检索结果-内蒙古大学图书馆

作者： Fabio Miguel Canto Pereira Universidade de Lisboa

学位级别：硕士

Monitoring is a fundamental activity in network management as it provides knowl- edge about the behavior of a network. Different monitoring methodologies have been employed in practice, with sample-based and sketch-based approaches standing out be- cause of their manageable memory requirements. The accuracy provided by traditional sampling-based monitoring approaches, such as NetFlow, is increasingly being consid- ered insufficient to meet the requirements of today's networks. By summarizing all traf- fic for specific statistics of interest, sketch-based alternatives have been shown to achieve higher levels of accuracy for the same cost. Existing switches, however, lack the necessary capability to perform the sort of processing required by this approach. The emergence of programmable switches and the processing they enable in the data plane has recently led sketch-based solutions to be made possible in switching hardware. One limitation of existing solutions is that they lack security. At the scale of the dat- acenter networks that power cloud computing, this limitation becomes a serious concern. For instance, there is evidence of security incidents perpetrated by malicious insiders in- side cloud infrastructures. By compromising the monitoring algorithm, such an attacker can render the monitoring process useless, leading to undesirable actions (such as routing sensitive traffic to disallowed locations). The objective of this thesis is to propose a novel sketch-based monitoring algorithm that is secure. In particular, we propose the design and implementation of a secure and scalable version of the Count-Min algorithm [16, 17], which tracks the frequency of items through a data structure and a set of hash functions. As traditional switches do not have the capabilities to allow these advanced forms of monitoring, we leverage the recently proposed programmable switches. The algorithm was implemented in P4 [11], a pro- grammable language for programmable switches, which

关键词： Monitoring Security Computer Networks Sketches programmable data planes

来源：评论

学校读者我要写书评

暂无评论

Offloading real-time DDoS attack detection to programmable data planes

Offloading real-time DDoS attack detection to programmable d...

引用

作者： Lapolli, Ângelo Cardoso

In recent years, Distributed Denial-of-Service (DDoS) attacks have escalated both in frequency and traffic volume, with outbreaks reaching rates up to the order of terabits per second and compromising the availability of supposedly highly resilient infrastructure (e.g., DNS and cloud-based web hosting). The reality is that existing detection solutions resort to a combination of mechanisms, such as packet sampling and transmission of gathered data to external software, which makes it very difficult (if at all possible) to reach a good compromise for accuracy (higher is better), resource usage footprint, and latency (lower is better). data plane programmability has emerged as a promising approach to help meeting these requirements as forwarding devices can be configured to execute algorithms and examine traffic at line rate. In this thesis, we explore P4 primitives to design a fine-grained, low-footprint, and low-latency traffic inspection mechanism for real-time DDoS attack detection. Our proposal – the first to be fully in-network – contributes to shed light on the challenges to implement sophisticated security logic on forwarding devices given that, to operate at high throughput, the inspection (and overall processing) of packets is subject to a small time budget (dozens of nanoseconds) and limited memory space (in the order of megabytes). We evaluate the proposed mechanism using packet traces from CAIDA. The results show that it can detect DDoS attacks entirely within the data plane with high accuracy (98.2%) and low latency ( 250 ms) while keeping device resource usage low (dozens of kilobytes in SRAM per 1 Gbps link and a few hundred TCAM entries). ...

关键词： Redes : Computadores Network Security Seguranca : Redes : Computadores programmable data planes DDoS Attacks Dissertação

来源：评论

学校读者我要写书评

暂无评论

Introducing packet-level analysis in programmable data planes to advance Network Intrusion Detection

引用

COMPUTER NETWORKS 2024年 239卷

作者： Doriguzzi-Corin, Roberto Knob, Luis Augusto Dias Mendozzi, Luca Siracusa, Domenico Savi, Marco Fdn Bruno Kessler Cybersecur Ctr Trento Italy Univ Milano Bicocca Dept Informat Syst & Commun DISCo Milan Italy

programmable data planes offer precise control over the low-level processing steps applied to network packets, serving as a valuable tool for analysing malicious flows in the field of intrusion detection. Albeit with limitations on physical resources and capabilities, they allow for the efficient extraction of detailed traffic information, which can then be utilised by Machine Learning (ML) algorithms responsible for identifying security threats. In addressing resource constraints, existing solutions in the literature rely on compressing network data through the collection of statistical traffic features in the data plane. While this compression saves memory resources in switches and minimises the burden on the control channel between the data and the control plane, it also results in a loss of information available to the Network Intrusion Detection System (NIDS), limiting access to packet payload, categorical features, and the semantic understanding of network communications, such as the behaviour of packets within traffic flows. This paper proposes P4DDLe, a framework that exploits the flexibility of P4-based programmable data planes for packet-level feature extraction and pre-processing. P4DDLe leverages the programmable data plane to extract raw packet features from the network traffic, categorical features included, and to organise them in a way that the semantics of traffic flows are preserved. To minimise memory and control channel overheads, P4DDLe selectively processes and filters packet-level data, so that only the features required by the NIDS are collected. The experimental evaluation with recent Distributed Denial of Service (DDoS) attack data demonstrates that the proposed approach is very efficient in collecting compact and high-quality representations of network flows, ensuring precise detection of DDoS attacks.

