Secure network monitoring using programmable data planes

Abstract

2017 AcknowledgmentsThroughout this year there were many people who helped me overcome the obstacles I faced. First of all, I would like to thank my family for giving me the opportunity to get where I am and for supporting me while I wrote this thesis and over all my life, in general.I would also like to thank my friends and colleagues with whom I shared great moments over the year. They made my work days more pleasant and our break times refreshing. They were always there to motivate me and to discuss ideas when I got stuck.I am also grateful to Faculdade de Ciências, specially its Informatics Department and the LaSIGE research group, for providing me all the conditions to perform my work.A special acknowledgement for my advisors, Professor Nuno Fuentecilla Maia Ferreira Neves and Professor Fernando Manuel Valente Ramos, for giving me the opportunity to join this project, for their guidance, and availability over the year. FundingThis work was partially supported by the European Commission through project FP7 SEGRID (607109) and project H2020 SUPERCLOUD (643964), and by national funds of Fundação para a Ciência e a Tecnologia (FCT) through project UID/CEC/00408/2013 (LaSIGE). i To my family and friends ResumoA monitorizaçãoé uma ferramenta fundamental na gestão das redes de computadores ao oferecer uma visão sobre o seu comportamento ao longo do tempo. Diferentes técnicas de monitorização têm sido aplicadas na prática, das quais se destacam duas: as baseadas em amostras e as baseadas em sketches. Enquanto as técnicas baseadas em amostras processam apenas um subconjunto do tráfego total (uma amostra), as técnicas baseadas em sketches processam todo o tráfego, procurando obter maior precisão nos seus resultados. Para poderem processar todo o tráfego e ainda assim serem escaláveis, os algoritmos baseados em sketches comprimem a informação monitorizada em estruturas de dados que têm comportamento semelhante ao das hash tables. Apesar da inevitável perda de informação resultante das colisões que ocorrem tipicamente quando se usam estas estruturas de dados, os algoritmos baseados em sketches apresentam ainda assim resultados bastante precisos, uma vez que todo o tráfego contribui para a computação das variáveis estatísticas monitorizadas.A informação fornecida pelos algoritmos de monitorizaçãoé essencial para a correta operação da rede. No entanto, se o algoritmo de monitorização puder ser corrompido, os seus resultados deixarão de ser confiáveis, tornando a monitorização inútil. No pior caso, o administrador de sistemas não deteta que o algoritmo de monitorização foi comprometido e acaba por tomar decisões inadequadas, baseadas em informação incorreta. Este problema demonstra a utilidade de algoritmos de monitorização seguros. No entanto, não temos conhecimento de nenhuma proposta que vise a segurança dos algoritmos de monitorização. De facto, a generalidade dos algoritmos de monitorização ignora as questões de segurança de forma a minimizar os seus tempos de execução e a memória utilizada, o que se justifica pelas ...

A real‐time attack defense framework for 5G network slicing

“…As mentioned in Section 2.4, probabilistic data structures provide a deterministic number of operations but probabilistic output. These structures use smaller amounts of memory and require less computation to provide a high‐quality approximation of the exact results …”

“…As a starting point, we argue that, in NS monitoring tasks, exact results are usually not necessary, and a high‐quality approximation is enough. This assumption suggests the use of probabilistic data structures (eg, BFs, Sketches) that use smaller amounts of memory and require less computation to achieve the desired goals . Such techniques have been widely accepted in network measurements, thanks to their higher accuracy compared to sampling techniques and their speed .…”

“…Probabilistic data structures provide a deterministic number of operations but probabilistic output. These structures use smaller amounts of memory and require less computation to provide a high‐quality approximation of the exact results . Probabilistic data structures such as BFs and Sketches have been widely accepted in network measurements, thanks to their higher accuracy compared to sampling techniques and their speed .…”

SFCMon: An Efficient and Scalable Monitoring System for Network Flows in SFC-enabled Domains

“…Probabilistic data structures provide a deterministic number of operations but probabilistic output. These structures use smaller amounts of memory and require less computation to provide a high-quality approximation of the exact results [Pereira et al 2017]. Probabilistic data structures such as Bloom Filters and Sketches have been widely accepted in network measurements, thanks to their higher accuracy compared to sampling techniques and their speed [Yang et al 2018].…”

“…As a starting point, we argue that, in SFC monitoring tasks, exact results are usually not necessary, and a highquality approximation is enough. This assumption suggests the use of probabilistic data structures (e.g., Bloom Filter, Sketches) that use smaller amounts of memory and require less computation to achieve the desired goals [Pereira et al 2017]. Such techniques have been widely accepted in network measurements, thanks to their higher accuracy compared to sampling techniques and their speed [Yang et al 2018].…”