Deep Packet Inspection as a Service Author Anat

Deep Packet Inspection as a Service Author : Anat Bremler-Barr, Yotam Harchol, David Hay and Yaron Koral Conference: ACM 10 th International Conference on emerging Networking EXperiments and Technologies(Co. NEXT), 2014 Presenter: Kuan-Chieh Feng Date: 2015/10/07 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R. O. C.

Outline l l l Introduction Architecture DPI Service Instance Implementation Experiment Result Conclusion National Cheng Kung University CSIE Computer & Internet Architecture Lab 2

Introduction - DPI Based Middleboxes DPI Intrusion Detection System Network Analytic Traffic Shaper Network Anti-Virus Copyright Enforcement Lawful Interception L 7 Firewall L 7 Load Balancer Leakage Prevention System National Cheng Kung University CSIE Computer & Internet Architecture Lab 3

Introduction l l Each MB implements its own DPI engine (higher MB costs) Each packet is scanned multiple times causing waste of computation resources National Cheng Kung University CSIE Computer & Internet Architecture Lab 4

Introduction l l DPI engine is the most time-consuming task and it may take most of the middlebox processing time. DPI engine is considered a system bottleneck in many of todays MBs (30%80%) [*Laboratory simulations over real deployments of Snort and Clam. AV] National Cheng Kung University CSIE Computer & Internet Architecture Lab 5

Introduction l The idea of having a centralized DPI service instead of multiple instances of it at each Middlebox. National Cheng Kung University CSIE Computer & Internet Architecture Lab 6

Introduction l SDN (Software Define Network) • SDN makes it possible to perform traffic steering. • This paper uses this flexibility to route traffic to a DPI service when needed. l NFV (Network Function Virtualization) • The main objective of NFV is to reduce the • • operational costs of these appliances. NFV provides easier management and maintenance. DPI is a significant example of an appliance or functionality that may be virtualized. National Cheng Kung University CSIE Computer & Internet Architecture Lab 7

Introduction l Aho-Corasick algorithm (AC algorithm) • The AC algorithm is the de-facto standard for • contemporary network intrusion detection systems (NIDS). It matches strings simultaneously by constructing a DFA that represents the pattern set. National Cheng Kung University CSIE Computer & Internet Architecture Lab 8

National Cheng Kung University CSIE Computer & Internet Architecture Lab 9

Introduction l Pattern set : {EDAE, BE, CDBA, CBD} E C B D E E D A D E D B E B D A National Cheng Kung University CSIE Computer & Internet Architecture Lab 10

Architecture DPI Controller Traffic Steering Update Policy Chain Add Patterns Register Rules SDN Controller AV 1 TS DPI 1 hello DPI 2 S 1 S 4 hello S 3 AV 2 IDS 2 hello IDS 1 L 7 FW 1 11

Architecture – DPI controller l l DPI controller is a centralized entity to manage the DPI process across the network. Two kinds of procedures take place between the DPI Controller and middleboxes. • Register • Pattern set management l DPI controller is also responsible for initializing DPI service instances and deployment of different DPI service instances across the network National Cheng Kung University CSIE Computer & Internet Architecture Lab 12

Architecture – Passing Pattern Matching Result l Network Service Header (NSH) hello l Separate result-packet • Delay packet until result-packet arrives hello National Cheng Kung University CSIE Computer & Internet Architecture Lab 13

Architecture – Deployment l l A common deployment choice is to group together similar policy chains and to deploy instances. For example: • Sets of patterns that correspond to HTTP traffic may be allocated to some DPI service instance while patterns correspond to FTP traffic is allocated to other DPI service instance. National Cheng Kung University CSIE Computer & Internet Architecture Lab 14

DPI Service Instance Implementation l National Cheng Kung University CSIE Computer & Internet Architecture Lab 15

DPI Service Instance Implementation l National Cheng Kung University CSIE Computer & Internet Architecture Lab 16

DPI Service Instance Implementation l National Cheng Kung University CSIE Computer & Internet Architecture Lab 17

DPI Service Instance Implementation 0 10 1 11 2 11 3 10 4 10 5 10 6 10 7 11 8 01 Pattern set 2 Both sets Pattern Set 1 Pattern Set 2 18

DPI Service Instance Implementation l <x 21 DOCTYPEs+[^>]*SYSTEM[^>]*>. *x 2 Eparse. Error <x 21 DOCTYPE SYSTEM x 2 Eparse. Error National Cheng Kung University CSIE Computer & Internet Architecture Lab 19

Experimental Environment l POX SDN Controller (Open. Flow 1. 0) l Static steering mechanism DPI Service and Middlebox using separate machines Toy middlebox applications: Snort, Clam. AV Functionality: Tested in virtual environments l l l Static Steering DPI Controller Runs over POX SDN Controller (Mininet, VMWare) Toy Snort 1 DPI Service Instance Toy Clam. AV Toy Snort 2 20 Virtual Environment

Experiment Results - Performance Patterns Space Throughput Latency Snort 4356 71. 18 MB 807. 7 Mbps 9. 69 us/p Clam. AV 31827 1. 87 GB 668. 4 Mbps 11. 91 us/p Overall Throughput Overall Latency 668. 4 Mbps 21. 5 us/p Policy Chain with Two DPIs : IDS 1 AV 1 Each using separate machines Combined DPI instances (DPI as a Service): DPI 1 IDS 1 DPI 2 AV 1 National Cheng Kung University CSIE Computer & Internet Architecture Lab 21

Experiment Results – Road Traffic Two separate policy chains: IDS 1 Separate IDSs: Static Load Balancing AV 1 Combined DPI instances (DPI as a Service): DPI 1 IDS 1 DPI 2 DPI as a Service: Dynamic Load Balancing AV 1 National Cheng Kung University CSIE Computer & Internet Architecture Lab 22

Conclusion l l l DPI is a common service used by today’s MB Thanks to its scalability it may be easily exported as a stand-alone network service DPI as a Service provides: • Innovation (Lower entry barriers) • Network scalability • Lower costs (Cheaper MB Hardware) National Cheng Kung University CSIE Computer & Internet Architecture Lab 23