关键词： programmable data planes Network Intrusion Detection Packet-level features

来源：评论

学校读者我要写书评

暂无评论

MLDDoS: a distributed denial of service attack detection method using multi-level sketch

引用

JOURNAL OF SUPERCOMPUTING 2025年第2期81卷 1-36页

作者： Xiao, Junbi Sun, Ruifeng Liu, Jianhang China Univ Petr East China Qingdao Inst Software Coll Comp Sci & Technol Qingdao 266580 Peoples R China

Distributed Denial of Service (DDoS) attacks pose a severe threat to network stability, and detecting them remains a significant challenge. Solutions based on programmable data planes and sketches have become a research hotspot. However, existing works, which are based on generic sketches, focus solely on the use of statistical results for large traffic flows, neglecting the inherent information within the large traffic itself. This could lead to additional costs for administrators in obtaining information about large traffic flows. To address this, we have designed a Multi-Level Sketch on the data plane to record detailed information of large flows and statistical information of small flows. In the control plane, we use the collected information to calculate the normalized entropy of the source IP addresses of network traffic, implementing an adaptive threshold detection scheme, a state control mechanism, and a traffic marking mechanism based on information from large flows. We validated the differences between Multi-Level Sketch and state-of-the-art methods on the public datasets CAIDA Anonymized Internet Traces 2019 and CAIDA DDoS 2007 using the same space size. The experimental results show that the average relative error difference between Multi-Level Sketch and Elastic Sketch is between 0.0383 and 2.82. In terms of information entropy estimation, the relative error of Multi-Level Sketch is 2.27 to 2.99 times lower than that of Elastic Sketch. In terms of true positive rate, false positive rate, and detection accuracy in DDoS attack detection, our method outperforms state-of-the-art methods.

关键词： Software-defined networks programmable data planes P4 Sketch DDoS detection

来源：评论

学校读者我要写书评

暂无评论

5G Fronthaul in Modular P4: eCPRI Protocol Processing and Precise BMv2 Timestamps for PTP-1588

引用

IEEE ACCESS 2025年 13卷 22710-22727页

作者： Nojavan, Atabak Pontikakis, Bill Boyer, Francois-Raymond Savaria, Yvon Polytech Montreal Dept Elect Engn Montreal PQ H3T 1J4 Canada Polytech Montreal Dept Comp & Software Engn Montreal PQ H3T 1J4 Canada

P4, a domain-specific language (DSL) for programming network devices, offers flexibility in defining packet processing behaviors. This paper demonstrates the use of P4 to achieve modular eCPRI protocol processing and enhanced PTP-1588 synchronization, both critical for 5G fronthaul applications in Open Radio Access Network (O-RAN) environments. By implementing an eCPRI packet processing unit based on the eCPRI Specification Version 2 and inspired by Intel's FPGA-based IP, we enable modular addition of new message types and custom packet processing functionality in P4. Our approach reduced lines of code per type by 85% and decreased configuration time by up to 5x compared to traditional methods, significantly simplifying complexity. Additionally, we introduce precise ingress and automatic egress timestamps for the BMv2 software switch to improve PTP-1588 accuracy, reducing error margins from 24,000 microseconds to 60 microseconds (99.75% improvement) and achieving sub-microsecond precision. Extensive testing in a Mininet environment validates these improvements, demonstrating enhanced precision and flexibility in handling time-sensitive protocols. While this paper focuses on 5G fronthaul applications in O-RAN networks, the techniques and results presented are equally applicable to other use cases across end-to-end 5G networks and beyond, paving the way for modular, high-precision, and programmable solutions in future open and interoperable network architectures.

