Traffic analysis is currently used by Internet Service Providers (ISP) to gain important insights on users' behavior, and to develop from them new applications that can best exploit their network. The volume of encrypted traffic is increasing and this poses new limits on the potentiality of Deep Packet Inspection (DPI) techniques, normally used to analyze traffic flows. However, an important amount of information can still be extracted from the first packets belonging to a connection which usually are transmitted in clear. Recent research works have shown that traffic inspected by the DPI can be reduced without losing classification accuracy. In this thesis we propose to exploit stateful SDN data plane to offload, down to network elements, the process of filtering. We show that it is possible to dramatically decrease the amount of traffic analyzed by the DPI with zero-classification accuracy loss. We also show that we can reduce the computational requirements of the DPI and that the impact of the functions offloaded to network switches is negligible in terms of their performance. By taking advantage of the programmability of the data plane we also managed to delegate to the switches the process of statistics collection (such as per-flow number of packets, number of bytes, and duration), that otherwise would be lost by applying our filtering scheme. We gave evidences that this solution can be implemented in hardware, and also discuss an alternative implementation, based exclusively on a stateless data plane. Finally, we identify additional extensions to further optimize the solution.
L'analisi del traffico viene utilizzata dagli Internet Service Providers (ISP) per acquisire importanti informazioni riguardo il comportamento degli utenti. Queste informazioni vengono sfruttate dagli ISP per sviluppare nuove applicazioni e per sfruttare al meglio la rete in loro possesso. Il continuo aumento del traffico criptato crea sempre nuovi limiti alle tecniche di Deep Packet Inspection (DPI) usate per analizzare i flussi di dati. Una quantità importate di informazioni può comunque essere estratta dai primi pacchetti della connessione, i quali, di solito, vengono trasmessi in chiaro. Recenti lavori di ricerca hanno mostrato che è possibile ridurre il traffico ispezionato dalla DPI senza perdere precisione nella classificazione. In questo lavoro di tesi proponiamo di sfruttare il data plane SDN stateful per delegare il processo di filtraggio agli elementi di rete. Abbiamo mostrato che è possibile ridurre drasticamente le necessita computazionali della DPI e che l’impatto delle azioni delegate al data plane è trascurabile. Sfruttando le potenzialità del data plane programmabile siamo anche riusciti a demandare agli switch il processo di collezione delle statistiche dei flussi (es. numero di pacchetti, numero di byte, durata) che altrimenti sarebbero state perse con il nostro sistema di filtraggio. Abbiamo anche dato prova che la nostra soluzione può essere implementata in hardware. Inoltre, abbiamo proposto un’implementazione alternativa basata esclusivamente su data plane stateless. Infine, abbiamo identificato ulteriori estensioni che potrebbero ottimizzare ulteriormente la soluzione proposta.
Traffic classification offloading to stateful data plane in software-defined networking
MORO, DANIELE
2015/2016
Abstract
Traffic analysis is currently used by Internet Service Providers (ISP) to gain important insights on users' behavior, and to develop from them new applications that can best exploit their network. The volume of encrypted traffic is increasing and this poses new limits on the potentiality of Deep Packet Inspection (DPI) techniques, normally used to analyze traffic flows. However, an important amount of information can still be extracted from the first packets belonging to a connection which usually are transmitted in clear. Recent research works have shown that traffic inspected by the DPI can be reduced without losing classification accuracy. In this thesis we propose to exploit stateful SDN data plane to offload, down to network elements, the process of filtering. We show that it is possible to dramatically decrease the amount of traffic analyzed by the DPI with zero-classification accuracy loss. We also show that we can reduce the computational requirements of the DPI and that the impact of the functions offloaded to network switches is negligible in terms of their performance. By taking advantage of the programmability of the data plane we also managed to delegate to the switches the process of statistics collection (such as per-flow number of packets, number of bytes, and duration), that otherwise would be lost by applying our filtering scheme. We gave evidences that this solution can be implemented in hardware, and also discuss an alternative implementation, based exclusively on a stateless data plane. Finally, we identify additional extensions to further optimize the solution.| File | Dimensione | Formato | |
|---|---|---|---|
|
2017_04_Moro.pdf
Open Access dal 04/04/2020
Descrizione: Testo della tesi
Dimensione
1.56 MB
Formato
Adobe PDF
|
1.56 MB | Adobe PDF | Visualizza/Apri |
I documenti in POLITesi sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
https://hdl.handle.net/10589/133211