The fast evolving nature of modern cyber threats and network monitoring needs calls for new, "software-defined", approaches to simplify and quicken programming and deployment of online (stream-based) traffic analysis functions. StreaMon is a carefully designed data-plane abstraction devised to scalably decouple the "programming logic" of a traffic analysis application (tracked states, features, anomaly conditions, etc.) from elementary primitives (counting and metering, matching, events generation, etc), efficiently pre-implemented in the probes, and used as common instruction set for supporting the desired logic. Multi-stage multi-step real-time tracking and detection algorithms are supported via the ability to deploy custom states, relevant state transitions, and associated monitoring actions and triggering conditions. Such a separation entails platform-independent, portable, online traffic analysis tasks written in a high level language, without requiring developers to access the monitoring device internals and program their custom monitoring logic via low level compiled languages (e.g., C, assembly, VHDL). We validate our design by developing a prototype and a set of simple (but functionally demanding) use-case applications and by testing them over real traffic traces.
Network monitoring and measurement is commonly regarded as an essential function for understanding, managing and improving the performance and security of network infrastructures. Traditional passive network monitoring approaches are not adequate for fine-grained performance measurements nor for security applications. In addition, many applications would benefit from monitoring data gathered at multiple vantage points within a network infrastructure. This paper presents the design and implementation of DiMAPI, an application programming interface for distributed passive network monitoring. DiMAPI extends the notion of the network flow with the scope attribute, which enables flow creation and manipulation over a set of local and remote monitoring sensors. Experiments with a number of applications on top of DiMAPI show that it has reasonable performance, while the response latency is very close to the actual round trip time between the monitoring application and the monitoring sensors. A broad range of monitoring applications can benefit from DiMAPI to efficiently perform advanced monitoring tasks over a potentially large number of passive monitoring sensors.  A device is provided for influencing starting of an internal combustion engine of a motor vehicle that has an electronically controlled gearbox, an electrically acting interlock that prevents the internal combustion engine from being put into operation when a gearbox status causing a driving force connection is selected, and a starter with an electromagnetic disengagement switch that is suppliable with battery current from an ignition switch during actuation of the starter. The device has an electronic engine control unit for at least one of ignition and metering of fuel, with a communicative connection communicatively connecting the engine control unit to the gearbox control. A direct connection is provided from the ignition switch to the electromagnetic disengagement switch for supplying battery current to the electromagnetic disengagement switch without an intermediate disabling switch. A recorder records the position of an element influencing the gear-selection status of the gearbox and transmits a corresponding signal to the gearbox control. The gearbox control acts upon the engine control unit via the communicative connection to disable at least one of the ignition and the fuel metering when the element influencing the gear-selection status of the gearbox is in a position which normally effects a driving force connection through the gearbox.