Submarine infrastructure
This work connects observed Internet paths to the submarine cables that carry them, then asks how subsea infrastructure should be strengthened when failures have regional consequences.
Research
Modern networks increasingly span organizational, technological, and physical boundaries. Traffic may traverse multiple providers and submarine infrastructure before reaching its destination. Network functions that once ran entirely in software increasingly execute across programmable packet and optical systems, while satellite and quantum networks introduce new physical and operational constraints.
These systems are difficult to observe as a whole, and failures often cross the abstractions used to manage them. A physical hazard may remove apparently independent logical paths; an attack may create a bottleneck at another layer; a change inside one infrastructure may alter behavior observed somewhere else.
My work therefore asks three related questions: what parts of networked infrastructure remain hidden, how can we explain their behavior from incomplete evidence, and how should that understanding change the systems we build?
Reveal hidden infrastructure
Logical Internet measurements expose only part of the system. Important properties may live in physical infrastructure, topology, shared conduits, submarine cables, private backbones, or other hidden dependencies.
This work combines multiple forms of evidence to recover missing structure. The goal is not mapping for its own sake; it is exposing dependencies that matter for performance, security, and resilience.
Physical Internet mapping
InterTubes and cloud peering measurements show how active measurement can uncover otherwise opaque physical infrastructure and interconnection relationships.
Topology and path measurement
Layer-aware topology and active measurement work expand what can be inferred from incomplete Internet observations.
Explain network behavior
A network operator rarely has one authoritative source of truth. Traffic, BGP, DNS, telemetry, active measurements, logs, topology, and infrastructure metadata each expose different parts of the system.
The research question is how these observations can be connected well enough to determine what changed, why it changed, which evidence supports the explanation, which alternatives remain plausible, what additional measurement would reduce uncertainty, and what action should follow.
This direction grows naturally out of earlier work in measurement, telemetry, and network data analysis. AI appears here as a mechanism for reasoning over heterogeneous network evidence while preserving provenance, uncertainty, network semantics, and competing explanations.
Network explanation frameworks
NetExplain and related work turn heterogeneous observations and learned models into trustworthy, evidence-backed explanations for operators.
Runtime telemetry
DynATOS studies how telemetry systems can adapt to dynamic traffic and query workloads.
Weak supervision and network data science
This line develops ways to learn from network data when high-quality labels are scarce, noisy, expensive, or distributed across organizations, extending from weak-supervision techniques to hybrid explainability for ML-powered networking systems.
Engineer resilient infrastructure
Resilience often fails because different network layers hide dependencies from one another: logical paths may share physical infrastructure, DDoS defenses may sit downstream of the real bottleneck, and communication systems may depend on infrastructure exposed to the same hazards they are expected to survive.
The contribution is to identify a hidden dependency or constraint, expose it through measurement or modeling, and redesign the system around it.
Programmable security and packet-optical systems
This work studies defenses shaped by switch memory, link capacity, optical topology, and where attacks create bottlenecks.
Infrastructure under stress
This work examines what happens when the physical environment becomes part of the network failure model, from sea-level rise and climate exposure to Cascadia-scale earthquakes, wildfire monitoring, and multi-hazard satellite resilience.
Emerging infrastructure
The Argus project explores measurement and management techniques for multi-cloud networks, while satellite and quantum-classical work studies systems whose dependencies and control planes change over time.
Funded Projects
Securing campus CI and REN workflows
Measurement-informed multi-cloud management
Cross-boundary monitoring for hazard infrastructure
Distributed data-plane runtime telemetry
Programmable defenses for terabit DDoS
Democratizing Internet data science
Climate-change risk and Internet infrastructure resilience
Weak supervision for network telemetry
Future Direction
Networks have become remarkably programmable, but they remain surprisingly difficult to understand. I see an opportunity to bring together Internet measurement, network data science, programmable systems, resilience, and AI to build network infrastructure that can reason about its own state and dependencies.
This requires more than placing an AI interface in front of existing management tools. An intelligent network must be able to distinguish observations from inference, connect evidence across layers and datasets, represent uncertainty, explain why competing hypotheses differ, and determine what additional information is required before an action is safe.
The long-term objective is networked infrastructure that is not only programmable, but observable, explainable, adaptive, and resilient by construction.
Interested in working on these problems? See information for prospective students →