SF-TAP: Scalable and Flexible Traffic Analysis Platform running on Commodity Hardware

Application-level network traffic analysis and sophisticated analysis techniques such as machine learning and stream data processing for network traffic require considerable computational resources. In addition, developing an application protocol analyzer is a tedious and time- consuming task. Therefore, we propose a scalable and flexible traffic analysis platform (SF-TAP) that provides an efficient and flexible application-level stream analysis of high-bandwidth network traffic. Our platform’s flexibility and modularity allow developers to easily implement multicore scalable application-level stream analyzers. Furthermore, SF-TAP is horizontally scalable and can therefore manage high-bandwidth network traffic. We achieve this scalability by separating network traffic based on traffic flows, forwarding the separated flows to multiple SF-TAP cells, each of which consists of a traffic capturer and application-level analyzers. In this study, we discuss the design and implementation of SF-TAP and provide details of its evaluation.

Transcript

1. 4'5"1
   4DBMBCMF
   BOE
   'MFYJCMF
   5SBGGJD
   "OBMZTJT
   1MBUGPSN
   3VOOJOH
   PO
   $PNNPEJUZ
   )BSEXBSF :VVLJ
   5BLBOP
   3ZPTVLF
   .JVSB
   4IJOHP
   :BTVEB
   ,VOJP
   "LBTIJ
   5PNPZB
   *OPVF  JO
   64&/*9
   -*4"
    /*$5
   +"*45
   +BQBO
2. 5BCMF
   PG
   $POUFOUT  .PUJWBUJPO
    3FMBUFE
   8PSL
    %FTJHO
   PG
   4'5"1
    *NQMFNFOUBUJPO
   PG
   4'5"1
    1FSGPSNBODF
   &WBMVBUJPO
    $PODMVTJPO 
3. .PUJWBUJPO
    w 1SPHSBNNBCMF
   BQQMJDBUJPO
   MFWFM
   USBGGJD
   BOBMZ[FS
   w 8F
   XBOU
   ʜ
   w UP
   XSJUF
   USBGGJD
   BOBMZ[FST
   JO
   BOZ
   MBOHVBHFT
   TVDI
   BT
   1ZUIPO
   3VCZ
   $
   GPS
   NBOZ
   QVSQPTFT
   *%4 *14
   GPSFOTJD
   NBDIJOF
   MFBSOJOH 
   w OPU
   UP
   XSJUF
   DPEFT
   IBOEMJOH
   5$1
   TUSFBN
   SFDPOTUSVDUJPO
   RVJUF
   DPNQMFY 
   w NPEVMBSJUZ
   GPS
   NBOZ
   BQQMJDBUJPO
   QSPUPDPMT 
4. .PUJWBUJPO
    w )JHI
   TQFFE
   BQQMJDBUJPO
   MFWFM
   USBGGJD
   BOBMZ[FS
   w 8F
   XBOU
   ʜ
   w UP
   IBOEMF
   IJHI
   CBOEXJEUI
   USBGGJD
   w UP
   IBOEMF
   IJHI
   DPOOFDUJPOT
   QFS
   TFDPOE
   w IPSJ[POUBM
   BOE
   $16
   DPSF
   TDBMBCMF
   BOBMZ[FS 
5. .PUJWBUJPO
    w 3VOOJOH
   PO
   $PNNPEJUZ
   )BSEXBSF
   w 8F
   XBOU
   ʜ
   w PQFO
   TPVSDF
   TPGUXBSF
   w OPU
   UP
   VTF
   FYQFOTJWF
   BQQMJBODFT 
6. 3FMBUFE
   8PSL  #1'
   <64&/*9
   "5$
   > OFUNBQ
   <64&/*9
   "5$
   > %1%, QDBQ ("411
   <64&/*9
   "5$
   > 4$"1
   <*.$
   > MJCOJET MJCQSPUPJEFOU O%1* MGJMUFS MPX
   MFWFM
   USBGGJD
   DBQUVSF GMPX
   PSJFOUFE
   BOBMZ[FS BQQMJDBUJPO
   USBGGJD
   EFUFDUPS 4'5"1
   NPEVMBSJUZ
   BOE
   TDBMBCJMJUZ
   
