2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)最新文献

A one-way proof-of-work protocol to protect controllers in software-defined networks 用于保护软件定义网络中的控制器的单向工作量证明协议

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889481

Jingrui Li, T. Wolf

引用次数: 9

A study of speed mismatches between communicating Virtual Machines 通信虚拟机之间速度不匹配的研究

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2881037

L. Rizzo, Stefano Garzarella, G. Lettieri, Vincenzo Maffione

引用次数: 6

Evaluating Information-Centric Networks in Disconnected, Intermittent, and Low-bandwidth environments 在断开连接、间歇和低带宽环境中评估信息中心网络

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889483

Thiago Teixeira, M. Zink

引用次数: 1

Forwarding strategies for applications in Named Data Networking 命名数据网络中应用的转发策略

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889475

Hila Ben Abraham, P. Crowley

引用次数: 10

O3FA: A scalable finite automata-based pattern-matching engine for out-of-order deep packet inspection O3FA:一个可扩展的基于有限自动机的模式匹配引擎，用于无序深度数据包检测

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2881034

Xiaodong Yu, Wu-chun Feng, D. Yao, M. Becchi

{"title":"O3FA: A scalable finite automata-based pattern-matching engine for out-of-order deep packet inspection","authors":"Xiaodong Yu, Wu-chun Feng, D. Yao, M. Becchi","doi":"10.1145/2881025.2881034","DOIUrl":"https://doi.org/10.1145/2881025.2881034","url":null,"abstract":"To match the signatures of malicious traffic across packet boundaries, network-intrusion detection (and prevention) systems (NIDS) typically perform pattern matching after flow reassembly or packet reordering. However, this may lead to the need for large packet buffers, making detection vulnerable to denial-of-service (DoS) attacks, whereby attackers exhaust the buffer capacity by sending long sequences of out-of-order packets. While researchers have proposed solutions for exact-match patterns, regular-expression matching on out-of-order packets is still an open problem. Specifically, a key challenge is the matching of complex sub-patterns (such as repetitions of wildcards matched at the boundary between packets). Our proposed approach leverages the insight that various segments matching the same repetitive sub-pattern are logically equivalent to the regular-expression matching engine, and thus, interchanging them would not affect the final result. In this paper, we present O3FA, a new finite automata-based, deep packet-inspection engine to perform regular-expression matching on out-of-order packets without requiring flow reassembly. O3FA consists of a deterministic finite automaton (FA) coupled with a set of prefix-/suffix-FA, which allows processing out-of-order packets on the fly. We present our design, optimization, and evaluation for the O3FA engine. Our experiments show that our design requires 20×–4000× less buffer space than conventional buffering-and-reassembling schemes on various datasets and that it can process packets in real-time, i.e., without reassembly.","PeriodicalId":335686,"journal":{"name":"2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130990792","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 23

Minflate: Combining rule set minimization with jump-based expansion for fast packet classification Minflate:将规则集最小化与基于跳跃的扩展相结合，用于快速分组分类

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889485

Sven Hager, P. John, Andreas Fiessler, B. Scheuermann

引用次数: 3

On data plane latency and pseudo-TCP congestion in Software-Defined Networking 软件定义网络中的数据平面延迟和伪tcp拥塞

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889482

Dongzhe Tai, Huichen Dai, Ting Zhang, Bin Liu

引用次数: 5

Many-field packet classification for software-defined networking switches 软件定义网络交换机的多字段分组分类

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2881036

Cheng-Liang Hsieh, N. Weng

{"title":"Many-field packet classification for software-defined networking switches","authors":"Cheng-Liang Hsieh, N. Weng","doi":"10.1145/2881025.2881036","DOIUrl":"https://doi.org/10.1145/2881025.2881036","url":null,"abstract":"Packet classification is a core problem for OpenFlow-based software-defined networking switches, which required 38 packet header fields per flow to be examined against thousands of rules in a ruleset. With the trend of continue growing number of fields in a rule and the number of rules in rule set, it will be a great challenge to design a high performance packet classification solution with the capability to easy update new rule and fields. In this paper, we present a scalable many-field packet classification algorithm with varying rulesets and its prototype implementation on a graphics processing unit. The proposed algorithm constructs multiple lookup tables and merges partial lookup results for a small ruleset to accelerate the overall packet classification process by using effective bit positions in a ruleset with three selecting metrics: wildcard ratio, independence index, and diversity index. Those lookup tables made with effective bit positions are flat with a low rule replication ratio. Besides, they are adjustable to meet different implementation environments for a good performance scalability between different ruleset sizes. Our prototype on a single NVIDIA K20C GPU achieves 198 MPPS, 186 MPPS, 163 MPPS throughput for 1K, 32K, and 100K 15-field ruleset.","PeriodicalId":335686,"journal":{"name":"2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS)","volume":"103 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133964399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 24

Node configuration for the Aho-Corasick algorithm in intrusion detection systems 入侵检测系统中Aho-Corasick算法的节点配置

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2889473

Alexsandre B. Lacroix, J.M. Pierre Langlois, François-Raymond Boyer, Antoine Gosselin, G. Bois

引用次数: 6

PFPSim: A programmable forwarding plane simulator PFPSim:一个可编程的转发平面模拟器

2016 ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS) Pub Date : 2016-03-17 DOI: 10.1145/2881025.2881029

S. Abdi, Umair Aftab, Gordon Bailey, Bochra Boughzala, Faras Dewal, Shafigh Parsazad, Eric Tremblay

引用次数: 10