Parsing application layer protocol with commodity hardware for SDN

Abstract

The de facto implementation of Software Defined Networking (SDN), i.e., OpenFlow, only parses L2-L4 headers, which limits the use of SDN to employ control intelligence in application layer. In this paper, we advocate content parsing to empower SDN with finer grained control ability over traffic. Specifically, we propose a scalable content parser, called COPY, to identify and parse application layer protocols. COPY creates a distinguishable counting context free grammar (DCCFG) to specify the protocol's semantics in application layer, and translates multiple DCCFGs into one distinguishable counting automaton (DCA). DCA is generated without semantic loss from the single DCCFG, and thus provides accurate and scalable parsing ability. Our experiments show that COPY precisely identifies every packet in a labeled trace. When comparing with other six approaches on the real traces, COPY performs 4.2Gb/s and 24.7Gb/s with single-and eight-thread models, respectively, which improves 20%-860% than others, and consumes acceptable offline overhead in time and space.Expressive and distinguishable specification ( §4). We propose a distinguishable counting context free grammar (DCCFG) to specify an application by its L7 header or payload. This expressive and user-friendly grammar can distinguish multiple extracting behaviors across protocols. Our evaluations show that DCCFG can express complex protocols in the application layer within only tens of lines of code.High speed parsing structure for multiple protocols ( §5, §6). We employ a distinguishable counting automaton (DCA) to provide linear-complex parsing on the input 978-1-4673-6633-5/15/$31.00

Security and Privacy Issues in Software-Defined Networking (SDN): A Systematic Literature Review

“…Researchers have proposed a number of security solutions for SDN planes to identify, investigate, and mitigate the security threats in their actual contexts [85,86,90,95,96,101].…”

Deep semantics inspection over big network data at wire speed

“…The SPE in SOLID first combines multiple app-specs into a distinguishable automaton, and a one-time parsing on this automaton can identify the protocol and extract the field values simultaneously to assure the high speed processing of the SPE. Please refer to our previous work [7] for the detailed design of the parsing method. Previous literatures are not sufficient for our purpose.…”

“…Other related works identify and parse protocols separately [8,9]. In particular, they either sequentially parse each app-spec, which is obviously not scalable, or set an inaccurate prior identifier to identify the protocol first, which risks the accuracy of the whole system [7].…”