7. )JHIMFWFM
   "SDIJUFDUVSF
   PG
   4'5"1  $16 $16 $16 $16 'MPX
   "CTUSBDUPS $16 $16 $16 $16 'MPX
   "CTUSBDUPS $16 $16 $16 $16 'MPX
   "CTUSBDUPS $16 $16 $16 $16 'MPX
   "CTUSBDUPS $FMM
   *ODVCBUPS 5IF
   *OUFSOFU 4'5"1
   $FMM 4'5"1
   $FMM 4'5"1
   $FMM 4'5"1
   $FMM *OUSB
   /FUXPSL $PSF
   4DBMJOH $PSF
   4DBMJOH $PSF
   4DBMJOH $PSF
   4DBMJOH )PSJ[POUBM
   4DBMJOH "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS "OBMZ[FS (C& (C&
8. %FTJHO
   1SJODJQMF
    w 'MPX
   "CTUSBDUJPO
   w BCTUSBDU
   GMPXT
   CZ
   BQQMJDBUJPO
   MFWFM
   QSPUPDPMT
   w QSPWJEF
   GMPX
   BCTUSBDUJPO
   JOUFSGBDFT
   MJLF
   EFW
   QSPD
   PS
   #1'
   w GPS
   NVMUJQMF
   QSPHSBNNJOH
   MBOHVBHFT
   w .PEVMBS
   "SDIJUFDUVSF
   w TFQBSBUF
   BOBMZ[JOH
   BOE
   DBQUVSJOH
   MPHJD
   w FBTJMZ
   SFQMBDF
   BOBMZ[JOH
   MPHJD 
9. %FTJHO
   1SJODJQMF
    w )PSJ[POUBM
   4DBMBCMF
   w BOBMZ[JOH
   MPHJD
   UFOET
   UP
   SFRVJSF
   NBOZ
   DPNQVUFS
   SFTPVSDFT
   w WPMVNF
   FGGFDU
   TIPVME
   TPMWF
   UIF
   QSPCMFN
   w $16
   $PSF
   4DBMBCMF
   w CPUI
   BOBMZ[JOH
   BOE
   DBQUVSJOH
   MPHJD
   TIPVME
   CF
   DPSF
   TDBMBCMF
   GPS
   FGGJDJFODZ 
10. %FTJHO
    PG
    4'5"1
      /8
    *' )551
    *' 5-4
    *' 'MPX
    "CTUSBDUPS 'MPX $MBTTJpFS 5-4
    "OBMZ[FS )551
    "OBMZ[FS )551
    1SPYZ 5$1
    BOE
    6%1
    )BOEMFS pMUFS
    BOE DMBTTJpFS SVMF -
    -PPQCBDL
    *' %# 'PSFOTJD *%4*14 FUD "QQMJDBUJPO 1SPUPDPM
    "OBMZ[FS FUD 5$1
    %FGBVMU
    *' 6%1
    %FGBVMU
    *' "OBMZ[FS
    1MBOF "CTUSBDUPS
    1MBOF $BQUVSFS 1MBOF 4'5"1
    $FMM *ODVCBUPS 'MPX *EFOUJpFS 'MPX 4FQBSBUPS 4FQBSBUPS 1MBOF TFQBSBUFE
    USB⒏D 4'5"1
    $FMM --
    4OJ⒎FS 44- 1SPYZ FUD PUIFS
    4'5"1
    DFMMT *1
    1BDLFU %FGSBHNFOUFS -
    #SJEHF NJSSPSJOH USB⒏D 1BDLFU
    'PSXBSEFS *1
    'SBHNFOU )BOEMFS EFGJOFE
    