关键词： Payloads Protocols Amplitude modulation Logic 5G mobile communication Pipelines Open RAN data mining Synchronization IP networks 5G BMv2 eCPRI IEEE 1588 PTP modularity O-RAN fronthaul packet aggregation packet concatenation programmable data planes P4

来源：评论

学校读者我要写书评

暂无评论

DNSGuard: In-Network Defense Against DNS Attacks

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2025年第1期22卷 597-613页

作者： Duan, Guanglin Li, Qing Zhang, Zhengxin Zhao, Dan Xie, Guorui Yang, Yuan Yuan, Zhenhui Jiang, Yong Xu, Mingwei Peng Cheng Lab Shenzhen 518055 Guangdong Peoples R China Tsinghua Shenzhen Int Grad Sch Shenzhen 518057 Peoples R China Tsinghua Univ Dept Comp Sci Beijing 100084 Peoples R China Northumbria Univ Dept Comp & Informat Sci Newcastle Upon Tyne NE1 8ST England

The Domain Name System (DNS) is a growing center of cyber attacks, including both volumetric and non-volumetric attacks. programmable switches provide a new opportunity for more efficient defense against DNS attacks since they can offer better cost, performance, and flexibility trade-offs compared to traditional defense systems. However, programmable switches have strict limitations on the operations and storage space supported to ensure line-speed packet processing. In this paper, we propose DNSGuard, an intelligent in-network defense framework that can handle volumetric and non-volumetric DNS attacks on programmable switches. We propose a recursive incremental parsing algorithm that can effectively extract variable-length domain names. To achieve real-time and accurate detection against two types of DNS attacks, we design a switch-optimized and resource-efficient algorithm to extract both independent features of each packet and domain-based cumulative features. Then, we propose a multi-phase hybrid model architecture to perform dynamic packet analysis at different time phases of a domain. Further, we design efficient model representation mechanisms to deploy tree-based ensemble models in the data plane. Experimental results show that DNSGuard can defend against diverse DNS attacks at the line rate. In addition, DNSGuard introduces a minimal nanosecond latency to normal traffic in heavily loaded networks.

关键词： Domain Name System Computer crime Servers Feature extraction Tunneling Malware IP networks DDoS detection DNS DNS attacks machine learning network security p4 programmable data planes

来源：评论

学校读者我要写书评

暂无评论

In-Network Volumetric DDoS Victim Identification Using programmable Commodity Switches

引用

IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT 2021年第2期18卷 1191-1202页

作者： Ding, Damu Savi, Marco Pederzolli, Federico Campanella, Mauro Siracusa, Domenico Fdn Bruno Kessler Ctr Informat & Commun Technol I-38123 Trento Italy Univ Bologna Dept Elect Elect & Informat Engn I-40126 Bologna Italy Univ Milano Bicocca Dept Informat Syst & Commun I-20126 Milan Italy GARR I-00185 Rome Italy

Volumetric distributed Denial-of-Service (DDoS) attacks have become one of the most significant threats to modern telecommunication networks. However, most existing defense systems require that detection software operates from a centralized monitoring collector, leading to increased traffic load and delayed response. The recent advent of data Plane Programmability (DPP) enables an alternative solution: threshold-based volumetric DDoS detection can be performed directly in programmable switches to skim only potentially hazardous traffic, to be analyzed in depth at the controller. In this paper, we first introduce the BACON data structure based on sketches, to estimate per-destination flow cardinality, and theoretically analyze it. Then we employ it in a simple in-network DDoS victim identification strategy, INDDoS, to detect the destination IPs for which the number of incoming connections exceeds a pre-defined threshold. We describe its hardware implementation on a Tofino-based programmable switch using the domain-specific P4 language, proving that some limitations imposed by real hardware to safeguard processing speed can be overcome to implement relatively complex packet manipulations. Finally, we present some experimental performance measurements, showing that our programmable switch is able to keep processing packets at line-rate while performing volumetric DDoS detection, and also achieves a high F1 score on DDoS victim identification.

关键词： Computer crime Denial-of-service attack Hash functions Registers Monitoring IP networks data structures Anomaly detection programmable data planes DDoS victim identification P4

来源：评论

学校读者我要写书评

暂无评论

DESiRED - Dynamic, Enhanced, and Smart iRED: A P4-AQM with Deep Reinforcement Learning and In-band Network Telemetry

引用

COMPUTER NETWORKS 2024年 244卷

作者： de Almeida, Leandro C. de Silva, Washington Rodrigo Dias x Tavares, Thiago C. Pasquini, Rafael Papagianni, Chrysa Verdi, Fabio L. Fed Inst Paraiba Acad Unit Informat Joao Pessoa PB Brazil Univ Fed Sao Carlos Dept Comp Sci Sorocaba SP Brazil Univ Fed Uberlandia Fac Comp Uberlandia MG Brazil Univ Amsterdam Informat Inst Amsterdam Netherlands Fed Inst South Minas Gerais IFSULDEMINAS Pocos De Caldas MG Brazil

