Rafael Antonello

Characterizing signature sets for testing DPI systems

Deep Packet Inspection (DPI) is a crucial tool that enables more accurate network management and traffic profiling. Its high computational demands have been pushing networking researchers to study how to improve DPI technologies. However, in this quest for better performance, little effort has been devoted to making fair performance comparisons among DPIs. Even worse, most studies show performance gains by applying DPI techniques using specific, and sometimes small, signature sets. Consequently, one DPI engine may report a certain maximum throughput while another one may report a similar performance but may have used a significantly smaller signature set. This fact makes it clear that the research community needs a well-defined framework for testing new DPI systems. This paper proposes a new framework for characterizing signature sets for evaluating DPI systems and provides an in-depth analysis of signature sets from application, protocol, and intrusion detection systems.

Deterministic Finite Automaton for scalable traffic identification: The power of compressing by range

Deep Packet Inspection (DPI) systems have been becoming an important element in traffic measurement ever since port-based classification was deemed no longer appropriate, due to protocol tunneling and misuses of well-defined ports. Current DPI systems express application signatures using regular expressions and it is usual to perform pattern matching through the use of Finite Automaton (FA). Although DPI systems are essentially more accurate, they are also resource-intensive and do not scale well with link speeds. Looking to this area of interest, this paper proposes a novel Deterministic Finite Automaton, called Ranged Compressed Deterministic Finite Automaton (RCDFA), that compresses transitions without additional memory lookups. Experimental results show that RCDFA yields space savings of 97% over the original DFA and up to 93% better compression when compared to the DFAs state-of-the-art compression techniques.

Network level characterization of adaptive streaming over HTTP applications

Over the past years, multimedia applications have dramatically increased their share in the Internet traffic composition. Therefore, there is a strong interest from both industry and academia to develop techniques for improving users quality of experience for multimedia services, especially video content. Adaptive streaming is a technology that allows adaptation of video quality to the current network conditions and to the client device. In this paper we characterize the network traffic behavior of two popular adaptive streaming environments, namely Netflix and YouTube. In our experiments we observed their behavior under different constraints and varying network conditions. We found out that Netflix has overall better performance, even though both players behave poorly under bandwidth and packet loss constraints. In the delay constrained scenario, they nearly reached their regular behavior.

High-Performance Traffic Workload Architecture for Testing DPI Systems

Traffic identification and classification are essential tasks performed by Internet Service Provider (ISPs) administrators. Deep Packet Inspection (DPI) is currently playing a key role in traffic identification and classification due to its increased expressive power. To allow fair comparison among different DPI techniques and systems, workload generators should have the following characteristics: (i) synthetic packets with meaningful payloads; (ii) TCP and UDP traffic generation; (iii) a configurable network traffic profile, and (iv) a high-speed sending rate. This paper proposes a workload generator framework which inherits all of the above characteristics. A performance evaluation shows that our flexible workload generator system achieves very high sending rates over a 10Gbps network, using a commodity Linux machine. Additionally, we have configured and tested our workload generator following a real application traffic profile. We then analyzed its results within a DPI system, proving its accuracy and efficiency.

A step towards understanding Joost IPTV

Recently, peer-to-peer (P2P) streaming applications have drawn attention to both users and research community. The P2P approach for IPTV has the appealing feature of providing TV-like quality content distribution service (for both on-demand and live TV), which has been attracting a large number of users from across the globe. However, there is very little understanding about their network architecture and resource consumption. This work aims at having an in-depth understanding of Joost, a video-on-demand P2P system for distributing TV content, created by Skype and Kazaa founders. Results show that Joost relies on UDP for content delivery with an asymmetric bandwidth consumption of until 750 Kbps (download) and 480 Kbps (upload). We also evaluated the Joost control plane, which is mainly based on TCP. Along with other P2P IPTV technologies, such systems could have a great impact on network bandwidth utilization, even more than P2P file transfer ones.

A look under the hood: Revealing performance issues in the DPI engine

Compressed Deterministic Finite Automata (DFA) promises same representation power as traditional DFAs while using less memory for representing Regular Expressions (RE). Experimental evaluations of DFA-based Deep Packet Inspection (DPI) systems focus mainly on memory consumption without observing other important related aspects, such as the matching speed. Proper design of DPI systems requires the assessment of several performance metrics at hardware level, in order to make sure that its implementation will not compromise the overall performance. This paper proposes a novel and systematic evaluation of DPIs and reveals the impact of DFAs data-structures and the correspondent memory layout implementation to hardware-level metrics. Experimental results show that some DFA model and memory layout combinations are almost 100 times faster than others. Results also show that choosing the incorrect model-layout pair can lead to significant performance issues. Our methodology and results will certainly help researchers and developers to design efficient DPI engines, through the selection of the best DFA model and memory layout combination to achieve the targeted overall performance.

On the performance of DPI signature matching with dynamic priority

Traffic classification and identification plays an important role for several activities in network traffic management, where DPI (Deep Packet Inspection) is one of the most accurate and used techniques. However, inspection of packet payload is highly computing intensive. Several research studies have evaluated different components of DPI systems for application detection, in order to increase the classification speed. Nonetheless, the arrangement of the signatures in the signature set is an open issue and can degrade performance. Depending on the order of signatures, the overall performance of the DPI system can be degraded, leading to loss of packets and incorrect traffic identification. To the best of our knowledge, no previous research has analyzed the impact of the order of the application signatures and how it could be modified to improve the identification speed in a given DPI. In this work, we evaluate the impact of the ordering of signatures in a list and propose a method to dynamically adapt the signature list according to the traffic dynamics. We show the effectiveness of our approach with the most reactive proposed setup, saving more than 50% of processing time. We demonstrate the importance of the order of signatures and propose an effective method that can be used to save processing time. Finally, our method can be combined with other state-of-the-art techniques to achieve an optimal utilization of DPI features.

Benchmarking of compressed DFAs for traffic identification: Decoupling data structures from models

Current network traffic analysis systems heavily rely on Deep Packet Inspection (DPI) techniques, such as Finite Automata (FA), to detect patterns carried by regular expression (regex). However, traditional Finite Automata cannot keep up with the ever-growing speed of the Internet links. Although there are a number of efficient FA compressing mechanisms for DPIs, there is no standardized or common way to evaluate and compare them. In this scenario, this paper proposes a methodology to evaluate and compare automaton models and the data-structures that materialize them. We also adapt state-of-the-art memory layouts to better fit in todays computer architectures. Finally, we apply our methodology to most important automaton models, memory layouts, and well-known signature sets. The results show us that some memory layouts are not efficient for regexes that represent small automata and other ones which fit only with uncompressed automata. Further, we also found out that theoretical studies about memory usage from memory encodings are not as accurate as they should be.