The fast evolving nature of modern cyber threats and network monitoring needs calls for new, "software-defined", approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the "programming logic" of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.
Finally, while our work is, to the best of our knowledge, the first which exploits eXtended Finite State Machines (XFSM) for programming custom monitoring logic, we acknowledge that the idea of using XFSM as programming language for networking purposes was proposed in a completely different field (wireless MAC protocols programmability) by @cite_27 .
@cite_27
1968861283 2139644003 2152390472 2053770984
Programmable wireless platforms aim at responding to the quest for wireless access flexibility and adaptability. This paper introduces the notion of wireless MAC processors. Instead of implementing a specific MAC protocol stack, Wireless MAC processors do support a set of Medium Access Control “commands” which can be run-time composed (programmed) through software-defined state machines, thus providing the desired MAC protocol operation. We clearly distinguish from related work in this area as, unlike other works which rely on dedicated DSPs or programmable hardware platforms, we experimentally prove the feasibility of the wireless MAC processor concept over ultra-cheap commodity WLAN hardware cards. Specifically, we reflash the firmware of the commercial Broadcom AirForce54G off-the-shelf chipset, replacing its 802.11 WLAN MAC protocol implementation with our proposed extended state machine execution engine. We prove the flexibility of the proposed approach through three use-case implementation examples. Accurate analytical expressions of delay and packet reception probabilities, and energy consumption of duty-cycled wireless sensor networks with random medium access control (MAC) are instrumental for the efficient design and optimization of these resource-constrained networks. Given a clustered network topology with unslotted IEEE 802.15.4 and preamble sampling MAC, a novel approach to the modeling of the delay, reliability, and energy consumption is proposed. The challenging part in such a modeling is the random MAC and sleep policy of the receivers, which prevents to establish the exact time of data packet transmission. The analysis gives expressions as function of sleep time, listening time, traffic rate and MAC parameters. The analytical results are then used to optimize the duty cycle of the nodes and MAC protocol parameters. The approach provides a significant reduction of the energy consumption compared to existing solutions in the literature. Monte Carlo simulations by ns2 assess the validity of the analysis. Exponential growth in the number of wireless devices that operate in the limited unlicensed frequency spectrum necessitates the next generation of radio devices to be reconfigurable and sensitive to changes in network conditions and spectrum availability. Most modern wireless devices offer increased software programmability and control over radio communication parameters. Since a large portion of the MAC protocol is implemented in software, with the firmware providing a set of functional primitives, it is possible to design and implement alternate MAC protocols in real testbeds equipped with commodity 802.11 devices. This paper describes FreeMAC, a reconfigurable MAC protocol development framework that enables the design and implementation of a general class of multi-channel MAC protocols on a typical Linux system. FreeMAC provides support for frequent channel switching and fine control over the timing of packet transmissions. We also propose a mechanism to reduce the latency in the scheduling of periodic operations of a software MAC protocol that have strict timing requirements. Results from our six node testbed indicate that using our approach, the scheduling latency of slot transitions in a TDMA-style MAC can be improved by up to an order of magnitude, with minimal overhead. FreeMAC also exports a number of radio configuration parameters as API functions to enable cross layer interactions among wireless networking protocols. As a proof of concept, we implement a simple multi-channel TDMA MAC on our testbed to demonstrate the utility of FreeMAC as a development framework. The IEEE 802.11 standard specifies both radio and MAC protocol design. We observe that its CSMA protocol helps avoid much of co-channel interference by sharing radio resources in time at the potential expense of degraded network performance. Due to the coupling between the physical and MAC layers, conventional frequency allocation methods for typical cellular networks cannot be applied directly to the 802.11 networks. In this paper, by focusing on interactions among access points, we formulate the channel assignment problem for the 802.11 network, considering the traffic load at the MAC layer, and prove that the problem is NP-complete. In light of computational complexity, a heuristic algorithm is proposed and analyzed. The algorithm is then applied to two cellular settings with known optimal assignments for verification. For one of the settings, the proposed technique generates the optimal channel assignment. As for the second case of a large network, although only a suboptimal solution is obtained by the algorithm, it is shown to be excellent. Thus, as the 802.11 networks are widely deployed, the proposed method can serve as a valuable tool for frequency planning of networks with non-uniform coverage and load.