address these challenges, the National Science Foundation has started “Future Internet Design” program which aims to design and incrementally deploy the next generation of Internet in 5 to 10 years with about $300M funding anticipated.  With this, the next golden Internet age is about to come.


To design the new Internet, first we need to understand the operational problems of the current Internet.  Remarkably, there is very little quantitative data about the Internet's behavior.  In large part, this is because the Internet is operated by a loose federation of tens of thousands of organizations, at turns both competing and cooperating with each other to provide Internet service to end users.


This course is intended for both CS and ECE undergraduates and graduate students.   Students from non-system/networking areas are particularly welcome  In this course, we will learn to systematically measure every aspect of the Internet's behavior, from the topology and intra- and inter-domain routing policies, to failures and misconfigurations, to various traffic it carries (viruses, worms, spam, spyware, botnet, etc.), and to the emerging edge network traffic (e.g., wireless and ad hoc network).   A key insight is to leverage and integrate the various sources of information that leak out from service about their internal operation, in much the same way that astronomers infer stellar structure from the evidence which reaches our telescopes.    In addition, we will learn the basic tools (both analytical and experimental) for measurement and analysis, at the beginning of the course.  The techniques learned, especially the analytical part, can be used broadly in studying other domains.


Unlike normal research seminars which are purely paper reading based, we will leverage a recent textbook on Internet Measurement, which summarizes the important knowledge from thousands of papers, including the latest ones published last year!  During the course, we will identify a list of open research problems for class projects or students can come up with their own projects.   I will accomodate as much as I can, and just try to provide some guidance and necessary help.   Hopefully, some projects will spawn a quarter-long undergrad research course which is purely guided and managed by undergrads like the RTFM. 


Massive real-world anonymized router/gateway traffic data will be provided to analyze the behavior of the Internet, e.g., to detect both well-known and unknown viruses/worms/attacks, and even botnets and spywares.    There will be no exams.

 Course Prerequisites

  • Required: CS213, ECE 231, or any equivalent computer system introductory course.
  • Highly recommended: CS 340 or equivalent computer networking course.

Course Materials


No exams for this class.  The grading will be based on how much you learn from the course, not just how much you are able to achieve in the projects because different students have different background.  Undergrad and grad students will be graded separately.

  • Class participation and discussion 10%
  • Books/Paper reading summary 10%
  • In class paper presentation 30%
  • Project 50%
    1. Midterm presentation and report 10%
    2. Weekly report and meeting 10%
    3. Final presentation 10%
    4.  Final report 20%

Papers Reading and Presentation

There is no required textbook. All reading will be from papers. Whenever possible, handouts and papers will be placed online on the web page.  A schedule of assigned readings is available online.

Please refer to the slides of the first class for details. You must send the slides to me for review at least 24 hours before your presentation. There are some guidelines suggested by Fabián E. Bustamante which you will find useful.


  • Late policy:
    Since there are many small handin (e.g., paper summary, work-in-progress report)  for this course, we do not accept late submissions.
  • Work division:
    I will try to group undergrad and grad students together. While more work is certainly expected for the grad students, undergraduate students should also be responsible for significant portion of the project and each undergrad in the team should do similar amount of work.  At the end of the quarter, we will ask each one to submit a brief description on work division of his/her team.