Byungjoon Lee

Content-aware Internet application traffic measurement and analysis

As the Internet is quickly evolving from best-effort networks to business quality networks, billing based on the precise traffic measurement becomes an important issue for Internet service providers (ISP). Billing settlement is necessary not only between ISP and customers but also between ISP. Currently, most ISP use a flat rate charging policy. Besides the degree of difficulty in deriving appropriate charging policies agreeable by a concerned party, there are substantial technical challenges to come up with a good usage-based accounting system. Usage-based accounting depending on IP packet header information only is not sufficient any more due to the highly dynamic nature of the development and the use of the Internet applications such as peer-to-peer and network games. They use port numbers dynamically and even several applications can use the same port number. Thus, more precise means of classifying them and accounting for their traffic usage are required. In this paper, we propose a high performance, adaptable, configurable, and scalable content-aware application traffic measurement and analysis system which can achieve very accurate usage-based accounting.

Building firewall over the software-defined network controller

Many have recognized the need to restructure the current internet work into a much more dynamic networking environment. It is difficult for todays inflexible infrastructure to cope with the fast changing demands of the users. As a result, Software-Defined Network (SDN) was introduced around 2005 to transform todays network to have centralized management, rapid innovation, and programmability by decoupling the control and data planes. This study focuses on developing a firewall application that runs over an OpenFlow-based SDN controller to show that most of the firewall functionalities are able to be built on software, without the aid of a dedicated hardware. Among many OpenFlow controllers that already exist for the public, we have chosen POX written in Python for the experiment; and to create the SDN network topology, we have used VirtualBox and Mininet. In this study, we cover the implementation detail of our firewall application, as well as the experimentation result.

RAON: Recursive Abstraction of OpenFlow Networks

This paper describes RAON which is a novel solution for tackling scalability in OpenFlow networks. This approach recursively abstracts its underlying networks as OpenFlow switches to reduce complexity and to increase manageability. The design and early prototype of RAON shows very promising and graceful use cases of various scenarios.

End-to-end flow monitoring with IPFIX

End-to-End (E2E) flow monitoring is useful for observing performance of networks such as throughput, jitter and delay. Typically, E2E flow monitoring is carried out at end hosts with known tools such as iperf. However, the end-host approach may not be easily deployed in a large-scale network because of high cost and administrative overhead. Therefore, in this paper, we propose a new E2E flow monitoring method based on IP Flow Information eXport (IPFIX) that could provide QoS metrics such as throughput, retransmission rate, delay, and jitter for TCP flows and SIP-signalled RTP flows. We have extended the IPFIX templates for carrying QoS-related fields, and developed the E2E flow monitoring function with the open source that could be embedded into routers. From experiments, it was shown that the performance of TCP and RTP flows could be easily examined with the IPFIX-based approach.

IRIS-CoMan: Scalable and Reliable Control and Management Architecture for SDN-Enabled Large-Scale Networks

Abstract A software-defined network (SDN) enables agile network control and configuration as well as shortens the network function deployment time. Despite the projected benefits of an SDN, the abstractions toward the remote and centralized control tend to impose excessive control traffic overhead in order for the controller to acquire global network visibility as well as extend the legacy network’s inaccurate and unreliable management problems into the control plane. In addition, many recent SDNs facilitate multiple management pillars (such as customized interfaces and protocols) so that user applications can directly communicate to the data plane to measure and monitor specific information. Not only logical control centralization, but also virtualization of the underlying computing and network resources add demands of more flexible and programmable monitoring functions per the virtual domain. A complex combination of multiple and heterogeneous management channels introduces the significant scalability, control tuning, and reliability problems in SDN. In this paper, to address the above control and management problems, we propose a highly scalable and reliable SDN control and management architecture, called IRIS Control and Management (IRIS-CoMan). It builds an intelligent agent based hybrid SDN architecture by providing a control and management abstraction and filtering layer. It serves an essential component for the reliable, scalable, and secure SDN deployment. We present design, implementation, deployment, and feasibility evaluation results of IRIS-CoMan.

A Scalable and Highly Available Network Management Architecture on Consistent Hashing

To devise a large-scale network management system, we should consider following issues: heterogeneity of network devices, interoperation between multiple network domains, scal- ability and availability of the management system, and the cost of developing and deploying the system. Traditional network management software does not provide a cost-effective solution for the above issues because they are usually designed for a specific network domain composed of a limited set of network devices, and they have a complex multi-tiered architecture that usually requires a separate failover scheme and development strategy for each tier at the additional costs of development, deployment, and operation. In this paper, we propose a novel network management architecture, CORD, based on consistent hashing. CORD achieves scalable load balancing and sub-50ms failover performance against a node failure with a one-tired architecture. Using XML, CORD provides highly-customizable southbound management interface which integrates network devices from multiple vendors with ease. With the experiments, we have shown that the standard deviation of load balancing on CORD nodes is maintained around 5% and the failover time is below 50ms on average. In addition, we have applied CORD to the optical network management system development to reduce CAPEX and OPEX.

X-CLI: CLI-based management architecture using XML

As Internet technology becomes more complex, the policy information for managing the Internet grows beyond the capability of a simple protocol like SNMP. IETF suggested COPS (common open policy service) as an alternative, but it has not been widely accepted. For that reason, many administrators have developed network management systems which control network devices using CLI (command line interface), but systems based on CLI have a maintenance problem: when the syntax of CLI changes, the implementation of the system must be modified. We suggest X-CLI (XML wrapper API for CLI) as a solution for this problem, and describe its design principles.

Application-specific packet capturing using kernel probes

When we reverse-engineer unknown protocols or analyze the Internet traffic, it is critical to capture complete traffic traces generated by a target application. Besides, to prove the accuracy of Internet traffic classification algorithms of the traffic monitoring system usually located in the middle of the network, it is highly required to retain traffic traces associated with the related application. Therefore, in this paper, we present an application-specific packet capturing method at end hosts, which is based on the dynamic kernel probing technique. From the experiments it is shown that the proposed method is useful for creating per-application complete traffic traces without performance degradation.

Content classification of WAP traffic in Korean cellular networks

Cellular phones are expanding their popularity in data service. However, we do not know much about the data traffic consumed in cellular networks. Traditional traffic classification studies have focused on grouping a set of related packets into the application categories. However, the proposed methods are hard to be applied to Korean cellular data traffic analysis because most data is from a single application: Wireless Application Protocol (WAP). As WAP conveys WML documents, we have to inspect the WML documents included in a traffic flow for more detailed classification. In this paper, we propose a method that finds Korean words carried in WML documents and classifies the documents into appropriate content categories according to the their meaning. We implemented and evaluated simple classification heuristics using packet traces from CDMA 1x EVDO/WCDMA HSDPA networks. From the result, we show that a simple heuristic is effective for classifying WAP flows to their content categories.