High Performance Session State Management Scheme for Stateful Packet Inspection

Yoon, Seung-Yong; Kim, Byoungkoo; Oh, Jihyun; Jang, Jongsoo

doi:10.1007/978-3-540-75476-3_73

Cited by 5 publications

(4 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SPI is designed to prevent harmful or unsolicited packets entering the computer. SPI was originally developed for firewalls, but so far it has become an important factor in network-based intrusion detection systems (NIDS) and many other applications [ 3 ].…”

Section: Background and Related Workmentioning

confidence: 99%

Signal Waveform Detection with Statistical Automaton for Internet and Web Service Streaming

Tseng

Liu

et al. 2014

The Scientific World Journal

View full text Add to dashboard Cite

In recent years, many approaches have been suggested for Internet and web streaming detection. In this paper, we propose an approach to signal waveform detection for Internet and web streaming, with novel statistical automatons. The system records network connections over a period of time to form a signal waveform and compute suspicious characteristics of the waveform. Network streaming according to these selected waveform features by our newly designed Aho-Corasick (AC) automatons can be classified. We developed two versions, that is, basic AC and advanced AC-histogram waveform automata, and conducted comprehensive experimentation. The results confirm that our approach is feasible and suitable for deployment.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Signal Waveform Detection with Statistical Automaton for Internet and Web Service Streaming

Tseng

Liu

et al. 2014

The Scientific World Journal

View full text Add to dashboard Cite

show abstract

“…Flow look-up can be achieved mostly by three ways: Hashing, Bloom Filter (BF) and Tenary Content-Addressable Memory (TCAM). To reduce flow table size, [4] and [8] use a hash of the "raw" flow ID and a hash bucket for hash-collision. The use of a hashed flow ID could result in a dramatically smaller entry size, but the (many-to-one) hash function may cause collisions.…”

Section: Related Workmentioning

confidence: 99%

“…Traditionally, flow tables have been implemented in DRAM [4], [5] and flow look-up is achieved by a tree-based search, hashing and Bloom filters techniques [6] [5], [7]. For highspeed line cards in the routers, implementation of the flow table using a fast but small SRAM for the flow table has been recently proposed in [1], [8]. These approaches hash the flow ID drawn directly from the packets to the address bus of the SRAM, which stores the flow state information.…”

Section: Introductionmentioning

confidence: 99%

Mass Purging of Stale TCP Flows in Per-Flow Monitoring Systems

Nam

Patankar

Kesidis

et al. 2009

2009 Proceedings of 18th International Conference on Computer Communications and Networks

View full text Add to dashboard Cite

Timely deletion of a large number of stale sessions monitored by Internet routers, particularly in the presence of SYN floods, is critical to prevent flow table explosion. We investigate two frameworks for purging of stale sessions: "opportunistic" purging that employs a free-list of pointers to memory and "deterministic purging" involving logical swapping of a 1-bit flow enable and touch-bit vectors without requiring a free list. We compare the performance of our algorithms with a stateof-the-art algorithm, namely Finger-Compressed Filter (FCF). Our analysis using Internet traces shows that the deterministic purging, with no purging overhead, is ideal in that it reduces false positive and negative rates as compared to FCF by 52.5% and 59.2%, when the table size is twice the average number of active flows.

show abstract

“…A large number of short-lived flows or abnormal flows results in significant consumption of the flow memory as well as an increase in the volume of data exchanged for collaboration. Even though a SRAM implementation of the flow table has become typical for fast operations despite its limited capacity [5], [6], this has worsen the scaling problem. Since prediction of the "proper" size of flow table is not trivial, the per-flow monitoring should adapt to the dynamic traffic conditions.…”

Section: Introductionmentioning

confidence: 99%

Clock-like Flow Replacement Schemes for Resilient Flow Monitoring

Nam

Patankar

Lim

et al. 2009

2009 29th IEEE International Conference on Distributed Computing Systems

View full text Add to dashboard Cite

In the context of a collaborating surveillance system for active TCP sessions handled by a networking device, we consider two problems. The first is the problem of protecting a flow table from overflow and the second is developing an efficient algorithm for estimating the number of active flows coupled with the identification of "heavy-hitter" TCP sessions. Our proposed techniques are sensitive to limited hardware and software resources allocated for this purpose in the linecards in addition to the very high data rates that modern line cards handle; specifically we are interested in cooperatively maintaining a per-flow state with a low cost, which has resiliency on dynamic traffic mix. We investigate a traditional timeout processing mechanism to manage the flow table for per-flow monitoring, called Timeout-Based Purging (TBP), our proposed Clock-like Flow Replacement (CFR) algorithms using a replacement policy, called "clock", and a hybrid approach combining these two. Experiments with Internet traces show that our CFR schemes can significantly reduce both false positive and false negative rates, regardless of whether the flow table is fully occupied (even under SYN flooding) or sufficiently empty. Our hybrid scheme estimates the number of active flows accurately, and confines the heavy-hitters without storing packet counters.

show abstract

High Performance Session State Management Scheme for Stateful Packet Inspection

Cited by 5 publications

References 2 publications

Signal Waveform Detection with Statistical Automaton for Internet and Web Service Streaming

Signal Waveform Detection with Statistical Automaton for Internet and Web Service Streaming

Mass Purging of Stale TCP Flows in Per-Flow Monitoring Systems

Clock-like Flow Replacement Schemes for Resilient Flow Monitoring

Contact Info

Product

Resources

About