Sonata: query-driven streaming network telemetry

ABSTRACT

Managing and securing networks requires collecting and analyzing network traffic data in real time. Existing telemetry systems do not allow operators to express the range of queries needed to perform management or scale to large traffic volumes and rates. We present Sonata, an expressive and scalable telemetry system that coordinates joint collection and analysis of network traffic. Sonata provides a declarative interface to express queries for a wide range of common telemetry tasks; to enable real-time execution, Sonata partitions each query across the stream processor and the data plane, running as much of the query as it can on the network switch, at line rate. To optimize the use of limited switch memory, Sonata dynamically refines each query to ensure that available resources focus only on traffic that satisfies the query. Our evaluation shows that Sonata can support a wide range of telemetry tasks while reducing the workload for the stream processor by as much as seven orders of magnitude compared to existing telemetry systems.

References

1. Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J. A., Invernizzi, L., Kallitsis, M., et al. Understanding the Mirai botnet. In USENIX Security Symposium (2017).
2. Apache Thrift API. https://thrift.apache.org/.
3. Arashloo, M. T., Koral, Y., Greenberg, M., Rexford, J., and Walker, D. SNAP: Stateful network-wide abstractions for packet processing. In ACM SIGCOMM (2016).
4. Armbrust, M., Xin, R. S., Lian, C., Huai, Y., Liu, D., Bradley, J. K., Meng, X., Kaftan, T., Franklin, M. J., Ghodsi, A., et al. Spark SQL: Relational Data Processing in Spark. In ACM SIGMOD International Conference on Management of Data (2015).
5. Assignment 3, COS 561, Princeton University. https://github.com/Sonata-Princeton/SONATA-DEV/tree/tutorial/sonata/tutorials/Tutorial-1.
6. Bilge, L., Kirda, E., Kruegel, C., and Balduzzi, M. Exposure: Finding malicious domains using passive DNS analysis. In USENIX Network and Distributed System Security Symposium (2011).
7. Borders, K., Springer, J., and Burnside, M. Chimera: A declarative language for streaming network traffic analysis. In USENIX Security Symposium (2012).
8. Bosshart, P., Daly, D., Gibb, G., Izzard, M., McKeown, N., Rexford, J., Schlesinger, C., Talayco, D., Vahdat, A., Varghese, G., and Walker, D. P4: Programming Protocol-independent Packet Processors. ACM SIGCOMM Computer Communication Review 44, 3 (July 2014), 87--95.
9. Bosshart, P., Gibb, G., Kim, H.-S., Varghese, G., McKeown, N., Izzard, M., Mujica, F., and Horowitz, M. Forwarding metamorphosis: Fast programmable match-action processing in hardware for SDN. In ACM SIGCOMM (2013).
10. Cranor, C., Johnson, T., Spatschek, O., and Shkapenyuk, V. Gigascope: A stream database for network applications. In ACM SIGMOD International Conference on Management of Data (2003).
11. The CAIDA UCSD Anonymized Internet Traces 2016-09. http://www.caida.org/data/passive/passive_2016_dataset.xml.
12. Emmerich, P., Gallenmüller, S., Raumer, D., Wohlfart, F., and Carle, G. Moongen: A scriptable high-speed packet generator. In ACM Internet Measurement Conference (2015).
13. Estan, C., Savage, S., and Varghese, G. Automatically inferring patterns of resource consumption in network traffic. In ACM SIGCOMM (2003).
14. Fan, J., Xu, J., Ammar, M. H., and Moon, S. B. Prefix-preserving IP address anonymization: Measurement-based security evaluation and a new cryptography-based scheme. Computer Networks (2004).
15. Gil, T. M., and Poletto, M. MULTOPS: A data-structure for bandwidth attack detection. In USENIX Security Symposium (2001).
16. Gupta, A., Birkner, R., Canini, M., Feamster, N., MacStoker, C., and Willinger, W. Network Monitoring as a Streaming Analytics Problem. In ACM HotNets (2016).
17. Gurobi Solver. http://www.gurobi.com/.
18. Harrison, R., Qizhe, C., Gupta, A., and Rexford, J. Network-Wide Heavy Hitter Detection with Commodity Switches. In ACM Symposium on SDN Research (SOSR) (2018).
19. Hira, M., and Wobker, L. J. Improving Network Monitoring and Management with Programmable Data Planes. Blog posting, http://p4.org/p4/inband-network-telemetry/, September 2015.
20. Izzard, M. The Programmable Switch Chip Consigns Legacy Fixed-Function Chips to the History Books. https://goo.gl/JKWnQc, September 2016.
21. Javed, M., and Paxson, V. Detecting stealthy, distributed SSH brute-forcing. In ACM SIGSAC Conference on Computer & Communications Security (2013), pp. 85--96.
22. Jose, L., Yan, L., Varghese, G., and McKeown, N. Compiling packet programs to reconfigurable switches. In USENIX NSDI (2015).
