SmartWatch

Panda, Sourav; Feng, Yixiao; Kulkarni, Sameer; Ramakrishnan, K. K.; Duffield, Nick; Bhuyan, Laxmi N.

doi:10.1145/3485983.3494861

Cited by 10 publications

(3 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The paper [30] proposes a new approach for performing traffic analysis and flowstate tracking using smart network interface cards (SmartNICs) called SmartWatch. The authors describe the design and implementation of the system, which leverages the programmability and processing power of SmartNICs to perform an accurate traffic analysis and flow-state tracking in real time.…”

Section: Deployment and Performance Analysismentioning

confidence: 99%

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques

Abu Bakar,

Kijsirikul

2023

Sensors

View full text Add to dashboard Cite

Network security is paramount in today’s digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance.

show abstract

Section: Deployment and Performance Analysismentioning

confidence: 99%

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques

Abu Bakar,

Kijsirikul

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Networking monitoring is, however, a complex operation that entails collecting and analyzing traffic information at different locations using a different types of devices. Monitoring solutions such as *Flow [63], SmartWatch [59], NetWarden [71], and FlowLens [7]) rely on a combination of ASIC switches, SmartNICs, and general-purpose CPUs to detect network events at different levels of granularity and performance. ASIC switches offer high packet processing throughput with constrained packet processing logic (e.g., no decryption) and constrained memory.…”

Section: Deployment Beyond Asic Switchesmentioning

confidence: 99%

“…We showed in our evaluation that PipeCache significantly improves the accuracy of the packet length distribution in FlowLens [7], which would intuitively result in better detection accuracy on external devices. Solutions that rely on a two-level detection mechanism (e.g., Smart-Watch [59]), where the ASIC identifies suspicious traffic at a coarse grainularity and forwards it to external devices for fine-grained analysis, may also benefit from PipeCache. Our mechanism would reduce memory requirements for the data structures deployed on the switch for identifying suspicious traffic.…”

Section: Deployment Beyond Asic Switchesmentioning

confidence: 99%

Network Monitoring on Multi-Pipe Switches

Chiesa

Verdi

2023

SIGMETRICS Perform. Eval. Rev.

View full text Add to dashboard Cite

Programmable switches have been widely used to design network monitoring solutions that operate in the fast data-plane level, e.g., detecting heavy hitters, super-spreaders, computing flow size distributions and their entropy. Existing works assume packets access the same memory region in a switch. However, high-speed ASIC switches deploy multiple packet processing pipes, each equipped with its own independent memory. In this work, we first quantify the accuracy degradation due to splitting a monitoring data structure across multiple pipes (e.g., up to 3000x worse flow-size estimation average error). We then present PipeCache, a system that adapts existing data-plane mechanisms to multi-pipe switches by storing monitoring information for a traffic class into a single pipe. PipeCache stores monitoring information into a cache and piggybacks this information onto existing data packets to the correct pipe. Our implementation shows a 2-20x memory reduction to achieve an accuracy similar to single-pipe deployments.

show abstract