Software Defined Monitoring of Application Protocols

Abstract

With the ongoing shift of network services to the application layer also the monitoring systems focus more on the data from the application layer. The increasing speed of the network links, together with the increased complexity of application protocol processing, require a new way of hardware acceleration. We propose a new concept of hardware acceleration for flexible flow-based application level traffic monitoring which we call Software Defined Monitoring. Application layer processing is performed by monitoring tasks implemented in the software in conjunction with a configurable hardware accelerator. The accelerator is a high-speed application-specific processor tailored to stateful flow processing. The software monitoring tasks control the level of detail retained by the hardware for each flow in such a way that the usable information is always retained, while the remaining data is processed by simpler methods. Flexibility of the concept is provided by a plugin-based design of both hardware and software, which ensures adaptability in the evolving world of network monitoring. Our high-speed implementation using FPGA acceleration board in a commodity server is able to perform a 100 Gb/s flow traffic measurement augmented by a selected application-level protocol analysis.

Deep Packet Inspection as a Service

“…Middlebox consolidation and programmability: A different approach to tackle the problem raised by managing multiple middleboxes is to offer a consolidated solution [4,14,25,45] consisting of a single hardware, possibly programmable, that consolidates multiple logical middleboxes. DPI as a service may complement such consolidated architectures to improve the overall performance, either by extracting the DPI engine from these boxes to a virtual service, or by using our algorithm to merge multiple DPI engines and utilize shared hardware better.…”