Projects

The Aleph is an approach and system for network device geolocation that leverages Large Language Models (LLMs) to classify DNS PTR records, generate regular expressions for these classes, and establish hint-to-location mappings per operator, significantly scaling the coverage of existing geolocation tools.

The Internet is treated as critical infrastructure but was not designed as such, and much of what makes it hold together — or fail — is invisible from the outside. This is the agenda tying that work together: mapping the physical infrastructure paths depend on, stress-testing the routing system, studying how platforms engineer around failure, and arguing for what a survivable Internet would have to look like.

Consolidation Watch develops the measurements, methods, and frameworks needed to make Internet infrastructure consolidation visible — to distinguish concentration that reflects ecosystem constraints from concentration that reflects choices — so that its consequences can be understood and addressed.

Who owns what on the Internet? This project develops tools and methods to map autonomous systems to their parent organizations, classify the diverse roles ASes play, and reveal the corporate structure that shapes global connectivity. From enriching WHOIS-based mappings with PeeringDB to building AI-powered frameworks like Borges, the work combines traditional data sources with modern ML and LLM techniques to make the Internet’s organizational layer visible.

Since 2018, this project has been building a measurement and data-driven understanding of the global submarine cable network (SCN): how it is built, who controls it, how Internet paths rely on it, and how failures ripple through users and regions. From early position papers to systems like Calypso, the work treats the SCN as an evolving, critical infrastructure with many open problems still to tackle.

Public DNS resolvers gave users faster, more reliable name resolution — and quietly broke the mechanism CDNs use to send clients to a nearby replica. This project measured that interaction and built namehelp, a client-side resolver that keeps the benefits of a third-party service while restoring good replica selection for CDN-hosted content.

Cellular networks became how most of the world reaches the Internet, while remaining largely opaque to measurement from outside. This thread studies them from the client: where cellular traffic actually enters the Internet, how content is selected and delivered to mobile users, what the mobile web costs, how roaming works when the SIM belongs to an aggregator rather than an operator, and what connectivity looks like at 35,000 feet.

Measuring mobile networks and applications means getting inside a device that is designed to keep you out. This project builds the instruments: MBZ, which intercepts and modifies traffic on the handset itself; BatteryLab, a distributed platform for measuring real power draw on real hardware; and Crowd (Soft) Control, on directing the people carrying the devices.

Two mobile apps built for the Apps 4 Metro Chicago competitions, applying the group’s crowdsourcing work to civic problems: FixIt!, for reporting and validating issues needing city attention, and TrailBlaze Chicago, for planning bike routes and reporting path conditions. Both placed in their rounds.

Research testbeds sit in well-connected places that look nothing like where users actually are. This project built measurement systems that run inside applications on real home connections — NEWS, which detected network events by watching ordinary peer-to-peer traffic, and Dasu, which characterized broadband service and then opened that vantage point to other researchers as an experimentation platform.

Dasu answered a question users cared about — is my ISP giving me what I pay for? — and used the adoption that earned to build something researchers needed: a measurement platform running on tens of thousands of real home connections, able to host other people’s experiments.

Working with the Amaral lab, we showed that BitTorrent users form stable communities that can be recovered from connection patterns alone — an observer learns what you are interested in without inspecting a single payload. SwarmScreen answers the attack by mixing a fraction of deliberately unrelated connections into a client’s behaviour, restoring plausible deniability.

NEWS detected service-level network events by passively watching the traffic a BitTorrent client was already generating, then corroborating suspected problems across users in the same ISP or country. Hundreds of thousands of people ran it, which is what made detection at the edge possible at all.

Content delivery networks continuously measure the Internet to decide which replica should serve each client. This project asked whether the rest of us could read those decisions as a free, always-on measurement service — and used the answer to build systems for detouring, network positioning, and peer selection, including Ono, a BitTorrent plugin that cut cross-ISP traffic while making downloads faster.

Vehicular network research was being evaluated with mobility models that bore little resemblance to how cars actually move. STRAW drove simulated vehicles over real street maps under real traffic rules, and the tooling around it — SWANS++ and the Ceratias visualizer — made that kind of experiment repeatable, before later work took the questions out of simulation and into radio propagation measurements on real streets.

Application-level multicast has to deliver a stream over a network of participants who join, leave, and fail constantly. This project asked what structure survives that churn — producing Nemo, a resilient multicast protocol, its fat-tree successor FatNemo, DHT-based variants, and a series of comparative studies of how overlay designs actually behave under realistic conditions.