    QMBOFT "OBMZ[FS
    1MBOF BQQMJDBUJPO
    MFWFM
    BOBMZ[FST 'PSFOTJD
    *%4*14
    FUDʜ "CTUSBDUPS
    1MBOF GMPX
    BCTUSBDUJPO 4FQBSBUPS
    1MBOF GMPX
    TFQBSBUJPO $BQUVSFS
    1MBOF USBGGJD
    DBQUVSJOH PSEJOBSZ
    UFDI VTFST
    PG
    4'5"1
    JNQMFNFOUT
    IFSF XF
    JNQMFNFOUFE XF
    JNQMFNFOUFE
11. %FTJHO
    PG
    4'5"1
    
    4'5"1
    $FMM
    *ODVCBUPS  4'5"1
    $FMM *ODVCBUPS 'MPX 4FQBSBUPS TFQBSBUFE
    USB⒏D PUIFS
    4'5"1
    DFMMT -
    #SJEHF 1BDLFU
    'PSXBSEFS *1
    'SBHNFOU )BOEMFS 1BDLFU
    'PSXBSEFS MBZFS
    
    CSJEHF MBZFS
    
    GSBNF
    DBQUVSF *1
    'SBHNFOU
    )BOEMFS IBOEMF
    GSBHNFOUFE
    QBDLFUT 'MPX
    4FQBSBUPS TFQBSBUF
    GMPXT
    UP
    NVMUJQMF
    *GT
12. %FTJHO
    PG
    4'5"1
    
    4'5"1
    'MPX
    "CTUSBDUPS  /8
    *' )551
    *' 5-4
    *' 'MPX
    "CTUSBDUPS 'MPX $MBTTJpFS 5$1
    BOE
    6%1
    )BOEMFS pMUFS
    BOE DMBTTJpFS SVMF -
    -PPQCBDL
    *' 5$1
    %FGBVMU
    *' 6%1
    %FGBVMU
    *' 'MPX *EFOUJpFS *1
    1BDLFU %FGSBHNFOUFS 5$1
    BOE
    6%1
    )BOEMFS 'MPX
    *EFOUJpFS *1
    1BDLFU
    %FGSBHNFOUFS SFDPOTUSVDU
    5$1
    qPXT JEFOUJGZ
    qPXT
    CZ
    *1
    BOE
    QPSU OPUIJOH
    UP
    EP
    GPS
    6%1 EFGSBHNFOU
    *1
    QBDLFUT
    JG
    OFFEFE
13. %FTJHO
    PG
    4'5"1
    
