The fast evolving nature of modern cyber threats and network monitoring needs calls for new, "software-defined", approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the "programming logic" of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.

Bonola, M., Bianchi, G., Picierro, G., Pontarelli, S., Monaci, M. (2017). StreaMon: A Data-Plane Programming Abstraction for Software-Defined Stream Monitoring. IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 14(6), 664-678 [10.1109/TDSC.2015.2499747].

StreaMon: A Data-Plane Programming Abstraction for Software-Defined Stream Monitoring

Bonola M.;Bianchi G.;PICIERRO, GIULIO;Pontarelli S.;
2017-01-01

Abstract

The fast evolving nature of modern cyber threats and network monitoring needs calls for new, "software-defined", approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the "programming logic" of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.
2017
Pubblicato
Rilevanza internazionale
Articolo
Esperti anonimi
Settore ING-INF/03 - TELECOMUNICAZIONI
English
SDN; network monitoring; XFSM
Bonola, M., Bianchi, G., Picierro, G., Pontarelli, S., Monaci, M. (2017). StreaMon: A Data-Plane Programming Abstraction for Software-Defined Stream Monitoring. IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, 14(6), 664-678 [10.1109/TDSC.2015.2499747].
Bonola, M; Bianchi, G; Picierro, G; Pontarelli, S; Monaci, M
Articolo su rivista
File in questo prodotto:
Non ci sono file associati a questo prodotto.

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/2108/200393
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 12
  • ???jsp.display-item.citation.isi??? 10
social impact