Internet Resilience

Tue, 28 Nov 2023 00:00:00 +0000

Project Overview

We rely on the Internet the way we rely on power and water, and we reason about it far less carefully. It was not architected for survivability; the properties that let it absorb failures are largely emergent, unevenly distributed, and difficult to observe from outside the organizations that operate it. When something breaks — a cable, a route, a provider — the consequences are rarely where anyone expected.

This is the thread pulling that work together. It runs from the physical layer, where a few conduits on the seabed carry almost everything, up through the routing system that decides which of them traffic uses, to the platforms that engineer their own redundancy on top of both. Different layers, one question: what actually happens when this infrastructure fails, and what would we have to build to find out before it does?

Re-architecting for Survivability

In November 2023 we convened a two-day NSF workshop in Evanston — Towards Re-architecting Today’s Internet for Survivability — bringing together researchers across networking, control theory and security to ask what a survivable Internet would require, and what research agenda would get us there.

The workshop report, written with the participants and published in CCR, is the clearest statement of that agenda. A broader argument along the same lines is currently under review.

The Physical Layer

Ninety-nine percent of international data crosses submarine cables, and until recently networking research treated that infrastructure as a black box. Our submarine cable work — a project in its own right, running since 2018 — maps which cables carry which paths, who controls them, and how failures propagate to users and regions. It is the physical-layer half of this agenda, and it has its own systems: Calypso for charting paths through cables, and Sentinel for tracking failures as they are reported worldwide.

Stress-Testing the Routing System

You cannot experiment on the inter-domain routing system. It is shared, it is production, and the interesting failures are exactly the ones nobody will let you cause. Domino approaches that by building a testbench for stress-testing Internet critical infrastructure in silico — a way to ask what a given failure or attack would do, without doing it.

The SRDS 2025 paper on Domino, with Elham Ehsani Moghadam, Adrian Perrig and Walter Willinger, received the Best Student Paper Award.

Resilience as Engineered by Platforms

Large platforms build their own redundancy, and how they do it determines what their users experience when something underneath fails. Belt and Suspenders studies resilience in TikTok’s global video delivery — how a service at that scale hedges across delivery infrastructure, and what that buys when parts of it degrade.

This is the layer where resilience stops being a property of the network and becomes a set of decisions made by whoever operates the service.

Papers

Out of Sight, Not Out of Mind: A User-View on the Criticality of the Submarine Cable Network — IMC 2020
Towards Re-architecting Today’s Internet for Survivability — NSF Workshop Report — ACM SIGCOMM CCR, 2024
Poster: Domino — Towards a Testbench for Stress Testing Internet Critical Infrastructure — ICNP 2024
Towards Stress Testing the Internet Inter-Domain Routing System ‘in Silico’ with Domino — SRDS 2025 · Best Student Paper
Belt and Suspenders: A Study of Resilience in TikTok’s Global Video Delivery — CoNEXT 2026

The submarine cable publications are listed on that project’s page.

People

Leads

Fabián E. Bustamante (Northwestern University)
Walter Willinger (Northwestern University)

Students

Elham Ehsani Moghadam
Ying Zhang
Daniel Jang

Collaborators

Adrian Perrig (ETH Zürich)

Criticality of the Submarine Cable Network — the physical-layer thread
NSF Workshop: Towards Re-architecting Today’s Internet for Survivability

Routing | Aqualab - Northwestern University