    4'5"1
    'MPX
    "CTUSBDUPS  /8
    *' )551
    *' 5-4
    *' 'MPX
    "CTUSBDUPS 'MPX $MBTTJpFS 5$1
    BOE
    6%1
    )BOEMFS pMUFS
    BOE DMBTTJpFS SVMF -
    -PPQCBDL
    *' 5$1
    %FGBVMU
    *' 6%1
    %FGBVMU
    *' 'MPX *EFOUJpFS *1
    1BDLFU %FGSBHNFOUFS 'MPX
    $MBTTJpFS DMBTTJGZ
    qPXT
    CZ
    SFHVMBS
    FYQSFTTJPOT PVUQVU
    UP
    BCTUSBDUJPO
    *'T
14. *NQMFNFOUBUJPO w 4'5"1
    DFMM
    JODVCBUPS
    w $ 
    w JU
    VTFT
    OFUNBQ
    BWBJMBCMF
    PO
    'SFF#4%
    w 4'5"1
    GMPX
    BCTUSBDUPS
    w $ 
    w JU
    VTFT
    QDBQ
    PS
    OFUNBQ
    w BWBJMBCMF
    PO
    -JOVY
    #4%
    BOE
    .BD04
    w 4PVSDF
    $PEF
    w IUUQTHJUIVCDPN4'5"1
    w -JDFOTF
    w DMBVTFT
    #4%  VQEBUFE
    GSPN
    UIF
    QBQFS
15. 1FSGPSNBODF
    &WBMVBUJPO
      Figure 8: Total Memory Usage of HTTP Analyzer Figure 9: Packet Drop against CPS QBDLFU
    ESPQ
    BHBJOTU
    DPOOFDUJPOT
    QFS
    TFDPOE QDBQ , , ,
16. 1FSGPSNBODF
    &WBMVBUJPO
      GPSXBSEJOH
    QFSGPSNBODF
    PG
    4'5"1
    DFMM
    JODVCBUPS .QQT      GSBHNFOU
    TJ[F
    CZUFT      JEFBM 
    ЋЍ 
    ЋЌ 
    ЋЌ 
    ЋЍ e 14: Forwarding Performance of Cell Incubator risks are incurr Host-based I it is not suitab used in today’s power. Therefo operating with support the futu face of the flow implementation protocols. 7 Related Wireshark [38] Figure 11: CPU Load of Flow Abstractor versus Traffic Volume Figure 16 shows the CPU loads of the 15th CPU. At 5.95 Mpps, the load average was approximately 50%, but at 10.42 Mpps, the loads were close to 100%. More- over, at 14.88 Mpps, CPU resources were completely consumed. This limitation in forwarding performance was probably caused by the bias, which in turn was due o the flow director [10] of Intel’s NIC and its driver. The flow director cannot currently be controlled by user pro- grams on FreeBSD; thus, it causes bias depending on net- work flows. Note that the fairness regarding RSS queues s simply an implementation issue and is benchmarked or future work. Finally, the memory utilization of the cell incubator depends on the memory allocation strategy of netmap. The current implementation of the cell incubator requires approximately 700 MB of memory to conduct the exper- ments. 6 Discussion and Future Work Figure 12: Physical Memory Usage of Flow Ab (10K CPS) 
    (C&
    Y
     
    (C&
    Y
     Ћ Ќ Ѝ DFMM
    JODVCBUPS Figure 13: Experimental Network of Cell Incu 6.1 Performance Improvements We plan to improve the performance of the flow tor in three aspects. (1) The UNIX domain socket can be replaced other mechanism such as a memory-mapped file o memory attach [6]; however, these mechanisms suitable for our approach, which abstracts flows Thus, new mechanisms for high-performance m passing, such as the zero-copy UNIX domain so zero-copy pipe, should be studied. (2) The flow abstractor currently uses the mallo UP
    Ѝ UP
    Ќ UP
    Ќ
    BOE
    Ѝ Ћ Ќ Ѝ
17. 0UIFS
    'FBUVSFT w -
    -PPQCBDL
    JOUFSGBDF
    GPS
    FODBQTVMBUFE
    GMPXT
    w -PBE
    CBMBODJOH
    NFDIBOJTN
    GPS
    BQQMJDBUJPO
    QSPUPDPM
    BOBMZTFST
    w 4FQBSBUJOH
    BOE
    NJSSPSJOH
    NPEFT
    PG
    4'5"1
    DFMM
    JODVCBUPS
    w 4FF
    NPSF
    EFUBJOT
    JO
    PVS
    QBQFS 
18. $PODMVTJPO w 8F
    QSPQPTFE
    4'5"1
    GPS
    BQQMJDBUJPO
    MFWFM
    USBGGJD
    BOBMZTJT
    w 4'5"1
    IBT
    GPMMPXJOH
    GFBUVSFT
    w GMPX
    BCTUSBDUJPO
    w SVOOJOH
    PO
    DPNNPEJUZ
    IBSEXBSF
    w NPEVMBSJUZ
    w TDBMBCJMJUZ
    w 8F
    TIPXFE
    4'5"1
    IBT
    BDIJFWFE
    IJHI
    QFSGPSNBODF
    JO
    PVS
    FYQFSJNFOUT