23. Jose, L., Yu, M., and Rexford, J. Online measurement of large traffic aggregates on commodity switches. In Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (March 2011).
24. Jung, J., Paxson, V., Berger, A. W., and Balakrishnan, H. Fast portscan detection using sequential hypothesis testing. In IEEE Symposium on Security and Privacy (2004), IEEE, pp. 211--225.
25. Kührer, M., Hupperich, T., Rossow, C., and Holz, T. Exit from hell? Reducing the impact of amplification DDoS attacks. In USENIX Security Symposium (2014).
26. Liu, Z., Manousis, A., Vorsanger, G., Sekar, V., and Braverman, V. One sketch to rule them all: Rethinking network flow monitoring with UnivMon. In ACM SIGCOMM (2016).
27. Madden, S., Franklin, M. J., Hellerstein, J. M., and Hong, W. TAG: A Tiny Aggregation Service for Ad-hoc Sensor Networks. In USENIX OSDI (2002).
28. Madden, S. R., Franklin, M. J., Hellerstein, J. M., and Hong, W. TinyDB: An Acquisitional Query Processing System for Sensor Networks. ACM Transaction on Database System 30, 1 (2005).
29. Moshref, M., Yu, M., Govindan, R., and Vahdat, A. Dream: Dynamic resource allocation for software-defined measurement. ACM SIGCOMM (2015).
30. Moshref, M., Yu, M., Govindan, R., and Vahdat, A. Scream: Sketch resource allocation for software-defined measurement. In ACM CoNEXT (2015).
31. Moshref, M., Yu, M., Govindan, R., and Vahdat, A. Trumpet: Timely and precise triggers in data centers. In ACM SIGCOMM (2016).
32. Mullin, J. K. Optimal Semijoins for Distributed Database Systems. IEEE Transactions on Software Engineering 16, 5 (1990).
33. Narayana, S., Arashloo, M. T., Rexford, J., and Walker, D. Compiling path queries. In USENIX NSDI (2016).
34. Narayana, S., Sivaraman, A., Nathan, V., Goyal, P., Arun, V., Alizadeh, M., Jeyakumar, V., and Kim, C. Language-directed Hardware Design for Network Performance Monitoring. In ACM SIGCOMM (2017).
35. Pa, Y. M. P., Suzuki, S., Yoshioka, K., Matsumoto, T., Kasama, T., and Rossow, C. IoTPOT: Analysing the rise of IoT compromises. In USENIX Workshop on Offensive Technology (2015).
36. Polychroniou, O., Sen, R., and Ross, K. A. Track join: Distributed joins with minimal network traffic. In ACM SIGMOD International Conference on Management of Data (2014).
37. An update on the Memcached/Redis benchmark. http://oldblog.antirez.com/post/update-on-memcached-redis-benchmark.html.
38. Apache Flink. http://flink.apache.org/.
39. Benchmarking Apache Kafka: 2 Million Writes Per Second (On Three Cheap Machines). https://engineering.linkedin.com/kafka/benchmarking-apache-kafka-2-million-writes-second-three-cheap-machines.
40. OpenSOC. http://opensoc.github.io/.
41. OpenSOC Scalability. https://goo.gl/CX2jWr.
42. Sonata's technical report. http://www.cs.princeton.edu/~arpitg/pdfs/sonata_tr.pdf.
43. The Bro Network Security Monitor. https://www.bro.org/.
44. The CAIDA Anonymized Internet Traces 2016 Dataset. https://www.caida.org/data/passive/passive_2016_dataset.xml.
45. Slowloris HTTP DoS. https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris, June 2009.
46. Srivastava, U., Munagala, K., and Widom, J. Operator Placement for In-Network Stream Query Processing. In Symposium on Principles of Database Systems (2005).
47. Tammana, P., Agarwal, R., and Lee, M. Simplifying datacenter network debugging with PathDump. In USENIX OSDI (2016).
48. Apache Spark. http://spark.apache.org/.
49. Barefoot's Tofino. https://www.barefootnetworks.com/technology/.
50. P4 software switch. https://github.com/p4lang/behavioral-model.
51. Scapy: Python-based interactive packet manipulation program. https://github.com/secdev/scapy/.
52. SONATA Github. https://github.com/Sonata-Princeton/SONATA-DEV.
53. Sonata Queries. https://github.com/sonata-queries/sonata-queries.
54. Vinnakota, B. P4 with the Netronome Server Networking Platform. https://goo.gl/PKQtC7, May 2016.
55. Wu, Q., Strassner, J., Farrel, A., and Zhang, L. Network telemetry and big data analysis. Network Working Group Internet-Draft (2016 (Expired)).
56. Yu, M., Jose, L., and Miao, R. Software Defined Traffic Measurement with OpenSketch. In USENIX NSDI (2013).
57. Yuan, L., Chuah, C.-N., and Mohapatra, P. ProgME: Towards Programmable Network Measurement. In ACM SIGCOMM (2007).
58. Yuan, Y., Lin, D., Mishra, A., Marwaha, S., Alur, R., and Loo, B. T. Quantitative Network Monitoring with NetQRE. In ACM SIGCOMM (2017).
59. Zaharia, M., Das, T., Li, H., Hunter, T., Shenker, S., and Stoica, I. Discretized streams: Fault-tolerant streaming computation at scale. In ACM SOSP (2013).
60. Zhu, Y., Kang, N., Cao, J., Greenberg, A., Lu, G., Mahajan, R., Maltz, D., Yuan, L., Zhang, M., Zhao, B. Y., and Zheng, H. Packet-level telemetry in large datacenter networks. In ACM SIGCOMM (2015).

Index Terms

• Networks

  • Network services

    • Network monitoring