Active Queue Management (AQM) is a mechanism employed to alleviate transient congestion in network device buffers, such as routers and switches. Traditional AQM algorithms use fixed thresholds, like target delay or queue occupancy, to compute random packet drop probabilities. A very small target delay can increase packet losses and reduce link utilization, while a large target delay may increase queueing delays while lowering drop probability. Due to dynamic network traffic characteristics, where traffic fluctuations can lead to significant queue variations, maintaining a fixed threshold AQM may not suit all applications. Consequently, we explore the question: What is the ideal threshold (target delay) for AQMs? In this work, we introduce DESiRED (Dynamic, Enhanced, and Smart iRED), a P4-based AQM that leverages precise network feedback from In -band Network Telemetry (INT) to feed a Deep Reinforcement Learning (DRL) model. This model dynamically adjusts the target delay based on rewards that maximize application Quality of Service (QoS). We evaluate DESiRED in a realistic P4-based test environment running an MPEG-DASH service. Our findings demonstrate up to a 90x reduction in video stall and a 42x increase in high-resolution video playback quality when the target delay is adjusted dynamically by DESiRED.

关键词： Active Queue Management Deep Reinforcement Learning In-band Network Telemetry Quality of Service programmable data planes

来源：评论

学校读者我要写书评

暂无评论

Tracking Normalized Network Traffic Entropy to Detect DDoS Attacks in P4

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2022年第6期19卷 4019-4031页

作者： Ding, Damu Savi, Marco Siracusa, Domenico Univ Oxford Oxford OX1 2JD England Univ Milano Bicocca I-20126 Milan Italy Fdn Bruno Kessler I-38123 Trento Italy

Distributed Denial-of-Service (DDoS) attacks represent a persistent threat to modern telecommunications networks: detecting and counteracting them is still a crucial unresolved challenge for network operators. DDoS attack detection is usually carried out in one or more central nodes that collect significant amounts of monitoring data from networking devices, potentially creating issues related to network overload or delay in detection. The dawn of programmable data planes in Software-Defined Networks can help mitigate this issue, opening the door to the detection of DDoS attacks directly in the data plane of the switches. However, the most widely-adopted data plane programming language, namely P4, lacks supporting many arithmetic operations, therefore, some of the advanced network monitoring functionalities needed for DDoS detection cannot be straightforwardly implemented in P4. This work overcomes such a limitation and presents two novel strategies for flow cardinality and for normalized network traffic entropy estimation that only use P4-supported operations and guarantee a low relative error. Additionally, based on these contributions, we propose a DDoS detection strategy relying on variations of the normalized network traffic entropy. Results show that it has comparable or higher detection accuracy than state-of-the-art solutions, yet being simpler and entirely executed in the data plane.

关键词： Entropy Denial-of-service attack Monitoring Estimation Computer crime Hamming weight Pipelines Network monitoring programmable data planes P4 normalized network traffic entropy DDoS detection

来源：评论

学校读者我要写书评

暂无评论

SECAP Switch-Defeating Topology Poisoning Attacks Using P4 data planes

引用

JOURNAL OF NETWORK AND SYSTEMS MANAGEMENT 2023年第1期31卷 1-32页

作者： Smyth, Dylan Scott-Hayward, Sandra Cionca, Victor McSweeney, Sean O'Shea, Donna Munster Technol Univ Dept Comp Sci Cork Ireland Queens Univ Belfast Ctr Secure Informat Technol Belfast North Ireland

programmable networking is evolving from programmable control plane solutions such as OpenFlow-based software-defined networking (SDN) to programmable data planes such as P4-based SDN. To support the functionality of the SDN, the correct view of the network topology is required. However, multiple attacks aimed at topology poisoning have been demonstrated in SDNs. While several controller-centralised security solutions have been proposed to defeat topology poisoning attacks, some attacks e.g., the data Plane ARP Cache Poisoning Attack and the relay-type Link Fabrication Attack are difficult to detect using a fully centralised security solution. In this paper, we present the Security-Aware programmable (SECAP) Switch-a lightweight, in-network, P4-based security solution that is designed to prevent attacks that might otherwise evade control plane solutions. The SECAP switch verifies source address details contained within the headers of protocols commonly used to perform topology poisoning attacks. This function is supported by a novel variance-based anomaly detection solution to provide a layered defence. We demonstrate the ability of the SECAP switch to defeat topology poisoning attacks with minimal memory and processing overhead.

关键词： Software-defined networking programmable data planes p4 Security Topology poisoning

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：