FPGA-Assisted DPI Systems: 100 Gbit/s and Beyond

Orosz, Péter; Tóthfalusi, Tamás; Varga, Pál

doi:10.1109/comst.2018.2876196

Cited by 12 publications

(8 citation statements)

References 107 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Češka et al [7] design an FPGA architecture for regex matching on 100Gbps networks by leveraging NFAs. Similar solutions built with FPGA are also described in [30,36]. Rahimi et al [32] present an open-source FPGA-based automata processing framework called Grapefruit to facilitate design space exploration for pattern matching.…”

Section: Related Workmentioning

confidence: 99%

Fidas

Chen

Zhang

Wang

et al. 2022

Proceedings of the 49th Annual International Symposium on Computer Architecture

View full text Add to dashboard Cite

Network intrusion detection systems (IDS) are crucial for secure cloud computing, but they are also severely constrained by CPU computation capacity as the network bandwidth increases. Therefore, hardware offloading is essential for the IDS servers to support the ever-growing throughput demand for packet processing. Based on the experience of large-scale IDS deployment, we find the existing hardware offloading solutions have fundamental limitations that prevent them from being massively deployed in the production environment. In this paper, we present Fidas, an FPGA-based intrusion detection offload system that avoids the limitations of the existing hardware solutions by comprehensively offloading the primary NIC, rule pattern matching, and traffic flow rate classification. The pattern matching module in Fidas uses a multi-level filter-based approach for efficient regex processing, and the flow rate classification module employs a novel dual-stack memory scheme to identify the hot flows under volumetric attacks. Our evaluation shows that Fidas achieves the state-of-the-art throughput in pattern matching and flow rate classification while freeing up processors for other security-related functionalities. Fidas is deployed in the production data center and has been battle-tested for its performance, cost-effectiveness, and DevOps agility.

show abstract

Section: Related Workmentioning

confidence: 99%

Fidas

Chen

Zhang

Wang

et al. 2022

Proceedings of the 49th Annual International Symposium on Computer Architecture

View full text Add to dashboard Cite

show abstract

“…2. Non-segmented system architecture means that there should be one frame in a single word, and segmented system architecture can process multiple frames at the same time [18]. Region 1 and Region 2 correspond to the computation of W ln B n in (4).…”

Section: A Non-segmented System Architecturementioning

confidence: 99%

“…The segmented system architecture is proposed to solve the problem. The bus format is just like that in [7], and the block in [7] is another name for the segment in [18]. For an example, a 4096-bit bus can process 8 complete frames at the same time; hence, the bus can be divided into 8 regions [7].…”

Section: E Segmented System Architecturementioning

confidence: 99%

Low-Cost and Programmable CRC Implementation Based on FPGA

Liu

Qiu

Pan

et al. 2021

IEEE Trans. Circuits Syst. II

View full text Add to dashboard Cite

Cyclic redundancy check (CRC) is a well-known error detection code that is widely used in Ethernet, PCIe, and other transmission protocols. The existing FPGA-based implementation solutions are faced with the problem of excessive resource utilization in high-performance scenarios. The padding zeros problem and the introduction of programmability further exacerbate this problem. In this brief, the stride-by-5 algorithm is proposed to achieve the optimal utilization of FPGA resources. The pipelining go back algorithm is proposed to solve the padding zeros problem. The method of reprogramming by HWICAP is proposed to realize programmability with a small and constant resource utilization. The experimental results show that the resource utilization of proposed non-segmented architecture is 84.1% and 37.6% lower than those of two state-of-the-art FPGA-based CRC implementations, and the proposed segmented architecture has a lower resource utilization by 83.9% and 8.9% compared wtih the two state-of-the-art architectures; meanwhile, the throughput and programmability are guaranteed. We made the source code available on GitHub[1].

show abstract

“…Software-only DPI methods incur substantial latency, as they have to go through a demanding process of fetching each packet from the interface, buffering it, passing it to the CPU, waiting for the operating system task scheduler, and finally parsing the multiple protocol headers. This factually limits packet capture to 70% of the line rate, thereby disregarding a substantial fraction of traffic [42]. On the other hand, recent hardware-based or hybrid DPI solutions can operate close to the line rate [13], yet they come at a very high economic cost for the operator: dedicated FPGA hardware must be deployed at every collection point, and expensive equipment updates are required whenever new classification rules for emerging traffic categories are necessary.…”

Section: Introductionmentioning

confidence: 99%

Microscope

Zhang

Fiore

Ziemlicki

et al. 2020

Proceedings of the 26th Annual International Conference on Mobile Computing and Networking

View full text Add to dashboard Cite

The growing diversification of mobile services imposes requirements on network performance that are ever more stringent and heterogeneous. Network slicing aligns mobile network operation to this context, by enabling operators to isolate and customize network resources on a per-service basis. A key input for provisioning resources to slices is real-time information about the traffic demands generated by individual services. Acquiring such knowledge is however challenging, as legacy approaches based on in-depth inspection of traffic streams have high computational costs, which inflate with the widening adoption of encryption over data and control traffic. In this paper, we present a new approach to servicelevel demand estimation for slicing, which hinges on decomposition, i.e., the inference of per-service demands from traffic aggregates. By operating on total traffic volumes only, our approach overcomes the complexity and limitations of legacy traffic classification techniques, and provides a suitable input to recent 'Network Slice as a Service' (NSaaS) models. We implement decomposition through Microscope, a novel framework that uses deep learning to infer individual service demands from complex spatiotemporal features hidden in traffic aggregates. Microscope ( ) transforms traffic data collected in irregular radio access deployments in a format suitable for convolutional learning, and ( ) can accommodate a variety of neural network architectures, including original 3D Deformable Convolutional Neural Networks (3D-DefCNNs) that we explicitly design for decomposition. Experiments with measurement data collected in an operational network demonstrate that Microscope accurately estimates per-service traffic demands with relative errors below 1.2%. Further, tests in practical NSaaS management use cases show that resource allocations informed by decomposition yield affordable costs for the mobile network operator. CCS CONCEPTS• Networks → Network monitoring; Network management; Mobile networks; • Computing methodologies → Artificial intelligence.

show abstract

FPGA-Assisted DPI Systems: 100 Gbit/s and Beyond

Cited by 12 publications

References 107 publications

Fidas

Fidas

Low-Cost and Programmable CRC Implementation Based on FPGA

Microscope

Contact Info

Product

Resources

About