The fast evolving nature of modern cyber threats and network monitoring needs calls for new, "software-defined", approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the "programming logic" of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.
In the literature, several monitoring platforms have targeted monitoring applications' programmability. A Monitoring API for programmable HW network adapters is proposed in @cite_19 . On top of such probe, network administrators may implement custom C++ monitoring applications. One of the developed applications is Appmon @cite_26 . It uses deep packet inspection to classify observed flows and attribute these flows to an application. Flow are stored in an hash table and retrieved when an flow is observed again. This way to handle states bears some resemblance with that proposed in this work, which however makes usage of (much) more descriptive eXtended Finite State Machines. CoMo @cite_21 is another well known network monitoring platform. We share with CoMo the (for us, side) idea of extensible plug-in metric modules, but besides this we are quite orthogonal to such work, as we rather focus on how to combine metrics with features and states using higher level programming techniques (versus CoMo's low level queries).
@cite_19 @cite_26 @cite_21
2345093194 2572745118 2198609082 2074373872
Wireless sensor networks (WSNs) are starting to have a high impact on our societies and, for next generation WSNs to become more integrated with the Internet, researchers recently proposed to embed IPv6 into such very constrained networks. Also, constraint application protocol (CoAP) and Observe have been proposed for RESTful services to be provided. CoAP Observe supports the use of caches proxies and, for this reason, an observation request may resort to multiple client server registration steps in order to get notifications. Here, we propose to plan the multiple registration steps, at proxies, of multiple observation requests in order to make proper aggregation scheduling of notifications for transmission. This leads to less energy consumption and to an effective use of bandwidth, avoiding energy depletion of nodes, and increasing the network lifetime. Besides, mathematically formalizing the problem, a heuristic approach is developed and a discussion on how to incorporate algorithm’s decision into the network is done. The proposed framework can be applied to multiple application domains (e.g., monitoring, machine to machine). In recent years, we have seen tremendous progress in the field of object detection. Most of the recent improvements have been achieved by targeting deeper feedforward networks. However, many hard object categories such as bottle, remote, etc. require representation of fine details and not just coarse, semantic representations. But most of these fine details are lost in the early convolutional layers. What we need is a way to incorporate finer details from lower layers into the detection architecture. Skip connections have been proposed to combine high-level and low-level features, but we argue that selecting the right features from low-level requires top-down contextual information. Inspired by the human visual pathway, in this paper we propose top-down modulations as a way to incorporate fine details into the detection framework. Our approach supplements the standard bottom-up, feedforward ConvNet with a top-down modulation (TDM) network, connected using lateral connections. These connections are responsible for the modulation of lower layer filters, and the top-down network handles the selection and integration of contextual information and low-level features. The proposed TDM architecture provides a significant boost on the COCO testdev benchmark, achieving 28.6 AP for VGG16, 35.2 AP for ResNet101, and 37.3 for InceptionResNetv2 network, without any bells and whistles (e.g., multi-scale, iterative box refinement, etc.). Passive network monitoring applications such as intrusion detection systems are susceptible to overloads, which can be induced by traffic spikes or algorithmic singularities triggered by carefully crafted malicious packets. Under overload conditions, the system may consume all the available resources, dropping most of the monitored traffic until the overload condition is resolved. Unfortunately, such an awkward response to overloads may be easily capitalized by attackers who can intentionally overload the system to evade detection. In this paper we propose Selective Packet Paging (SPP), a two-layer memory management design that gracefully responds to overload conditions by storing selected packets in secondary storage for later processing, while using randomization to avoid predictable evasion by sophisticated attackers. We describe the design and implementation of SPP within the widely used Libpcap packet capture library. Our evaluation shows that the detection accuracy of Snort on top of Libpcap is significantly reduced under algorithmic complexity and traffic overload attacks, while SPP makes it resistant to both algorithmic overloads and traffic bursts. Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.